Advertise
MCP.so
Sign In
S

Shellguard MCP Server

@jonchun

Repository

Basic information

Category

Developer Tools

Transports

stdio

Author

jonchun

Submitted by

Jonathan Chun

About Shellguard MCP Server

ShellGuard is an MCP server that lets LLM agents securely SSH into remote Linux hosts with read-only shell access. Instead of copy-pasting terminal output, your AI can run safe diagnostics, inspect logs, query systems, and troubleshoot production, staging, or dev environments aut

#mcp#mcp-server#llm-tools#ai-agents#agent-infrastructure#developer-tools#cli#automation#devops#sysadmin#sre#infrastructure#linux#unix#bash#shell#ssh#remote-access#diagnostics#troubleshooting#log-inspection#observability#incident-response#aiops#llm-infrastructure#agentic-debugging#hands-free-debugging#ai-assisted-ops#secure-by-default#read-only#least-privilege#production-safe

Shellguard MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "shellguard": {
      "command": "shellguard"
    }
  }
}

Shellguard MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Shellguard?

Shellguard is an MCP server that gives LLM agents read-only bash access to remote servers over SSH. It allows AI assistants to run diagnostics, inspect logs, query databases, and troubleshoot remote servers without manual context-switching. Commands are restricted to a curated set of read-only tools; destructive operations are blocked with actionable suggestions.

How to use Shellguard?

Install via Homebrew (brew install jonchun/tap/shellguard), curl, or Go install. Then add it as a stdio MCP server to your client (Cursor, Claude Desktop, Claude Code, OpenCode, VS Code, Zed, Roo Code) using the command shellguard with no arguments. Configuration for SSH can be set in a YAML file (~/.config/shellguard/config.yaml) or via environment variables.

Key features of Shellguard

  • Exposes seven read-only tools: connect, execute, list_commands, disconnect, provision, download_file, sleep
  • Parses shell commands into AST and rejects unsafe syntax
  • Validates commands against an allowlist with explicit denylist
  • Supports native (built-in) and system (local ssh binary) SSH modes
  • Verifies host keys with accept-new, strict, or off modes
  • Probes and provisions diagnostic tools (rg, jq, yq) on remote hosts

Use cases of Shellguard

  • Investigate production incidents by running diagnostics on remote servers
  • Query databases or inspect logs without leaving the AI chat interface
  • Troubleshoot server behaviour by executing read-only commands
  • Deploy common diagnostic tools to servers that lack them

Frequently asked questions

1

What commands can the LLM run?

Only read-only commands from a curated allowlist. Every command is parsed, validated against the allowlist, reconstructed to prevent injection, and then executed with per-command timeouts and output truncation.

2

How does Shellguard prevent destructive actions?

Commands are parsed into an AST; shell tricks like semicolons, redirections, and command substitution are rejected at the syntax level. Destructive operations (e.g., `wget -r`, `tail -f`, `sed`) are blocked with specific suggestions so the LLM can self-correct.

3

What SSH authentication methods are supported?

Shellguard tries in order: explicit key (`identity_file` parameter in `connect`), ssh-agent, then default keys (`~/.ssh/id_ed25519`, `id_ecdsa`, `id_rsa`). Passphrase-protected keys are silently skipped unless specified via `identity_file`, which will cause a fatal error.

4

Can I use bastion hosts or ProxyJump?

Yes. Shellguard offers a "system" SSH mode that uses the local `ssh` binary, providing full support for `ProxyJump`, `ProxyCommand`, and `Match` blocks. Native mode (default) does not support these features, so switch to system mode if your infrastructure requires them.

5

What are the size and timeout limits?

The `download_file` tool has a 50MB limit. The `sleep` tool can wait up to 15 seconds between diagnostic checks. Per-command timeouts and output truncation are applied automatically.

Comments

More Developer Tools MCP servers

Yocoolab

Yocoolab

MCP server for AI Agents — exposes Yocoolab feedback threads and design selections as tools

1

Eddyter AI Rich Text Editor MCP

EddyterAI

Set up and manage the Eddyter AI rich text editor by talking to your AI agent — for Claude, Cursor, Codex and other MCP tools. A Model Context Protocol server that lets AI tools add Eddyter to a React, Next.js, Vite or R

9

Cronwatch

cronwatchdev

CronWatch records every run of your scheduled jobs in your own database, and speaks up when one is missed, fails, gets stuck, runs slow or costs too much. CronWatch is free and open-source.

31

screenshotrun-mcp

screenshotrun

Give your AI agent the ability to see any webpage. Capture screenshots from Claude, Cursor, or any MCP client. Supports full-page, dark mode, mobile emulation, OG image generation, base64 output, custom viewport, ad bloc

offprompt

offprompt

MCP server that lets Claude Code, Cursor or Codex ask you for API keys on a local page and write them to .env. The agent only ever sees key names.

2
Advertise