Linux MCP Server

Name: Linux MCP Server
Author: RHEL Lightspeed

Diagnose and troubleshoot Linux hosts, local or over SSH, with read-only system inspection tools

Official · RHEL Lightspeed Python Local · stdio DevOps and monitoring

GitHub PyPI Website

63 popularity score ★ 318 ↓ 2.8k/mo

Connect your client

Local (PyPI)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio

Opens the app, which asks before it adds the server.

Or add it by command or config

FirstTerminal

uv tool install linux-mcp-server

Claude CodeTerminal

claude mcp add linux -- linux-mcp-server

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "linux": {
      "command": "linux-mcp-server",
      "args": []
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "linux": {
      "command": "linux-mcp-server",
      "args": []
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "linux": {
      "type": "stdio",
      "command": "linux-mcp-server",
      "args": []
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.linux]
command = "linux-mcp-server"
args = []

Gemini CLITerminal

gemini mcp add --scope user linux linux-mcp-server

Local (container)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.

Or add it by command or config

FirstTerminal

mkdir -p ~/.local/share/linux-mcp-server/{logs,ssh}
cp ~/.ssh/config ~/.ssh/id_ed25519 ~/.local/share/linux-mcp-server/ssh/
sudo chown -R 1001:1001 ~/.local/share/linux-mcp-server/

Claude CodeTerminal

claude mcp add linux -- docker run --rm --interactive -e LINUX_MCP_USER -v '<ABSOLUTE_PATH_TO_SSH_DIR>:/var/lib/mcp/.ssh:ro' -v '<ABSOLUTE_PATH_TO_LOG_DIR>:/var/lib/mcp/.local/share/linux-mcp-server/logs:rw' quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server:latest

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "linux": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "--interactive",
        "-e",
        "LINUX_MCP_USER",
        "-v",
        "<ABSOLUTE_PATH_TO_SSH_DIR>:/var/lib/mcp/.ssh:ro",
        "-v",
        "<ABSOLUTE_PATH_TO_LOG_DIR>:/var/lib/mcp/.local/share/linux-mcp-server/logs:rw",
        "quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server:latest"
      ]
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "linux": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "--interactive",
        "-e",
        "LINUX_MCP_USER",
        "-v",
        "<ABSOLUTE_PATH_TO_SSH_DIR>:/var/lib/mcp/.ssh:ro",
        "-v",
        "<ABSOLUTE_PATH_TO_LOG_DIR>:/var/lib/mcp/.local/share/linux-mcp-server/logs:rw",
        "quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server:latest"
      ]
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "linux": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "--interactive",
        "-e",
        "LINUX_MCP_USER",
        "-v",
        "<ABSOLUTE_PATH_TO_SSH_DIR>:/var/lib/mcp/.ssh:ro",
        "-v",
        "<ABSOLUTE_PATH_TO_LOG_DIR>:/var/lib/mcp/.local/share/linux-mcp-server/logs:rw",
        "quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server:latest"
      ]
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.linux]
command = "docker"
args = ["run", "--rm", "--interactive", "-e", "LINUX_MCP_USER", "-v", "<ABSOLUTE_PATH_TO_SSH_DIR>:/var/lib/mcp/.ssh:ro", "-v", "<ABSOLUTE_PATH_TO_LOG_DIR>:/var/lib/mcp/.local/share/linux-mcp-server/logs:rw", "quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server:latest"]

Gemini CLITerminal

gemini mcp add --scope user linux docker -- run --rm --interactive -e LINUX_MCP_USER -v '<ABSOLUTE_PATH_TO_SSH_DIR>:/var/lib/mcp/.ssh:ro' -v '<ABSOLUTE_PATH_TO_LOG_DIR>:/var/lib/mcp/.local/share/linux-mcp-server/logs:rw' quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server:latest

Settings 12

`LINUX_MCP_USER`	Optional: Default SSH user name for remote hosts.
`LINUX_MCP_ALLOWED_LOG_PATHS`	Optional: Comma-separated log files read_log_file may open; none by default.
`LINUX_MCP_SSH_KEY_PATH`	Optional: Path to the SSH private key.
`LINUX_MCP_KEY_PASSPHRASE`	Optional: Passphrase for an encrypted SSH key.
`LINUX_MCP_HOST_MODE`	Optional: any, local-only or remote-only; any on Linux, remote-only in a container.
`LINUX_MCP_TOOLSET`	Optional: fixed (default), run_script or both; the latter two enable script execution.
`LINUX_MCP_GATEKEEPER__PROVIDER`	Optional: Gatekeeper model provider; needed for run_script/both, with a matching key such as OPENAI_API_KEY or ANTHROPIC_API_KEY.
`LINUX_MCP_GATEKEEPER__MODEL`	Optional: Gatekeeper model ID; needed for run_script/both.
`LINUX_MCP_MAX_FILE_READ_BYTES`	Optional: Largest file read_file returns; 1048576 by default.
`LINUX_MCP_COMMAND_TIMEOUT`	Optional: Command timeout in seconds; 30 by default.
`LINUX_MCP_VERIFY_HOST_KEYS`	Optional: Check known_hosts for remote hosts; True by default.
`LINUX_MCP_TRANSPORT`	Optional: stdio (default) or http.

In a container, a setting goes in with -e NAME=value after docker run.

What it does

Linux MCP Server is Red Hat's diagnostics server for Linux machines, built around RHEL, Fedora, CentOS Stream and other systemd distributions. It gives an assistant tools to inspect a system: OS and hardware details, CPU, memory and disk usage, systemd services and their logs, the journal, processes, listening ports and connections, block devices, directory listings, file contents, and historical Performance Co-Pilot (PCP) metrics. Each tool takes a host argument: localhost runs the underlying command on the machine the server runs on, any other name runs it on that machine over SSH, so one session can move between several servers.

By default it starts the fixed toolset of 23 read-only tools. An experimental mode, Guarded Command Execution (LINUX_MCP_TOOLSET=run_script or both), adds four tools that let the assistant write a bash or Python script and run it on the target. Each script is first checked by a separate gatekeeper model you configure with your own provider key, and scripts that change the system are sent for human approval. In both mode the server has 27 tools.

It also forms the basis of Red Hat's MCP Server for RHEL. Besides stdio it can serve over HTTP, with optional TLS, OAuth sign-in (Google, GitHub, JWT or token introspection) and a YAML policy that decides who may run which tools on which hosts.

One point the overview pages leave out: read_log_file only opens paths on the LINUX_MCP_ALLOWED_LOG_PATHS allowlist, but read_file has no such list. In the 1.7.0 code it reads any absolute path the local or SSH user can read, refusing files over LINUX_MCP_MAX_FILE_READ_BYTES (1 MiB by default).

What it needs

Runtime	PythonorDocker

Python with uv (the docs install it with uv tool install linux-mcp-server), or Podman/Docker for the quay.io container image. Local inspection works only when the server runs on Linux. Remote hosts need key-based, passwordless SSH from the machine running the server. PCP tools need PCP installed and running on the target. Kerberos SSH needs the [gssapi] extra. Guarded Command Execution needs an API key for a gatekeeper model (OpenAI, Anthropic, Gemini, OpenRouter or Vertex AI; Vertex needs the [gcp] extra).

Limits

read_log_file reads nothing until LINUX_MCP_ALLOWED_LOG_PATHS is set. read_file refuses files over 1 MiB by default (LINUX_MCP_MAX_FILE_READ_BYTES); commands time out after 30 seconds by default. SSH password sign-in is not supported. Local execution is not implemented on macOS or Windows and is off by default in a container (host mode remote-only). Audit logs, all network connections and dmidecode data need root or extra groups on the target. Guarded Command Execution is experimental, with rudimentary sandboxing and a hardcoded policy. The security page says HTTP has no authentication; the configuration reference documents OAuth for it.

Who it suits

A good fit for admins and SREs who want an assistant to look into RHEL, Fedora or other systemd hosts they already reach by SSH key, especially production machines, because the default toolset only reads. It runs on your machine and needs no account. Pick it when you want journal, service, process, network and PCP data as structured tool results rather than giving an assistant a general shell. If you need the assistant to make fixes, the experimental script mode can, but it needs a paid gatekeeper model key and approvals. For non-systemd systems, or hosts you cannot reach by SSH key, look elsewhere.

Tools 27

get_system_information: OS, kernel, hostname, uptime and whether PCP is available
get_cpu_information: CPU model, cores and load
get_memory_information: RAM and swap usage
get_disk_usage: Filesystem space usage
get_hardware_information: Hardware details; some need root
list_services: List systemd services and their states
get_service_status: Status of one systemd service
get_service_logs: Recent journal entries for one service
list_processes: List running processes
get_process_info: Details for one process
get_journal_logs: Query the systemd journal by unit, priority, time or transport
read_log_file: Read lines from a log file on the allowlist
get_listening_ports: Ports with listening sockets
get_network_connections: Open network connections
get_network_interfaces: Network interfaces and addresses
list_block_devices: Disks, partitions and volumes
list_directories: Subdirectories of a path, sortable by size, name or date
list_files: Files in a path, sortable by size, name or date
read_file: Return a text file's contents within the size cap
pcp_guide: Catalog of PCP metric names and how to read them
pcp_list_metrics: Browse the PCP metric namespace
pcp_performance_summary: CPU, memory, disk, network snapshot, live or at a past time
pcp_query_metrics: Historical PCP metric samples over a time range
validate_script: Script mode: have the gatekeeper check a script and get a run token
run_script: Script mode: run a validated script that needs no confirmation
run_script_with_confirmation: Script mode: run a system-changing script after the client asks the user
run_script_interactive: Script mode: run a system-changing script with an approval UI in MCP-apps clients

Popularity

63 popularity score, on our list (the bar is 36)

★ 318 ↓ 2.8k/mo

GitHub stars	318	30 points
Stars in 30 days	+2	2.4 points
PyPI downloads, last month	2,837	22.8 points
Official server	Yes	8 points

Measured 2026-11-07. How the score works.

Where it is published

Code	rhel-lightspeed/linux-mcp-server ★ 318
PyPI	linux-mcp-server 1.8.0, 2026-10-28, the one the command runs
Container	`quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server`

What it can reach

Runs	On your machine
Reaches	Runs shell commands, Files on your machine, The internet
Changes things	Yes: it can write, send, create or delete
Sign-in	None
Licence	Apache-2.0 (GitHub)
Last code change	2026-11-06

The server runs on your machine (or in its container) and executes system commands such as journalctl, ss, lsblk and file reads, either locally or on remote hosts over SSH with your key, as the SSH user you configure. The default fixed toolset is read-only, but read_file can return any file that user can read (up to 1 MiB by default), including secrets in /etc or home directories. Setting LINUX_MCP_TOOLSET to run_script or both lets it run scripts that change the target system. Those scripts are checked by a gatekeeper model at a third-party provider (the script text is sent there) and need human approval when they modify the system. SSH host keys are verified by default. Over stdio with no policy file every tool may run on any host. Over HTTP with no policy all access is denied.

Over time

GitHub stars 318 +2 (+1 %)

318314

10 Oct 20267 Nov 2026

PyPI downloads a month 2.8k −2.5k (−47 %)

5.4k2.5k

13 May 20267 Nov 2026

Before the site measured it, read from pypistats' daily download counts.

Popularity score 63 +10 (+20 %)

6353

10 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-10-15.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![Linux MCP Server on EveryMCPServer](https://everymcpserver.com/badge/linux-mcp-server.svg)](https://everymcpserver.com/servers/linux-mcp-server)

Connect your client

Add in one click

Or add it by command or config

Add in one click

Or add it by command or config

Settings 12

What it does

What it needs

Limits

Who it suits

Tools 27

Similar servers

SSH MCP Server

MCP SSH Manager

ssh-mcp-server

PostHog MCP Server

Better Stack MCP Server

Jam MCP