I agree that this would be the best option, but what is the point of remote deployment APIs then? Eg my CI deploys war files on a tomcat using tomcats remote deployment API, so tomcat must be able to write in its webapp directory. Would you suggest to deploy wars always via scp and a restart of the tomcat instance instead?