Overview

MCP Server Remote Linux Health Monitoring is an MCP (Model Context Protocol) compatible server that collects real-time health and performance metrics from remote Linux hosts over SSH. It exposes a set of MCP tools so AI assistants (for example, Claude) or other MCP clients can query system state, retrieve diagnostics, and evaluate threshold-based alerts without direct interactive SSH sessions.

This tool is useful for on-call engineers, SREs, and automation systems that need quick, programmatic access to CPU, memory, disk, network, process and security signals across multiple servers. Because it runs as an MCP server, it integrates with assistant workflows for remote triage, automated runbooks, or data-analytics pipelines that consume operational telemetry.

Features

Comprehensive metrics: CPU, memory, disk, network, processes, and security-related signals
Real-time monitoring: ad-hoc queries and continuous checks
Multi-server support from a single MCP instance
Threshold-based alerts for CPU, memory, disk, I/O and security issues
SSH connection pooling and reuse for efficient data collection
Security-focused checks: failed logins, pending security updates, suspicious processes
MCP-native interface for integration with assistants and tools
Lightweight Python implementation suitable for running inside a virtual environment

Installation / Configuration

Requirements:

Python 3.10+
MCP Python SDK (installable from requirements)
SSH access to each target host (key or password-based)

Clone and install:

git clone https://github.com/thanhtung0201/mcp-remote-system-health.git
cd mcp-remote-system-health
python -m venv venv
# macOS / Linux
source venv/bin/activate
# Windows (PowerShell)
venv\Scripts\Activate.ps1
pip install -r requirements.txt

Per-host configuration (JSON). Create one file per monitored host or a list of host objects:

{
  "hostname": "server1",
  "ip": "192.168.1.100",
  "ssh_port": 22,
  "username": "monitor",
  "key_path": "~/.ssh/id_rsa"
}

Launcher example (command line):

./mcp_launcher.py \
  --username=monitor \
  --key-path=~/.ssh/id_rsa \
  --servers=192.168.1.100,192.168.1.101 \
  --log-level=info

Common CLI options:

Option	Description
–username	SSH username (required unless specified per-server)
–password	SSH password (not recommended; use key_path)
–key-path	Path to SSH private key
–ssh-port	SSH port (default: 22)
–servers	Comma-separated server IPs or hostnames
–log-level	Logging verbosity (debug, info, warning, error)

MCP client / Claude integration (example snippet):

{
  "mcpServers": {
    "system-health": {
      "command": "/path/to/venv/bin/python3",
      "args": [
        "/path/to/mcp-remote-system-health/src/mcp_launcher.py",
        "--username=monitor",
        "--key-path=/home/monitor/.ssh/id_rsa",
        "--servers=server1.example.com,server2.example.com",
        "--log-level=debug"
      ],
      "description": "Remote Linux health monitoring via MCP"
    }
  }
}

Library usage (async):

from src.server import serve

server_configs = [
    {"hostname":"server1","ip":"192.168.1.100","ssh_port":22,"username":"monitor","key_path":"~/.ssh/id_rsa"}
]

# Start the MCP server (async context)
await serve(server_configs)

Available Tools / Resources

The MCP server exposes tools for programmatic access. Typical tool names:

system_status — concise overall system health
cpu_metrics — per-core usage, load averages, iowait
memory_metrics — RAM, swap, free/used ratios
disk_metrics — mount-level usage, inodes, I/O utilization
network_metrics — interface stats and errors
security_metrics — failed logins, pending updates, suspicious processes
process_list — top CPU / memory consumers
system_alerts — active alerts based on thresholds
health_summary — aggregated snapshot for a host

Use these tools via MCP client calls to fetch structured JSON responses for dashboards, automation, or assistant-driven diagnostics.

Default Alert Thresholds

Metric	Warning	Critical
CPU usage	≥ 80%	≥ 90%
Load avg relative	> 1.5 × core count	—
I/O wait	> 20%	—
Memory usage	≥ 85%	≥ 95%
Swap usage	≥ 80%	—
Disk usage	≥ 85%	≥ 95%
Inode usage	≥ 90%	—
Failed logins	> 10 (warning)	—
Security updates	≥ 1 (warning)	> 5 (critical)

Thresholds are configurable in code or config files; alerts are returned by system_alerts tool calls (no external notification delivery built-in).

Use Cases

On-call triage: an assistant queries system_alerts and process_list to create a concise incident summary and suggested next steps.
Capacity planning: periodic pulls of cpu_metrics and disk_metrics feed analytics pipelines for trend analysis.
Remote diagnostics: run network_metrics and disk I/O checks on-demand during incident response without direct SSH.
Security investigation: security_metrics helps identify recent failed logins, unusual ports, or suspicious processes for further forensics.
Multi-server aggregation: run the MCP server centrally to compare health across a fleet of hosts and prioritize remediation.

Notes, Security & Limitations

Prefer SSH key-based auth and use minimal-permission monitoring accounts.
No persistent historical metric store; metrics are real-time snapshots. Integrate with time-series databases if history is required.
The server currently targets Linux only.
Alerts are exposed via MCP calls; external notification integrations (Slack/email) are not included out of the box.

Repository and source code: https://github.com/thanhtung0201/mcp-remote-system-health