lacs-project/sysknife

The Linux sysadmin MCP server. Plan. Approve. Audit.
Distros  
MCP server ·
Install ·
How it works ·
Why not X ? ·
Distro matrix ·
Roadmap ·
Contribute ·
Discuss
A deterministic reproduction of the Claude Code MCP flow on Ubuntu 24.04, rendered offline by
ubuntu-flow-mock.sh so it replays identically from a
fresh checkout. Every action name, risk level and command shown is the one the catalogue
carries. The same flow works in Cursor and Codex CLI.
On an atomic host the plan uses rpm-ostree instead:
the Fedora Atomic recording .
Looking for the standalone CLI? See the CLI guide .
> **Describe what you want in plain language.** Review a typed plan with risk
> levels. Approve explicitly. Watch it execute with live output. Atomic-host
> changes (rpm-ostree) roll back automatically on failure. Every action is
> Ed25519-signed and audited.
The AI never supplies a command. Every action is a **typed operation** with a
formal risk level, and the daemon builds the command line itself from the
action's own definition — some actions do run through sh -c, but the shell
fragment is constructed by SysKnife, never by the model. The AI cannot touch
your system directly. A privileged daemon executes only what you approve, writes
a tamper-evident Ed25519-signed audit chain, and rolls back atomic-host
(rpm-ostree) changes automatically on failure.
**Why typed actions and not a guarded shell?** Red-team research (GuardFall)
found that **10 of 11 AI agents bypass raw-string shell guards** — an allowlist
or regex is filtering a language rich enough to hide intent. SysKnife removes
the shell string entirely: the model emits
typed actions, and a
public-key-verifiable audit chain records every one.
---
MCP server
SysKnife is an MCP server first. Point Claude Code, Cursor or Codex CLI at it and
your assistant gets typed, risk-classified sysadmin tools in place of a shell:
| Tool | What it does |
|---|---|
| sysknife_plan | Turns plain language into typed steps, each with a risk level, a resolved command and a daemon transaction ID |
| sysknife_execute | Runs steps that carry a one-time receipt, and nothing else |
| sysknife_history | Reads past runs out of the signed audit log |
| sysknife_doctor | Reports daemon, provider and audit-chain health |
| sysknife_audit_verify | Walks the Ed25519 chain and says whether it is intact |
| sysknife_get_disk_usage, and the rest of the read-only catalogue | Direct queries, selected for the distro you are on |
One command wires the server into your client and installs the daemon.
Install has the detail, and MCP protocol has the
wire behaviour.
**Your assistant cannot approve its own work.** sysknife_plan hands back a
transaction ID and stops there. The receipt sysknife_execute demands comes
from sysknife approve , typed in your terminal, on a channel
the model does not sit on. Missing, expired, mismatched and replayed receipts
are all refused.
Prefer to stay in the shell? The CLI
is the same engine with no client in front of it.
---
Install
The fastest path is the setup wizard. It installs the daemon and wires
SysKnife into your AI IDE — Claude Code, Cursor, or Codex CLI — so you can
plan and execute from chat.
Needs **Node 22 or newer**; older Node releases no longer receive security fixes.
On Ubuntu 22.04 apt install nodejs gives Node 12, which is too old; the installer
says so and how to get a current Node. No Rust
toolchain and no compile: it downloads verified prebuilt binaries.
What this does:
1. **Downloads the prebuilt sysknife + sysknife-daemon binaries** for your
architecture (x86_64 / aarch64) from GitHub Releases, **SHA-256-verifies**
each against the release checksum file — a mismatch aborts the install — and
places them in ~/.local/bin (no sudo). Pass --no-binary to skip the
download and build from source instead.
2. Asks for your **LLM provider, key, and model** — OpenAI / Anthropic / Gemini
/ Ollama / Groq / DeepSeek / Mistral / xAI (Ollama needs no key). The key
prompt is skipped when the matching env var is already set.
3. Asks **which AI integration** to wire up (or pick --claude / --cursor /
--codex / --all) and your **daemon target(s)** — socket, plus an optional