If you’ve spent any time pair-programming with autonomous AI coding agents—whether it’s Claude Code, Cursor, Gemini, or custom agentic sidecars—you’ve likely handed them terminal execution permissions.
It feels intoxicatingly productive. You ask the agent to inspect a failing deployment, check container health across your cluster, or tail application logs, and it obliges in seconds.
Until you realize what you actually gave it.
In the background, your AI assistant isn’t just checking your staging box. It has complete, uninhibited read and execute access to your entire ~/.ssh/config. That includes your jump hosts, production database bastions, client servers, and private key identities.
One hallucinated shell expansion, one prompt injection hidden inside an untrusted Git repo, or one poorly scoped bash command, and your agent is executing arbitrary commands directly on production infrastructure.
💥 The Two Hidden Sins of Agentic SSH
When AI agents interact with remote servers via raw bash, two massive failure modes emerge:
1. The Blast Radius Problem (Zero Guardrails)
Standard AI terminal tools treat all SSH hosts equally. If it’s in your ~/.ssh/config, the model can reach it. There is no concept of “this server is for development, but that server holds the customer database.”
Asking an agent to “clean up lingering Docker containers across our machines” can turn into an unrecoverable disaster in milliseconds.
2. The “Token Avalanche” & Reconnect Lag
Whenever an agent executes a command like ssh server 'journalctl -n 500' or docker ps -a, two things happen:
- Connection Latency: Every single command undergoes a full SSH TCP handshake, key exchange, and authentication negotiation (typically 1.2s – 2.0s per invocation).
- Context Poisoning: The command dumps 15,000 tokens of raw ASCII, ANSI color escape codes, and repeated column headers straight into the LLM context window.
Within 3 queries, your model hits its context limit, reasoning degrades, and your API bill explodes.
📊 Benchmark: Raw Bash vs. Agentic SSH
Here is what happens when an AI assistant queries container health and listening ports across 3 remote nodes:
| Metric | Raw Bash (ssh host 'docker ps && ss -tlpn') |
Agentic SSH (ash) |
Improvement |
|---|---|---|---|
| Context Consumption | ~14,800 prompt tokens (raw ASCII/ANSI) | 185 structured JSON tokens | 98.8% Reduction 📉 |
| Execution Latency | 1,450ms (fresh TCP/SSH handshake) | 0.4ms (pre-warmed pool) | 3,600x Faster ⚡️ |
| Host Guardrails | ❌ Full access to all ~/.ssh/config hosts |
✅ Cryptographic allow_hosts list |
Zero-Trust 🛡️ |
| Session Cleanup | ❌ Lingering background zombie processes | ✅ Auto-teardown after 5m idle | Clean 🧹 |
🛡️ The Architecture of agentic_ssh
To solve this, we built Agentic SSH (ash)—a dedicated, high-performance Model Context Protocol (MCP) server written in Rust.
Instead of letting agents execute unconstrained shell commands, agentic_ssh acts as a zero-trust cryptographic gateway between the AI and your servers.
┌─────────────────┐ MCP Tool Call ┌────────────────────────┐ Pre-Warmed SSH ┌─────────────────┐
│ AI Assistant │ ────────────────────────> │ agentic_ssh (Rust MCP) │ ─────────────────────────> │ Remote Server │
│ (Claude/Cursor) │ <──────────────────────── │ │ <───────────────────────── │ │
└─────────────────┘ Structured JSON └────────────────────────┘ 0ms Latency └─────────────────┘
(185 Tokens) • Strict Host Allowlist
• Stream Parser & Truncation
• Keepalive Connection Pool⚡️ Key Architectural Pillars
1. Cryptographic allow_hosts Guardrails
By default, agentic_ssh operates on a strict Zero-Trust model. Even if your local SSH config lists 50 servers, the AI can only interact with hosts explicitly enumerated in .agentic_ssh.toml:
# Only staging and local nodes are accessible to the AI
allow_hosts = [
"staging-app-01",
"staging-db-01",
"aruba-node"
]
# Production servers are invisible and strictly unreachable
deny_hosts = ["prod-*", "bastion-primary"]If the agent attempts to target an unauthorized host, the tool call is rejected locally before a single network packet leaves your machine.
2. Pre-Warmed Rust Connection Pooling (0ms Handshakes)
Rather than spinning up and tearing down SSH processes on every command, agentic_ssh maintains an asynchronous in-memory connection pool built on russh and tokio.
- Active Reuse: Consecutive tool calls to the same server execute in < 1ms with zero reconnect overhead.
- Auto-Teardown: Idle sessions automatically close after 5 minutes of inactivity.
3. Squeezing 15,000 Tokens Down to 185 (98.8% Savings)
AI models don’t need 500 lines of kernel timestamps—they need actionable status. agentic_ssh parses raw remote system outputs into compact, structured JSON telemetry:
{
"host": "staging-app-01",
"cpu_usage_pct": 14.2,
"mem_used_gb": 3.8,
"mem_total_gb": 16.0,
"disk_free_pct": 72.4,
"listening_ports": [80, 443, 8425],
"failing_services": []
}By compressing terminal noise into structured payloads, we slashed prompt token consumption by 98.8%, dramatically reducing model reasoning latency and operational costs.
4. Interactive Live-Stream TUI (ash watch)
When you want to oversee what your AI assistant is doing on your servers in real-time, agentic_ssh includes a high-performance terminal UI built with ratatui:
ash watch staging-app-01You get a split-pane live stream of resource consumption, active SSH sessions, and tail logs across multiple hosts concurrently.
📦 Getting Started in 30 Seconds
agentic_ssh is officially verified on the Anthropic Model Context Protocol Registry and available across macOS and Linux:
1. Install via Homebrew or Cargo
# macOS & Linux (Homebrew)
brew install sandbanks/tap/agentic_ssh
# Rust toolchain
cargo install agentic_ssh2. Auto-Register with Your AI Tools
Run the self-install command to automatically configure Claude Desktop, Cursor, and other MCP clients:
agentic_ssh install3. Configure Your Allowed Hosts
Create a simple ~/.config/agentic_ssh/config.toml or .agentic_ssh.toml in your project root:
allow_hosts = ["my-dev-box", "staging-cluster"]🎯 Final Thoughts
Autonomous AI agents are only as safe as the boundaries we give them. Stop letting agents wander through your ~/.ssh/config unrestricted.
Give them dedicated, high-speed, zero-trust tools that keep your production infrastructure safe and your context windows clean.
- ⭐️ GitHub: github.com/sandbanks/agentic_ssh
- 📖 Live Docs & Interactive Demo: sandbanks.tech/agentic-ssh
- 💖 Sponsor on GitHub: github.com/sponsors/sandbanks
Richard Scorer
Independent software engineer building high-performance, sovereign tools and agentic primitives at sandbanks.tech.