bridge

SSH Bridge CLI — Remote Tool Execution and Configuration

Execute MCP tools on remote hosts or manage bridge configuration via the token-efficient CLI.

Current state

Host status: !bridge-mcp status 2>/dev/null || echo "CLI binary not found — run 'make build' or 'cargo install --path .'"

Instructions

No arguments or status

Show host status (above) and available tool groups: !bridge-mcp list-tools --groups-only

Then ask the user what they want to do.

Config mode

Help the user configure the bridge. Show current config state:

1. Config file location: ~/.config/bridge-mcp/config.yaml
2. Validate current config: !bridge-mcp validate 2>&1
3. Show diff vs defaults: !bridge-mcp config-diff 2>&1

Then guide the user through configuration. The config file has these sections:

Adding a host:

hosts:
  my-server:
    hostname: 192.168.1.100
    port: 22
    user: admin
    description: "My server"
    auth:
      type: key              # key | password | agent
      path: ~/.ssh/id_ed25519
    # os_type: windows       # for Windows hosts
    # shell: powershell      # for Windows: cmd (default) or powershell
    # proxy_jump: bastion    # connect through a jump host

Security modes:

security:
  mode: standard     # strict = whitelist only | standard = whitelist for exec, blacklist for tools | permissive = blacklist only
  whitelist:
    - "^docker\\s+(ps|logs|inspect).*"   # regex patterns
  blacklist:
    - "rm\\s+(-[a-zA-Z]*r|--recursive)"  # always denied
  sanitize:
    enabled: true    # mask secrets in output (~50 builtin patterns)

Filtering tool groups (reduce MCP context):

tool_groups:
  groups:
    docker: false       # disable docker tools
    kubernetes: false   # disable k8s tools
    # Set any of the 74 groups to false to disable

SSH config auto-discovery:

ssh_config:
  enabled: true   # auto-import hosts from ~/.ssh/config

Reference: config/config.example.yaml has the full documented example.