<div align="center">
<h1>MCP SSH Orchestrator</h1>
<img src="assets/logo/logo-v1.png" alt="MCP SSH Orchestrator Logo" width="200" height="200">
<h1>Zero-Trust SSH Orchestration for AI Assistants</h1>
<p><strong>Enforce declarative policy-as-code and audited access for Claude Desktop, Cursor, and any MCP-aware client.</strong></p>
<p>Launch in minutes with Docker + MCP tooling, deny-by-default controls, and hardened SSH key management.</p>
</div>
<div align="center">
<img src="assets/demo.gif" alt="MCP SSH Orchestrator Demo">
</div>
What Problem Does This Solve?
Imagine this: Your AI assistant (Claude, ChatGPT, etc.) can access your servers, but you're terrified of what it might do. rm -rf /? Delete your databases? Change firewall rules?
Now imagine this: Your AI has governed, auditable access to your infrastructure. It can check logs, restart services, and manage your fleet, but only if your security policies allow it.
That's exactly what MCP SSH Orchestrator provides: the power of AI-driven server management with deny-by-default access control, IP allowlists, host key verification, and comprehensive audit logging backed by declarative YAML policy-as-code (config/servers.yml, config/credentials.yml, config/policy.yml).
Why This Matters
Zero-Trust Security Model
- Deny-by-default: Nothing runs unless explicitly allowed
- Network controls: IP allowlists prevent lateral movement
- Command whitelisting: Only approved commands can execute
- Declarative policy-as-code: Versioned YAML files define hosts, credentials, and allowed commands
- Comprehensive audit trails: Every action is logged in JSON
Prevents Common Attack Vectors
- Dangerous commands blocked:
rm -rf, dd, file deletions
- Network isolation: Servers can't access external internet
- No privilege escalation: Runs as non-root in containers
- Resource limits: CPU and memory caps prevent DOS
Production-Ready Audit & Security
- OWASP LLM Top 10 protected: Mitigates LLM07 (Insecure Plugin Design), LLM08 (Excessive Agency), LLM01 (Prompt Injection)
- MITRE ATT&CK aligned: Prevents T1071 (Application Layer Protocol), T1659 (Content Injection)
- Structured JSON audit logs: Complete audit trail with timestamps, hashes, and IPs
- Forensics ready: Command hashing, IP tracking, detailed metadata
- Real-time monitoring: Progress logs for long-running tasks
Who Is This For?
Homelab Enthusiasts
- Automate routine server maintenance with AI
- Safely manage Proxmox, TrueNAS, Docker hosts
- Get help troubleshooting without losing SSH security
Security Engineers
- Audit and control AI access to infrastructure
- Implement zero-trust principles with declarative policy-as-code configs
- Meet compliance requirements with structured logging
DevOps Teams
- Let AI handle routine tasks: log checks, service restarts, updates
- Manage fleets of servers through conversational interface
- Reduce manual toil while maintaining security standards
Platform Engineers
- Enable AI-powered infrastructure management
- Provide secure self-service access to developers
- Bridge the gap between AI and infrastructure securely
Real-World Use Cases
Scenario 1: Homelab Automation (Homelab Enthusiasts)
You say: "Claude, my Proxmox host is running slow. Can you check disk usage and memory on all my VMs?"
What happens
- Policy allows
df -h and free -m on Proxmox hosts
- Network check: Private IP allowlist permits access
- Tag-based execution checks all hosts tagged
proxmox
- Commands execute safely with no destructive operations
- Complete audit trail stored in JSON logs
Scenario 2: Incident Response (DevOps Teams)
You say: "We're seeing 500 errors. Check nginx logs across all production web servers and show me the last 100 error lines."
What happen…
