Use Claude Code’s stdio configuration to launch your local ssh client, then run the MCP server as the remote command. Add -T so SSH does not allocate a pseudo-terminal, verify that the remote process keeps stdout reserved for MCP messages, and inspect the connection with /mcp or the claude mcp commands. If the server exposes HTTP or SSE instead, an SSH port-forward plus Claude Code’s HTTP/SSE transport is usually cleaner.
Choose the connection method first
Claude Code supports MCP servers started as local stdio processes and remote servers reached over HTTP or SSE. SSH is the transport between your computer and the host; it does not change the MCP protocol. Match the setup to the interface the server actually provides.
| Server situation | Recommended setup | Main concern |
|---|---|---|
| Command-line MCP server runs only on the SSH host | Register ssh as a stdio command and pass the remote launch command |
Shell quoting and clean stdin/stdout |
| Server has an HTTP or SSE endpoint reachable from your computer | Register the endpoint directly with --transport http or --transport sse |
Correct URL path, authentication and transport |
| HTTP/SSE listens on the SSH host or a private interface | Create an SSH local port forward, then register the local forwarded URL | Forward direction, bind address and tunnel lifetime |
The SSH-launched stdio method below applies Anthropic’s documented “command plus arguments” model to OpenSSH. Anthropic’s MCP documentation does not publish an SSH-specific recipe, so treat the exact remote command and quoting as an adaptation you must validate for your server and operating systems. See the Claude Code MCP documentation and the OpenBSD ssh(1) manual.
Prerequisites and a non-interactive SSH test
- Claude Code is installed and the
claudecommand starts normally. - The OpenSSH client is installed locally, and your account can authenticate to the remote host.
- The MCP server package, runtime and configuration exist on the remote host.
- The remote launch command works without a password, passphrase prompt, confirmation question or interactive shell setup.
Test the exact style of session Claude Code will create. Replace the destination and command with your values:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -T mcp-host 'node /opt/mcp/server.js'A successful test should leave a long-running MCP process attached to stdin and stdout. It may wait silently for protocol input. Diagnostics belong on stderr, not stdout. Shell banners, login messages, debug prints or a command that exits immediately will corrupt or terminate the protocol stream. If your SSH key requires an agent, make sure the agent is available to the process that launches Claude Code.
Configure an MCP server over SSH (stdio)
Option 1: Register it with claude mcp add
Claude Code documents claude mcp add for adding servers. The following illustrates the argument shape; consult the current CLI reference for your installed version, especially scope flags and argument parsing:
claude mcp add --transport stdio remote-tools -- ssh -T mcp-host 'node /opt/mcp/server.js'Some releases accept the command and each argument as separate CLI arguments rather than one quoted remote command. If the command above is rejected, run claude mcp add --help and supply ssh, -T, the destination and the remote command according to that version’s syntax. The important resulting configuration is an MCP server whose executable is ssh.
Option 2: Edit the JSON configuration
The conceptual shape is:
{
"mcpServers": {
"remote-tools": {
"command": "ssh",
"args": ["-T", "mcp-host", "node /opt/mcp/server.js"]
}
}
}Use the configuration location and scope documented for your Claude Code installation. The JSON is illustrative: substitute your host, runtime, path and required environment. If the remote command contains shell operators, pipes, variables or nested quotes, prefer a small remote wrapper script with a stable path. That reduces local-versus-remote shell quoting surprises.
Free tools Windows power users keep installed
One-click scans. No signup required.
Select a scope deliberately
Claude Code provides local and user scopes and supports project-shared configuration in .mcp.json. Project-scoped servers require user approval before use. Use the scope that matches who should receive the server, and avoid putting private keys, tokens or other secrets in a project file. Check the live Claude Code CLI reference for current scope names and syntax.
Verify, inspect and remove the server
- Restart Claude Code, or reload its MCP configuration if your version provides a reload action.
- In an interactive session, run
/mcpand confirm thatremote-toolsappears. - From a shell, run
claude mcp listto see registered servers. - Run
claude mcp get remote-toolsto inspect the resolved configuration and scope. - When it is no longer needed, run
claude mcp remove remote-tools.
If the server is missing, inspect every scope: a project file, user configuration and local configuration can produce different lists. Approve a project server when Claude Code asks, then check /mcp again.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep stdio reliable
Disable pseudo-terminals
ssh -T disables pseudo-terminal allocation. A PTY can add terminal control characters, buffering or line discipline that an MCP stdio protocol does not expect. The OpenBSD ssh(1) manual defines -T for this purpose.
Keep stdout protocol-only
The remote process must write MCP messages to stdout and send logs to stderr. Remove shell startup output for noninteractive sessions, such as an unconditional “welcome” message in a profile script. Do not wrap the server in a command that prints status text before starting it. If you need logging, redirect it to stderr or a file.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Make the environment explicit
Noninteractive SSH sessions may have a smaller PATH and fewer environment variables than your login shell. Call the runtime by an absolute path or use a remote wrapper that sets PATH, working directory and required variables. Never assume a version manager initialized by an interactive shell is available.
HTTP or SSE through an SSH tunnel
Use this route when the MCP server already speaks HTTP or SSE rather than stdio. First identify the server’s listening address and port on the SSH host. Then create a local forward:
ssh -N -L 127.0.0.1:8787:127.0.0.1:8787 mcp-hostHere, local port 8787 forwards to port 8787 on the SSH host. Change both ports and addresses when the service binds elsewhere. Keep this SSH process running while Claude Code uses the endpoint. Binding the local side to 127.0.0.1 avoids exposing the forwarded service to other machines on your network.
With the tunnel active, register the exact local URL and path supported by the server:
claude mcp add --transport http remote-http http://127.0.0.1:8787/mcpFor an SSE endpoint, use the SSE transport and its documented path:
claude mcp add --transport sse remote-sse http://127.0.0.1:8787/sseThese URL paths are examples, not universal defaults. Confirm the server’s endpoint, authentication headers, TLS requirements and transport implementation. Anthropic documents HTTP and SSE registration in its MCP guide; OpenSSH forwarding behavior is described in the ssh(1) manual.
Troubleshooting by symptom
“Server failed to start”
Run the noninteractive SSH command manually. Check hostname resolution, key access, the remote executable path, working directory and required environment variables. A command that works only after an interactive login needs a wrapper or explicit environment.
The connection closes immediately
The remote process probably exited, crashed or is not an MCP stdio server. Run it directly over ssh -T, inspect stderr, and verify that it remains alive waiting for stdin.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Messages are garbled or intermittent
Remove PTY allocation, confirm -T is present, and eliminate every banner or debug print from stdout. Send diagnostics to stderr.
An authentication prompt blocks Claude Code
Use an SSH key or agent setup that works without interaction, and test it from the same account that launches Claude Code. Do not put private key material or service secrets in shared project configuration.
The tunnel connects but the endpoint fails
Verify the forwarding direction, local and remote ports, the server’s bind address and the URL path. Ensure the selected Claude Code transport matches the server (HTTP versus SSE). If the service binds only to a container or another private interface, forward to that reachable address on the SSH host.
The server does not appear in Claude Code
Run claude mcp list, claude mcp get remote-tools and /mcp. Check the active scope, JSON syntax and any pending project approval. Product commands can change, so confirm syntax in the current Anthropic documentation.
Operational and security considerations
- Host trust: verify the SSH host key using your organization’s normal process; do not disable host-key checking as a shortcut.
- Least privilege: use a remote account and filesystem permissions limited to what the MCP server needs.
- Secrets: provide tokens through the remote service’s supported secret store or environment mechanism, not committed project files.
- Lifecycle: stdio starts with Claude Code; a tunnel requires a separately running SSH process and will fail when that process exits.
- Performance: SSH adds connection setup and network latency. A persistent control connection or tunnel can avoid repeated handshakes, subject to your security policy.
- Failure behavior: network drops terminate stdio or the tunnel. Design the server and your workflow to reconnect cleanly rather than duplicating side effects.
Or skip the browser setup
If your MCP workflow needs website screenshots, ScreenshotNeo provides an API and MCP server without asking you to maintain a browser on the SSH host. It accepts a URL and returns PNG, JPEG, WebP or PDF. Before capture it accepts cookie and consent banners and removes more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be disabled.
Only clean shots are billed. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits cost nothing, and response headers report the page verdict and billing status. Its MCP server exposes take_screenshot, get_page_info and capture_pdf for Claude, Cursor and other MCP clients.
A single request looks like this (see the ScreenshotNeo documentation for parameters and authentication):
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Every plan includes the full feature set, including full-page and element capture, device and retina settings, PDF controls, custom CSS and JavaScript, clicks, waits, request blocking, headers, cookies, geolocation, resizing, TTL caching, signed links, asynchronous webhooks, bulk capture of up to 100 URLs per call, usage data and an OpenAPI specification. The Free plan includes 1,000 shots each month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account to get started.
Recommended Free Tools
FAQ
Does Claude Code natively support SSH as an MCP transport?
SSH is not presented as a separate MCP transport in the cited Claude Code documentation. Running the local ssh executable as a stdio command is a practical composition of documented stdio configuration and OpenSSH remote-command behavior.
Should I use stdio or an SSH tunnel?
Use SSH-launched stdio for a command-line server that speaks MCP over stdin/stdout. Use a tunnel when the server already exposes HTTP or SSE and Claude Code should connect to a URL.
Can I share the SSH configuration in a project?
You can use project-shared MCP configuration where supported, but project servers require approval. Keep credentials and private secrets out of shared files.
Frequently Asked Questions
What if the remote MCP server needs a virtual environment or Node version manager?
Create a remote wrapper script that selects the runtime, sets PATH and environment variables, then execs the MCP server. Point SSH at that script so Claude Code does not depend on interactive shell initialization.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCan SSH compression or multiplexing be used?
They are OpenSSH options you may enable in your SSH configuration, but test them with your MCP server and security policy. They do not replace the required clean stdio stream or a running tunnel.
The Bottom Line
For a command-line MCP server confined to an SSH host, configure Claude Code to run ssh -T as a stdio server and keep the remote stdout protocol-only. For an HTTP/SSE server, forward its port and register the forwarded URL instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
