ssh-keyscan

What ssh-keyscan does on Github

AI agents call ssh-keyscan to retrieve information from Github without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why ssh-keyscan is rated Low

ssh-keyscan is a standard utility that passively fetches public SSH host keys from remote servers for purposes like host verification and known_hosts management. This is fundamentally a read operation with no side effects, no code execution on the target, and no data modification. The blast radius is minimal—an AI could only retrieve already-public information about SSH host keys, which is generally non-sensitive.

From the tool's definition Tool name is 'ssh-keyscan' and description states it 'Retrieves public host keys from a remote SSH server'. The verb 'retrieves' and the focus on 'public' keys indicates read-only information gathering with no modification or execution capabilities.

The rule that runs ssh-keyscan safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Github, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For ssh-keyscan, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "ssh-keyscan": {}
  }
}

Questions about ssh-keyscan