dsh-ssh-logs

When you ask an AI assistant to help debug a production incident, the most natural next step is to let it read the server logs. The catch is that handing a model an SSH session capable of running arbitrary commands is far too risky. dsh-ssh-logs closes that gap by wrapping log access into three strictly read-only MCP tools – list servers, read a log, and search a log – so the model can only operate on the fixed aliases and allowlisted directories you configure in advance, and can never pick an arbitrary host, execute an arbitrary command, or modify a remote file.

On the security front, the plugin enforces BatchMode and StrictHostKeyChecking with an explicit known_hosts file, generates only fixed head, tail, sed, and grep -F command templates, and rejects absolute paths, backslashes, and directory traversal. Each request is capped at 5 000 lines or 1 000 search matches, with a default output of 128 KiB and a hard ceiling of 4 MiB. Password prompts, sudo, SFTP writes, deletion, and any form of file modification are simply unsupported, eliminating privilege-escalation risk at the protocol level.

This plugin is built for engineers and ops staff who rely on DeepSeek Harness for everyday development and incident triage. Register a handful of frequently used servers with dedicated read-only accounts and log root directories in a single YAML config, restart the service, and you can let your AI assistant safely browse and grep server logs without ever copying terminal output by hand.