diff --git a/AGENTS.md b/AGENTS.md
index 80107e5..3af51de 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,7 +19,7 @@
   - Main LAN: `192.168.88.0/24`
   - IoT VLAN: `192.168.2.0/24`
   - Static WAN IP: `184.170.161.177`
-  - **SSH access**: available via `mcp__mcp-ssh__runRemoteCommand` with hostAlias `192.168.88.1`
+  - **SSH access**: available via user: sofi with hostAlias `192.168.88.1`
   - Commands use RouterOS syntax (e.g. `/ip dhcp-server network print`, `/ip dns static print`)
   - Can read/change: DHCP networks, DNS static entries, firewall rules, interfaces, NAT rules
 - **Synology RT6600ax**: WiFi AP only (pure AP mode, no routing, no DHCP)
@@ -67,12 +67,61 @@
 - **TrueNAS**: `192.168.88.24` — 25.5TB (TrueNAS-NFS pool)
 - **Photos NFS**: `/mnt/big-11t/photos` on Proxmox host, NFS-exported to siklos and ThinkStation
 
-## SSH Access Pattern
-- Direct to Proxmox host: `root@192.168.88.25`
-- To Siklos (VM112): `ssh -o StrictHostKeyChecking=no jgitta@192.168.88.27` (from jg-hud)
-- To other VMs: use VM103 or VM107 as jump hosts
-- Public key: `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRHmoQ63d1qi5yjYoFm8FgnBwUo5uNyRCPChW25DmjF root@jg-hud`
-- **Note**: Reach Siklos via Proxmox host shell SSH — QEMU agent times out on long commands
+## SSH Access
+
+All active endpoints are directly accessible via SSH on port 22.
+
+| Device | IP | User | SSH Command |
+|---|---|---|---|
+| Proxmox (jg-hud) | 192.168.88.25 | root | ssh root@192.168.88.25 |
+| MikroTik router | 192.168.88.1 | sofi | ssh sofi@192.168.88.1 |
+| VM102 (jellyfin) | 192.168.88.10 | jgitta | ssh jgitta@192.168.88.10 |
+| VM103 (next) | 192.168.88.62 | jgitta | ssh jgitta@192.168.88.62 |
+| VM106 (haos) | 192.168.88.39 | root | ssh root@192.168.88.39 |
+| VM107 (pbs) | 192.168.88.60 | root | ssh root@192.168.88.60 |
+| VM112 (siklos) | 192.168.88.27 | jgitta | ssh jgitta@192.168.88.27 |
+| VM113 (photos) | 192.168.88.32 | jgitta | ssh jgitta@192.168.88.32 |
+| CT200 (gitea) | 192.168.88.200 | jgitta | ssh jgitta@192.168.88.200 |
+| CT202 (caddy-proxy) | 192.168.88.110 | root | ssh root@192.168.88.110 |
+| TrueNAS | 192.168.88.24 | admin | ssh admin@192.168.88.24 |
+| ThinkStation | 192.168.88.41 | jgitta | ssh jgitta@192.168.88.41 |
+
+**Notes:**
+- CT201 (openclaw) is currently powered off
+- All connections are direct (no jump hosts required)
+- All use standard SSH port 22
+
+### SSH Quick Reference
+
+Quick reference for direct SSH access to all endpoints (all on port 22):
+
+**Infrastructure:**
+```
+ssh root@192.168.88.25      # Proxmox
+ssh sofi@192.168.88.1       # MikroTik
+```
+
+**VMs:**
+```
+ssh jgitta@192.168.88.10    # VM102 jellyfin
+ssh jgitta@192.168.88.62    # VM103 next
+ssh root@192.168.88.39      # VM106 haos
+ssh root@192.168.88.60      # VM107 pbs
+ssh jgitta@192.168.88.27    # VM112 siklos
+ssh jgitta@192.168.88.32    # VM113 photos
+```
+
+**Containers:**
+```
+ssh jgitta@192.168.88.200   # CT200 gitea
+ssh root@192.168.88.110     # CT202 caddy-proxy
+```
+
+**Storage & Workstation:**
+```
+ssh admin@192.168.88.24     # TrueNAS
+ssh jgitta@192.168.88.41    # ThinkStation
+```
 
 ## Caddy Reverse Proxy (CT202 — 192.168.88.110)
 - Version: v2.11.2 with Cloudflare DNS plugin