ssh-keyscan

What ssh-keyscan does on Search

AI agents call ssh-keyscan to retrieve information from Search without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why ssh-keyscan is rated Low

The ssh-keyscan tool performs passive information retrieval of public SSH host keys, which is a standard diagnostic and security operation. It does not modify, execute commands, delete data, or move money. The blast radius is minimal since host keys are public information and the operation cannot cause side effects beyond network connectivity to the target server.

From the tool's definition Tool description states it 'Retrieves public host keys from a remote SSH server' — a read-only operation that queries and returns cryptographic public data with no modification or deletion of data.

The rule that runs ssh-keyscan safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Search, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For ssh-keyscan, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "ssh-keyscan": {}
  }
}

Questions about ssh-keyscan