FarHand routes an agent's SSH commands without moving API keys

A new MCP server called FarHand gives an AI agent hands on a remote machine over SSH, without putting API keys on that machine. Created September 19, it's a single binary that multiplexes commands and file operations through your existing OpenSSH config, per FarHand's repo. It reuses your keys, agent, and jump hosts in one session.

For anyone running agents against a remote dev box or a production-adjacent server, that's a real reduction in what a compromised host can hand over. If the remote machine gets popped, there's no provider key sitting on it to steal.

The split is the point. On the remote side, the agent gets remote_bash plus the standard read, write, edit, ls, glob, and grep tools. On the local side, it only sees allowlisted folders through local_ls, local_read, upload, and download. Every action writes one JSON line to a local audit log.

The repo makes its argument by contrast. Running opencode serve on the remote host means the provider keys have to live there too. FarHand's pitch is that the SSH tunnel carries the commands instead, so the credentials stay on the machine you're sitting at.

That doesn't remove the risk of the remote commands themselves. An agent with remote_bash and file edit access can still do damage on the host it's connected to, key or no key. The audit log records what happened. It doesn't stop it, and FarHand's GitHub page doesn't say whether there's any sandboxing or command allowlisting beyond the folder restrictions on the local side. Check that log after a session; it won't catch a bad command on its own.