sshgate 允许 AI 代理（Claude Code 或任何 MCP 客户端）在你的 SSH 服务器上运行 shell 命令，但前提是默认你在桌面应用中批准了每个命令（参见自动允许的一次选择加入例外）。它是一个 Go 二进制文件加上一个 Electron 应用：

• **桥（sshgate），由你的MCP客户端启动;
• hub（sshgate hub），存放加密的已保存服务器、SSH连接和审批队列的保险库;
• 桌面应用（desktop/），运行枢纽，并在AI待处理请求旁边显示SSH终端标签页。

每个 AI 命令默认都由人类批准。你可以将一个主机设置为自动允许（默认为纯执行;root host 和 sudo-exec 仅在你选择每个主机时使用），在一定时间内或关闭为止;该命令在开机时可见，审计时可随时停止。AI 只会看到你标记为可见的服务器，并且只连接到你已固定的主机密钥的服务器。

sshgate最初是Tufantunc/ssh-mcp（MIT）的Go重写，现在是一个独立项目，既不隶属于它，也不获得其认可。

目录

• 工作原理
• 快速入门
• 桌面应用
• 安全模型
• 人工智能获得的工具

sshgate

sshgate lets an AI agent (Claude Code or any MCP client) run shell commands on your SSH servers, but only after you approve each command in a desktop app by default (see Auto-allow for the one opt-in exception). It is one Go binary plus a desktop app:

• the bridge (sshgate), which your MCP client starts;
• the hub (sshgate hub), which holds an encrypted vault of saved servers, the SSH connections, and the approval queue;
• the desktop app (app/, macOS), a native Go app that runs the hub and gives you SSH terminal tabs next to the AI’s pending requests. On Windows and Linux there is no desktop app; hub --cli approves from a terminal.

Every AI command is approved by a human by default. You may put one host on auto-allow (plain exec by default; root hosts and sudo-exec only when you opt in per host) for a set time, or until turned off; it is visible while on, audited, and stoppable at any time. The AI only sees servers you mark visible, and only connects to a server whose host key you have pinned.

sshgate started as a Go rewrite of tufantunc/ssh-mcp (MIT) and is now a separate project, not affiliated with or endorsed by it.

Contents

• How it works
• Quick start
• The desktop app
• Safety model
• Tools the AI gets
• Approving without the app: hub --cli
• Standalone mode: --host
• Files and environment variables
• Moving from the ssh-mcp name
• Development
• License

How it works

Claude Code ──stdio──▶ sshgate (bridge) ──per-user socket──▶ sshgate hub ──SSH──▶ your servers
                                                                  ▲
                                          desktop app ──stdio─────┘  (unlock, approve, terminals)

1. The AI calls exec through the bridge. The bridge holds no secrets and makes no decisions; it forwards the call to the hub over a socket only your user can open.
2. The hub checks that the server exists, is visible to AI, has a pinned host key, and that the vault is unlocked (a host on auto-allow also runs while the app is locked). Then it queues the request, unless the host is on auto-allow, in which case it runs at once.
3. The app shows the request: server, user@host:port, the exact command, and the AI’s description (marked unverified). You Deny, Allow, or Send to tab.