kastelldev/kastell

Your infrastructure, fortified.
> English | Türkçe
Why Kastell?
Server security is fragmented. Lynis scans but doesn't fix. OpenSCAP is powerful but complex. Custom scripts work until they don't -- and nobody maintains them. Each tool has its own output format, its own update cycle, its own learning curve.
**Kastell takes a different approach:** one CLI that audits, fixes, hardens, and monitors. Scan your server, apply safe fixes, lock it down to production standards, and keep watching -- all with the same tool.
**AI-native from day one.** Kastell ships with a built-in MCP server, so Claude, Cursor, or any MCP-compatible AI agent can manage your servers directly. Go from a prompt to production hardening in seconds.
You don't need four separate tools to secure a server.
Quick Start
Running kastell without any arguments launches an **interactive search menu** with a gradient ASCII banner and quick-start examples. Browse actions by emoji-categorized groups, type to filter results instantly, and configure options step by step -- no need to remember any command names or flags.
Each action includes sub-options (server mode, template, log source, port number, etc.) and a ** Prices reflect the cheapest plan with at least 2 GB RAM (required by Coolify and Dokploy). Bare mode has no minimum requirements -- plans start from ~$2.50/mo depending on provider. You can choose a different size during setup. Linode support is in beta -- community testing welcome.
Supported Platforms
| Platform | Mode Flag | Min RAM | Min CPU | Description |
|----------|-----------|---------|---------|-------------|
| Coolify | --mode coolify (default) | 2 GB | 2 vCPU | Docker-based PaaS (port 8000) |
| Dokploy | --mode dokploy | 2 GB | 2 vCPU | Docker Swarm-based PaaS (port 3000) |
| Bare | --mode bare | — | — | Generic VPS, no platform overhead |
Kastell uses a **PlatformAdapter** architecture -- the same commands (update, maintain, logs, health) work across all platforms. The platform is stored in your server record and auto-detected on each command.
Developer Experience
| Feature | Command / Flag | Description |
|---------|---------------|-------------|
| Dry Run | --dry-run | Preview destructive commands without executing. Available on: destroy, update, restart, remove, maintain, restore, firewall, domain, backup, snapshot, secure. |
| Shell Completions | kastell completions bash\|zsh\|fish | Generate shell completion scripts for tab-completion of commands and options. |
| Config Validation | kastell config validate | Check servers.yaml for structural and type errors using Zod strict schemas. |
| Version Check | kastell --version | Shows current version and notifies if a newer version is available on npm. |
YAML Config
Deploy with a single config file:
Templates
| Template | Best For | Includes |
|----------|----------|----------|
| starter | Testing, side projects | 1-2 vCPU, 2-4 GB RAM |
| production | Live applications | 2-4 vCPU, 4-8 GB RAM, full hardening |
| dev | Development & CI/CD | Same as starter, no hardening |
Security
Kastell is built with security as a priority -- **12,132 tests** across 380 suites, including dedicated security test suites.
- API tokens are never stored on disk -- prompted at runtime or via environment variables
- SSH keys are auto-generated if needed (Ed25519)
- All SSH connections use StrictHostKeyChecking=accept-new with IP validation (octet range) and environment filtering
- Shell injection protection on all user-facing inputs (spawn/spawnSync, no execSync)
- Provider error messages are sanitized to prevent token leakage
- stderr sanitization redacts IPs, home paths, tokens, and secrets from error output
- Config file token detection (22+ key patterns, case-insensitive, nested)
- Import/export operations strip sensitive fields and enforce strict file permissions (0o600)