Verified

Remote Fs MCP Server

Remote Linux servers managed via SSH, providing Docker, Git, and network control.

Data last scanned today · Reviewed today

39 13 dangerous tools66 tools★ 0TypeScriptMIT

Overview

Remote Fs MCP Server enables full remote Linux management through an SSH-based interface. It offers a broad suite of capabilities including file system access, shell execution, process management, and systemd service control, alongside integrated tools for Docker container management and Git repository operations. The server emphasizes operational visibility by incorporating persistent NDJSON audit logs, automatic secret redaction for sensitive patterns, and a Prometheus metrics endpoint. Designed for complex workflows, it includes high-level utilities like `deploy_compose` for automated uploads and deployment, and network diagnostic tools such as `net_ping` and `net_traceroute`.

Our verdict

With a security score of 24/100, this server is classified as high-risk. This rating stems from the fact that the project is community-maintained rather than vendor-official and has not undergone an independent editorial review, meaning users should exercise caution. Given the tool's deep access to system shells and Docker environments, it is best suited for experienced administrators who can independently verify the implementation and audit logs.

Supports persistent NDJSON audit logs with automatic secret redaction.
Includes Prometheus metrics and Kubernetes-style health check endpoints.
Provides nineteen specialized tools for Docker, Git, and networking.
Features automatic retry logic for transient SSH connection errors.

Security score of 24/100 indicates significant unverified risk.
Community-maintained project with no formal vendor oversight.
Lacks external editorial review of authentication and read-only modes.
Single-contributor repository increases bus-factor dependency.

Setup

Claude Desktop

{
  "mcpServers": {
    "remote-fs-mcp-server": {
      "args": [
        "-y",
        "remote-fs-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
ssh_connect	Open a session	medium
ssh_disconnect	Close it	low
ssh_status	Connection state (host, port, user, mode, uptime)	low
ssh_reconnect	Reconnect with the cached config	medium
fs_list	List directory (recursive, paginated)	low
fs_read	Read file (text/base64, with line range, byte cap)	low
fs_write	Overwrite file (text or base64)	medium
fs_append	Append to file	medium
fs_delete	Delete file	high
fs_move	Rename/move	medium

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›How can I prevent the server from modifying files or executing system changes?

You can enable read-only mode by setting the MCP_READ_ONLY environment variable to true, which filters out all mutating tools and restricts execution tools to read-only status and log commands.

›What mechanisms are in place to prevent path traversal or unauthorized file access?

The server supports path allowlisting via the MCP_ALLOWED_REMOTE_ROOTS and MCP_ALLOWED_LOCAL_ROOTS environment variables, which restrict all path-taking tools to specified directories.

›Does the server provide any security features for SSH connections?

Yes, the server supports SSH host-key verification by allowing you to pin a SHA256 fingerprint or use your ~/.ssh/known_hosts file, with strict host-key checking available.

›How are sensitive credentials handled in audit logs?

The server automatically scrubs secret patterns such as AWS keys, GitHub/GitLab tokens, JWTs, and passwords from both audit logs and error messages.

›Can I monitor tool usage and performance metrics?

Yes, the server exposes a Prometheus /metrics endpoint that includes tool call counters, duration histograms, and session gauges, which are protected by a bearer token.

›Are there limits on resource usage during remote shell execution?

Yes, all execution tools enforce a default timeout of 60 seconds and a maximum stream size of 2 MiB to prevent memory exhaustion and runaway processes.