ssh-keyscan

What ssh-keyscan does on Http

AI agents call ssh-keyscan to retrieve information from Http without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why ssh-keyscan is rated Low

ssh-keyscan is a standard utility that passively retrieves public SSH host keys for verification purposes. It performs no write operations, does not execute commands, and cannot delete or modify data. While it does perform network reconnaissance, the blast radius is minimal as it only gathers already-public information. Classified as Read with low severity.

From the tool's definition Tool name is 'ssh-keyscan' and description states it 'Retrieves public host keys from a remote SSH server' — a read-only operation that queries public cryptographic material without modifying or executing anything on the target.

The rule that runs ssh-keyscan safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Http, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For ssh-keyscan, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "ssh-keyscan": {}
  }
}

Questions about ssh-keyscan