A setup command that creates a dedicated SSH key and prepares it for password-free login to a server. It asks for connection details when no server profile exists and can be run again safely.

Use it when onboarding a server to the fleet manager and setting up SSH access for its commands.

It avoids repeatedly entering a server password and prevents an existing key from being overwritten. It also keeps the server connection details recorded for later use.

setup-ssh — Command by CallMeTechie

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/callmetechie/fleet-manager/setup-ssh

Clone the repo

git clone --depth 1 https://github.com/CallMeTechie/fleet-manager

Per session 23 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,162 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00023	$0.01162
Opus 5	$0.00012	$0.00581
Sonnet 5	$0.00005	$0.00232
Haiku 4.5	$0.00002	$0.00116

Measured yesterday against content hash efb95b477409, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

setup-ssh scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

chmod 600 "$KEY"

plugin/commands/setup-ssh.md · 109 lines

How it starts

The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Setup SSH

Establish passwordless key auth to a server using the plugin-dedicated keypair. Idempotent — re-running on a configured server is a no-op.

Anti-Pattern Rule (do not violate)

Never invoke ssh-copy-id from this command via the Bash tool. It hangs without a TTY. Only the user-typed !-prefix allocates a PTY for password entry. This command's job is to present the ssh-copy-id line as copyable text.

Steps

1. Resolve target + connection details

set -euo pipefail
source "${CLAUDE_PLUGIN_ROOT:-plugin}/commands/_fleet-lib.sh"
NAME="$(resolve_server "$(printf '%s' "$ARGUMENTS" | tr -d '[:space:]')")"

If resolve_server fails (no profile yet), ask via AskUserQuestion for: server name, host, port (default 22), user. Validate host ^[a-zA-Z0-9.-]+$, port 1–65535, user ^[a-zA-Z0-9_.-]+$. Write the Connection section of context/servers/<name>.md first (Concern 6 — profile exists before key deploy), using the EXAMPLE.md.template as the base.

2. Ensure the plugin keypair exists (never overwrite)

KEY="$HOME/.ssh/fleet-manager_ed25519"
if [ ! -f "$KEY" ]; then
  ssh-keygen -t ed25519 -N "" -f "$KEY" -C "fleet-manager@$(hostname)"
  chmod 600 "$KEY"
fi

3. Test key auth (cold)

build_ssh "$NAME"
if "${FM_SSH[@]}" "echo OK" 2>/dev/null | grep -qx OK; then
  echo "Key auth already works for $NAME."; exit 0
fi

Host key (first connection): the plugin keeps the OpenSSH default for host-key checking (it does not auto-trust). With BatchMode=yes there is no interactive prompt, so a host whose key is not yet in ~/.ssh/known_hosts makes this cold test fail. Establish it once, out of band, after reviewing the fingerprint: ssh-keyscan -p <port> <host> >> ~/.ssh/known_hosts (or connect once interactively and accept the key). Intentional — it blocks a silent man-in-the-middle on an unknown host.

4. Present the deployment instruction (copy-paste, not auto-run)

Each bash block runs in its own subshell, so FM_* from step 3 is gone here. Re-load the profile and print the exact command so you substitute real values (never guess host/port):

Read the full file on GitHub · 109 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 109 lines · 23 tokens per session scan B efb95b477409

Subscribe to this mod's changes

setup-ssh is a command published in the GitHub repository CallMeTechie/fleet-manager (1 stars, last pushed 29d ago), licensed MIT. It adds 23 tokens to every session and 1,162 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

DevOps and cloud Security ansible-alternative claude-code claude-code-plugin docker ssh

setup-ssh

Getting it into your agent

What it costs to keep this loaded

Grade B, and why

Asks for rootmediumPrivilege escalation

How it starts

Setup SSH

Anti-Pattern Rule (do not violate)

Steps

1. Resolve target + connection details

2. Ensure the plugin keypair exists (never overwrite)

3. Test key auth (cold)

4. Present the deployment instruction (copy-paste, not auto-run)

What this file has done since we first saw it

Other commands, from other repositories

domains

access

cleanup

deps-age

release-prep

review-pr