pty-mcp

pty-mcp

An MCP (Model Context Protocol) server that gives AI agents interactive terminal sessions — local shells, SSH, serial ports, and persistent remote sessions that survive disconnects.

Built for sysadmins and network engineers who want AI to help with real server and device management, not just code generation.

Why

AI agents run commands in non-interactive shells. They can't:

• SSH into a server and interact with running processes
• Connect to routers or switches via serial console
• Monitor logs and react when a specific event occurs
• Keep session state across multiple commands
• Wait for a server to reboot and detect when it's back up

pty-mcp solves all of these by providing real PTY sessions over MCP.

Without pty-mcp, AI agents resort to sleep 30 && check_status loops — burning CPU cycles and API calls waiting for things to happen. With wait_for, the agent blocks server-side until the event occurs. Less polling, less energy, better for polar bears. 🐻❄️

Use Cases

Server administration

# Reboot a server and wait until it's back online

create_local_session("ping myserver") read_output(wait_for: "bytes from", timeout: 300) → blocks until server responds after reboot (~80s, one tool call)

Network device management

# Connect to a router via serial console

create_serial_session(port: "/dev/ttyUSB0", baud: 9600) send_input("show interfaces status") read_output(wait_for: "\\$")

Log monitoring and alerting

# Watch logs and act when something happens

create_ssh_session(host: "prod", user: "admin") send_input("tail -f /var/log/app.log") read_output(wait_for: "ERROR|CRITICAL", timeout: 3600) → returns the error line + context when it appears

Long-running tasks that survive disconnects

create_ssh_session(host: "server", user: "admin", persistent: true)

send_input("apt upgrade -y") detach_session() → close Claude Code, task continues

Reconnect later to check result

Features

Architecture

┌─────────────────────────────────────────────────────┐

│ AI Agent (Claude Code, etc.) │ │ │ │ MCP Tools: create_local_session, send_input, │ │ send_control, read_output, close_session │ └──────────────────────┬──────────────────────────────┘ │ JSON-RPC stdio ┌──────────────────────┴──────────────────────────────┐ │ pty-mcp (MCP Server) │ │ │ │ Session Manager │ │ ├── LocalSession (local PTY via creack/pty) │ │ ├── SSHSession (remote PTY via x/crypto/ssh) │ │ ├── SerialSession (serial port via go.bug.st) │ │ └── RemoteSession (persistent via ai-tmux) │ └─────────────────────────────────────────────────────┘

Persistent mode (ai-tmux):

pty-mcp ──SSH──▶ ai-tmux client ──Unix socket──▶ ai-tmux server (daemon) ├── PTY: bash ├── PTY: ssh admin@router └── PTY: tail -f /var/log/syslog

Quick Start

Claude Code Plugin (recommended)

Installs the binary automatically and registers the MCP server:

claude plugin marketplace add raychao-oao/pty-mcp

claude plugin install pty-mcp@pty-mcp

Restart Claude Code — the binary downloads automatically on session start, then restart once more to activate it. No manual claude mcp add needed.

Updating:

claude plugin marketplace update pty-mcp

claude plugin update pty-mcp@pty-mcp

Restart Claude Code — the new binary downloads automatically on session start, then restart once more to apply the update.

Manual install

One-line install + register (macOS / Linux / WSL2):

curl -fsSL https://raw.githubusercontent.com/raychao-oao/pty-mcp/main/install.sh | sh

claude mcp add pty-mcp -- /usr/local/bin/pty-mcp

Restart Claude Code and the tools are available.

Other install methods

Download from GitHub Releases:

Go to Releases, download the binary for your platform, and make it executable:

chmod +x pty-mcp-*

sudo mv pty-mcp-* /usr/local/bin/pty-mcp claude mcp add pty-mcp -- /usr/local/bin/pty-mcp

Build from source (requires Go 1.25+):

go install github.com/raychao-oao/pty-mcp@latest

claude mcp add pty-mcp -- $(go env GOPATH)/bin/pty-mcp

WSL2 Notes

pty-mcp works in WSL2 out of the box. Use the Linux binary:

# Inside WSL2

curl -fsSL https://raw.githubusercontent.com/raychao-oao/pty-mcp/main/install.sh | sh claude mcp add pty-mcp -- /usr/local/bin/pty-mcp

Optional: Install ai-tmux on remote servers

For persistent sessions that survive SSH disconnects, install ai-tmux on your remote server:

# Download for your server's architecture

curl -fsSL https://raw.githubusercontent.com/raychao-oao/pty-mcp/main/install.sh | sh

Or just copy the binary:

scp /usr/local/bin/ai-tmux your-server:/usr/local/bin/ai-tmux

Usage Examples

Once registered, the AI agent can use these MCP tools:

Local interactive shell:

create_local_session()                    → {session_id, type: "local"}

send_input(session_id, "cd /tmp && ls") → {output: "...", is_complete: true} send_input(session_id, "python3") → start Python REPL send_input(session_id, "print('hello')") → {output: "hello\n>>>"} send_control(session_id, "ctrl+d") → exit Python close_session(session_id)

SSH to remote server:

create_ssh_session(host: "myserver", user: "admin")

send_input(session_id, "top") send_control(session_id, "ctrl+c") → stop top

Wait for pattern (v0.2.0):

create_local_session("ping myserver")

read_output(session_id, wait_for: "bytes from", timeout: 300) → blocks until server responds or 5 min timeout

send_input(session_id, "docker-compose up") read_output(session_id, wait_for: "ready|error", timeout: 60, context_lines: 3) → returns matched line + 3 lines of context

Send secret / password (v0.3.0):

# AI detects a password prompt, calls send_secret instead of handling the password itself

create_ssh_session(host: "router", user: "admin") read_output(session_id, wait_for: "Password:") → session is waiting for input

send_secret(session_id, prompt: "Router admin password:") → native GUI dialog appears on the operator's screen (macOS: system dialog, WSL2: Windows Get-Credential, Linux: zenity/kdialog) → operator types password — it is sent directly to the PTY session → AI only sees: {success: true, length: 12} → password never appears in AI context or logs

Persistent session (survives SSH disconnect):

create_ssh_session(host: "server", user: "admin", persistent: true)

send_input(session_id, "make build") → start long build detach_session(session_id) → disconnect, build continues

Later (even after restart):

list_remote_sessions(host: "server", user: "admin") → see running sessions create_ssh_session(host: "server", user: "admin", session_id: "abc123") → reattach send_input(session_id, "echo $?") → check build result

MCP Tools

¹ `send_secret` platform support: macOS uses a native password dialog (osascript). WSL2 uses powershell.exe Get-Credential (Windows GUI dialog). Linux with a display server uses zenity or kdialog. Headless Linux falls back to /dev/tty. On macOS/Linux, if the operator doesn't respond within 60 seconds, the dialog is dismissed and the call returns a timeout error instead of falling through to another dialog or waiting again; cancelling the call (e.g. pressing ESC in Claude Code) dismisses the dialog immediately the same way. WSL2 is the exception: its dialog has no timeout and is never force-closed, including on cancellation — killing a WSL-interop-launched process that owns an open Windows GUI window was found to freeze the hosting terminal (unresponsive to input, scrolling, and selection) until the operator closes that terminal, with no way to recover it short of that. The dialog just waits until the operator answers or clicks Cancel themselves, which exits normally.

Audit Log

pty-mcp includes an optional audit log feature that records every send_input command to a central collector. This lets teams review and trace what AI agents did during a session.

Important: This is a voluntary, self-reporting operation log. It relies on operators choosing to enable it and run the collector. Because pty-mcp runs on the operator's own machine, there is no technical mechanism to enforce logging — a non-compliant operator could simply run pty-mcp without audit enabled. This feature provides traceability for teams that *want* it, but it is not a substitute for system-level audit tools (e.g., auditd, syslog forwarding, SSH session recording) in environments where audit compliance is required.

What it records

• Timestamp, operator identity, session ID, session type (local/ssh/serial), target host
• The exact input sent via send_input (including raw=true inputs like menu selecti