Securing Model Context Protocol SSH Clients: Five Core Checks for Coding Agents
Giving coding agents SSH access using basic wrapper scripts risks credential leakage and uncontained shell execution. Modern tools like Termalin introduce key custodianship and granular per-host command policies for agentic workflows.
Why it matters
Harden your agent terminal permissions today by removing static SSH keys from agent contexts and enforcing strict command allowlists.
TL;DR
- 01Never place raw SSH keys in agent tool configuration files or environment variables.
- 02Enforce command allowlists on the client/proxy side before commands reach the remote shell.
- 03Use headless endpoints with short-lived certificates for CI/CD workflows instead of static credentials.
Key facts
- Key Storage Model
- Cryptographic custodian (agent never holds private key)
- Supported Local Platforms
- Windows, macOS, Linux, iOS
- Execution Safeguards
- Per-host command policies (full / allowlist / blocked)
Key Custodianship Versus Plain File Access
Passing private SSH keys into an agent's runtime environment allows model transcripts and telemetry logs to capture credential bytes. A key custodian pattern solves this:
- Custodian Signing: The built-in MCP server signs SSH handshakes on behalf of the agent.
- Zero Key Context: No private key files or raw bytes ever pass into prompts, tool arguments, or agent memory.
Per-Host Execution Policies
Restricting command execution requires policy enforcement at the proxy layer, independent of model obedience:
- Host Statuses: Servers must be explicitly toggled to full access, allowlisted, or blocked.
- Command Whitelists: Execution is rejected locally before the command dispatches if it does not match configured safe patterns.
Dual Local and Headless Architecture
Local stdio binaries such as termalin-mcp integrate directly into local developer environments across macOS, Windows, and Linux for Claude Code, Cursor, Codex, and Gemini. For cloud sandboxes and CI/CD pipelines, secure clients utilize hosted HTTPS endpoints that issue scoped, short-lived certificates rather than persistent root credentials.
Try it in 2 minutes
{
"mcpServers": {
"termalin": {
"command": "termalin-mcp",
"args": ["--policy", "allowlist-only"]
}
}
}json
✓ When to use
- Granting Claude Code, Cursor, Codex, or Gemini agents access to remote servers.
- Running autonomous server maintenance tasks in CI/CD without persistent SSH keys.
✕ When NOT to use
- Fully open-source environments where external audits require 100% auditable codebases.
- Dedicated Docker or Kubernetes orchestration where container APIs provide deeper native controls.
What to do today
- Audit existing MCP server configs to ensure no SSH private keys reside in plain text JSON.
- Configure command allowlists for every host exposed to local coding assistants.
- Implement temporary expiring API tokens or certificates for agentic CI/CD pipelines.