Kastell MCP Server: Install, Tools & Security

Canonical slug	`kastell-d7338e8c`	Deployment	Local Only
Canonical package	npm:kastell	Repository	kastelldev/kastell
First published	—	Latest release	—
Last security verification	—	Classification confidence	90%
Publication	Published	Official distribution	Yes

Channel	Identifier	Current version	Versions	Source
npm	kastell	`2.3.1`	36	Repository

Package	Version	Published / observed	Inventory	Security scan
npmkastell	`2.3.1`Current	Sep 5, 2026	17 toolsSucceeded · 2 resources · 3 prompts	Failed

Provenance	artifact_hash_verified	Signature	—
MCP SDK	@modelcontextprotocol/sdk	Artifact SHA-256	`3c2bacd581694bb65457ee646c9c0ccc92b8881006822beaaebbb90ac19813c0`
Scanner	mcp-proof-engine 0.1.0	Scan completed	Aug 20, 2026
Security rating	32 / 100	Methodology	version-rating-1.0

Executable entrypoints

[
  "kastell",
  "kastell-mcp"
]

Rating reasons

[
  "security_policy_not_observed"
]

Tools 17

Tool	Category	Annotations	Risk
server_auditRun a security audit on a server. Scans 31 categories with 449 checks. Returns score (0-100), per-category scores, and quick wins. Formats: 'summary' (compact text), 'json' (full AuditResult), 'score' (number only). Supports compliance filtering (cis-level1, cis-level2, pci-dss, hipaa), category/severity filtering, snapshot save/compare, threshold gate, and profile filtering. Requires SSH access. For health trends use server_doctor instead. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "format": { "default": "summary", "description": "Output format: summary (default), json (full result), score (number only)", "type": "string", "enum": [ "summary", "json", "score" ] }, "framework": { "description": "Compliance framework filter. Returns per-control pass/fail summary alongside audit results.", "type": "string", "enum": [ "cis-level1", "cis-level2", "pci-dss", "hipaa" ] }, "explain": { "description": "When true, include why + fix explanation for each failing check in summary format output. Capped at 10 checks.", "type": "boolean" }, "category": { "description": "Filter results to a specific category (e.g. 'SSH', 'Firewall', 'Docker').", "type": "string" }, "severity": { "description": "Filter checks by severity level.", "type": "string", "enum": [ "critical", "warning", "info" ] }, "snapshot": { "description": "Save audit snapshot. true for auto-name, string for custom name.", "anyOf": [ { "type": "boolean" }, { "type": "string" } ] }, "compare": { "description": "Compare two snapshots: format before:after (e.g. pre-upgrade:latest)", "type": "string" }, "threshold": { "description": "Minimum passing score (1-100). Returns error if score is below threshold.", "type": "integer", "minimum": 1, "maximum": 100 }, "profile": { "description": "Server profile filter (web-server, database, mail-server).", "type": "string" } } } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "format": { "type": "string", "const": "summary" }, "server": { "type": "string" }, "ip": { "type": "string" }, "overallScore": { "type": "number" }, "skippedCategories": { "type": "array", "items": { "type": "string" } }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "format", "server", "ip", "overallScore" ], "additionalProperties": false }, { "type": "object", "properties": { "format": { "type": "string", "const": "json" }, "server": { "type": "string" }, "ip": { "type": "string" }, "overallScore": { "type": "number" }, "categories": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "score": { "type": "number" }, "maxScore": { "type": "number" }, "checks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "category": { "type": "string" }, "severity": { "type": "string" }, "passed": { "type": "boolean" }, "currentValue": { "type": "string" }, "expectedValue": { "type": "string" }, "details": { "type": "string" }, "skip": { "oneOf": [ { "type": "object", "properties": { "code": { "type": "string", "const": "legacy-mutating" }, "apiVersion": { "type": "string", "const": "2" }, "kind": { "type": "string", "enum": [ "mutate-local", "mutate-global" ] } }, "required": [ "code", "apiVersion", "kind" ], "additionalProperties": false }, { "type": "object", "properties": { "code": { "type": "string", "const": "active-probe" }, "apiVersion": { "type": "string", "const": "3" } }, "required": [ "code", "apiVersion" ], "additionalProperties": false } ] } }, "required": [ "id", "name", "category", "severity" ], "additionalProperties": false } } }, "required": [ "name", "score", "maxScore" ], "additionalProperties": false } }, "checks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "category": { "type": "string" }, "severity": { "type": "string" }, "passed": { "type": "boolean" }, "currentValue": { "type": "string" }, "expectedValue": { "type": "string" }, "details": { "type": "string" }, "skip": { "oneOf": [ { "type": "object", "properties": { "code": { "type": "string", "const": "legacy-mutating" }, "apiVersion": { "type": "string", "const": "2" }, "kind": { "type": "string", "enum": [ "mutate-local", "mutate-global" ] } }, "required": [ "code", "apiVersion", "kind" ], "additionalProperties": false }, { "type": "object", "properties": { "code": { "type": "string", "const": "active-probe" }, "apiVersion": { "type": "string", "const": "3" } }, "required": [ "code", "apiVersion" ], "additionalProperties": false } ] } }, "required": [ "id", "name", "category", "severity" ], "additionalProperties": false } }, "quickWins": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "warning", "info" ] }, "commands": { "type": "array", "items": { "type": "string" } }, "currentScore": { "type": "number" }, "projectedScore": { "type": "number" }, "description": { "type": "string" } }, "required": [ "id", "severity", "commands", "currentScore", "projectedScore", "description" ], "additionalProperties": false } }, "complianceDetail": { "type": "array", "items": { "type": "object", "properties": { "framework": { "type": "string" }, "passedControls": { "type": "number" }, "totalControls": { "type": "number" }, "passRate": { "type": "number" }, "controls": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "status": { "type": "string" } }, "required": [ "id", "description", "status" ], "additionalProperties": false } } }, "required": [ "framework", "passedControls", "totalControls", "passRate", "controls" ], "additionalProperties": false } }, "skippedCategories": { "type": "array", "items": { "type": "string" } }, "baselineRegression": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "required": [ "format", "server", "ip", "overallScore", "categories" ], "additionalProperties": false }, { "type": "object", "properties": { "format": { "type": "string", "const": "score" }, "server": { "type": "string" }, "ip": { "type": "string" }, "overallScore": { "type": "number" } }, "required": [ "format", "server", "ip", "overallScore" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Security Audit", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	Read onlyNon-destructiveIdempotentOpen world	—
server_backupBackup and snapshot Kastell servers. Backup: 'backup-create' dumps Coolify DB + config via SSH (Coolify servers) or system config files (bare servers), 'backup-list' shows local backups, 'backup-restore' restores from backup — bare servers restore system config, Coolify servers restore DB+config (SAFE_MODE blocks restore). Snapshot: 'snapshot-create'/'snapshot-list'/'snapshot-delete' manage cloud provider snapshots (requires provider API token). Snapshots not available for manually added servers. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "backup-create", "backup-list", "backup-restore", "snapshot-create", "snapshot-list", "snapshot-delete", "snapshot-restore" ], "description": "Backup: 'backup-create' dumps Coolify DB+config via SSH (or system config for bare servers), 'backup-list' shows local backups, 'backup-restore' restores (SAFE_MODE blocks). Snapshot: 'snapshot-create'/'snapshot-list'/'snapshot-delete'/'snapshot-restore' manage cloud snapshots (requires API token). snapshot-restore restores server disk from a cloud snapshot (SAFE_MODE blocks, destructive)." }, "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "backupId": { "description": "Backup timestamp folder name (required for backup-restore).", "type": "string", "pattern": "^[\\w-]+$" }, "snapshotId": { "description": "Cloud snapshot ID (required for snapshot-delete and snapshot-restore).", "type": "string", "pattern": "^[\\w./-]+$" } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "backup-create" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "backupPath": { "type": "string" }, "manifest": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "backupPath", "manifest", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "backup-list" }, "server": { "type": "string" }, "backupCount": { "type": "number" }, "backups": { "type": "array", "items": { "type": "object", "properties": { "backupId": { "type": "string" }, "timestamp": { "type": "string" }, "coolifyVersion": { "type": "string" }, "files": { "type": "number" }, "status": { "type": "string" } }, "required": [ "backupId" ], "additionalProperties": false } }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "backupCount", "backups", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "backup-restore" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "backupId": { "type": "string" }, "steps": { "type": "array", "items": { "type": "object", "properties": { "status": { "type": "string" }, "message": { "type": "string" } }, "required": [ "status", "message" ], "additionalProperties": false } }, "hint": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "backupId", "steps", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "snapshot-create" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "snapshot": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "createdAt": { "type": "string" } }, "required": [ "id", "name", "createdAt" ], "additionalProperties": false }, "costEstimate": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "snapshot", "costEstimate", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "snapshot-list" }, "server": { "type": "string" }, "ip": { "type": "string" }, "snapshotCount": { "type": "number" }, "snapshots": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "createdAt": { "type": "string" } }, "required": [ "id", "name", "createdAt" ], "additionalProperties": false } }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "snapshotCount", "snapshots", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "snapshot-delete" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "snapshotId": { "type": "string" }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "snapshotId", "message", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "snapshot-restore" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "snapshotId": { "type": "string" }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "snapshotId", "message", "suggested_actions" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Backup & Snapshots", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }	—	WritesDestructiveNon-idempotentOpen world	—
server_compareCompare two servers side-by-side. Returns category-level score comparison (default) or check-level diff (detail mode). Uses cached snapshots when available, falls back to live SSH audit. Requires two registered servers. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "serverA": { "type": "string", "description": "First server name or IP." }, "serverB": { "type": "string", "description": "Second server name or IP." }, "fresh": { "default": false, "description": "Force live audit instead of using snapshots. Default: false.", "type": "boolean" }, "detail": { "default": false, "description": "Return check-level diff instead of category summary. Default: false.", "type": "boolean" } }, "required": [ "serverA", "serverB" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "format": { "type": "string", "const": "category" }, "serverA": { "type": "string" }, "serverB": { "type": "string" }, "categories": { "type": "array", "items": { "type": "object", "properties": { "category": { "type": "string" }, "scoreBefore": { "type": "number" }, "scoreAfter": { "type": "number" }, "delta": { "type": "number" } }, "required": [ "category", "scoreBefore", "scoreAfter", "delta" ], "additionalProperties": false } }, "overallA": { "type": "number" }, "overallB": { "type": "number" }, "overallDelta": { "type": "number" } }, "required": [ "format", "serverA", "serverB", "categories", "overallA", "overallB", "overallDelta" ], "additionalProperties": false }, { "type": "object", "properties": { "format": { "type": "string", "const": "check" }, "serverA": { "type": "string" }, "serverB": { "type": "string" }, "checks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "status": { "type": "string", "enum": [ "A_better", "B_better", "both_pass", "both_fail", "A_skip", "B_skip", "both_skip" ] }, "before": { "anyOf": [ { "type": "string", "enum": [ "passed", "failed", "skipped" ] }, { "type": "null" } ] }, "after": { "anyOf": [ { "type": "string", "enum": [ "passed", "failed", "skipped" ] }, { "type": "null" } ] } }, "required": [ "id", "name", "status", "before", "after" ], "additionalProperties": false } } }, "required": [ "format", "serverA", "serverB", "checks" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Compare Servers", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	Read onlyNon-destructiveIdempotentOpen world	—
server_doctorRun proactive health analysis on a server. Detects disk trending full, high swap, stale packages, elevated fail2ban bans, audit regression streaks, old backups, and reclaimable Docker space. Uses cached metrics by default — pass fresh=true to fetch live data via SSH. Returns findings grouped by severity (critical/warning/info) with remediation commands. For a full scored security audit across 27 categories, use server_audit instead. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "fresh": { "default": false, "description": "Fetch live data via SSH instead of using cached metrics. Default: false (reads cache only).", "type": "boolean" }, "format": { "default": "summary", "description": "Output format: summary (grouped findings with counts), json (full DoctorResult).", "type": "string", "enum": [ "summary", "json" ] }, "autoFix": { "default": false, "description": "Run diagnose->fix chain automatically. Default: false (read-only).", "type": "boolean" }, "dryRun": { "default": false, "description": "Show what fixes would be applied without executing SSH. Requires autoFix: true.", "type": "boolean" }, "force": { "default": false, "description": "Skip per-finding confirmation prompts (CI-safe). Requires autoFix: true.", "type": "boolean" } } } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "type": "object", "properties": { "server": { "type": "string" }, "total": { "type": "number" }, "critical": { "type": "number" }, "warning": { "type": "number" }, "info": { "type": "number" }, "score": { "type": "number" }, "ranAt": { "type": "string" }, "usedFreshData": { "type": "boolean" }, "findings": { "type": "array", "items": { "type": "string" } } }, "required": [ "server", "total", "critical", "warning", "info", "score", "ranAt", "usedFreshData", "findings" ], "additionalProperties": false } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Doctor", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	Read onlyNon-destructiveIdempotentOpen world	—
server_evidenceCollect forensic evidence package from a server. Gathers firewall rules, auth.log, listening ports, system logs, and optionally Docker info. Writes to ~/.kastell/evidence/{server}/{date}/. Returns manifest with SHA256 checksums per file. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "name": { "description": "Label for the evidence directory (e.g. 'pre-incident').", "type": "string" }, "lines": { "default": 500, "description": "Number of log lines to collect per file (default: 500).", "type": "number" }, "no_docker": { "default": false, "description": "Skip Docker data collection.", "type": "boolean" }, "no_sysinfo": { "default": false, "description": "Skip system information collection.", "type": "boolean" }, "force": { "default": false, "description": "Overwrite existing evidence directory.", "type": "boolean" } } } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "type": "object", "properties": { "evidenceDir": { "type": "string" }, "serverName": { "type": "string" }, "serverIp": { "type": "string" }, "platform": { "type": "string" }, "collectedAt": { "type": "string" }, "totalFiles": { "type": "number" }, "skippedFiles": { "type": "number" }, "manifestPath": { "type": "string" } }, "required": [ "evidenceDir", "serverName", "serverIp", "platform", "collectedAt", "totalFiles", "skippedFiles", "manifestPath" ], "additionalProperties": false } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Evidence Collection", "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }	—	WritesNon-destructiveNon-idempotentOpen world	—
server_explainDeep-dive into a single audit check. Returns what it does, why it matters, how to fix it, fix tier (SAFE/GUARDED/FORBIDDEN), and compliance references (CIS/PCI-DSS/HIPAA). No SSH connection required. Supports case-insensitive and fuzzy matching for check IDs. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "checkId": { "type": "string", "description": "Audit check ID to explain (e.g. SSH-PASSWORD-AUTH). Case-insensitive, fuzzy matching supported." } }, "required": [ "checkId" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "category": { "type": "string" }, "severity": { "type": "string" }, "description": { "type": "string" }, "fix": { "type": "string" }, "why": { "type": "string" }, "fixTier": { "type": "string" }, "compliance": { "type": "array", "items": { "type": "object", "properties": { "framework": { "type": "string" }, "controlId": { "type": "string" }, "description": { "type": "string" } }, "required": [ "framework", "controlId", "description" ], "additionalProperties": false } } }, "required": [ "id", "name", "category", "severity", "description", "fix", "why", "fixTier" ], "additionalProperties": false } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Explain Audit Check", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }	—	Read onlyNon-destructiveIdempotentClosed world	—
server_fixApply safe auto-fixes to a server. Runs audit, filters SAFE tier fixes, creates backup, applies fixes, and re-audits for score delta. dryRun defaults to true (preview only). SAFE_MODE forces preview. SSH/Firewall/Docker fixes are FORBIDDEN and always rejected. Use checks and category params to target specific fixes. Input schema { "type": "object", "properties": {} } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "apply" }, "dryRun": { "type": "boolean", "const": true }, "safeModeForcedDryRun": { "type": "boolean" }, "preview": { "type": "object", "properties": { "groups": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string" }, "checks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "category": { "type": "string" }, "severity": { "type": "string" } }, "required": [ "id", "name", "category", "severity" ], "additionalProperties": false } } }, "required": [ "severity", "checks" ], "additionalProperties": false } } }, "required": [ "groups" ], "additionalProperties": false }, "applied": { "type": "array", "items": { "type": "string" } }, "message": { "type": "string" }, "rejectedChecks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "id", "reason" ], "additionalProperties": false } }, "guardedCount": { "type": "number" }, "forbiddenCount": { "type": "number" }, "scoreBefore": { "type": "number" }, "baselineRegression": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "regressionWarning": { "type": "object", "properties": { "regressions": { "type": "array", "items": { "type": "string" } }, "scoreRegressed": { "type": "boolean" }, "message": { "type": "string" } }, "required": [ "regressions", "scoreRegressed", "message" ], "additionalProperties": false } }, "required": [ "action", "dryRun", "rejectedChecks", "guardedCount", "forbiddenCount", "scoreBefore" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "apply" }, "dryRun": { "type": "boolean", "const": false }, "applied": { "type": "array", "items": { "type": "string" } }, "errors": { "type": "array", "items": { "type": "string" } }, "rejectedChecks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "id", "reason" ], "additionalProperties": false } }, "scoreBefore": { "type": "number" }, "scoreAfter": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "targetWarning": { "type": "string" }, "diffSummary": { "type": "array", "items": { "type": "string" } }, "reportFile": { "type": "string" }, "baselineRegression": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "regressionWarning": { "type": "object", "properties": { "regressions": { "type": "array", "items": { "type": "string" } }, "scoreRegressed": { "type": "boolean" }, "message": { "type": "string" } }, "required": [ "regressions", "scoreRegressed", "message" ], "additionalProperties": false } }, "required": [ "action", "dryRun", "applied", "errors", "rejectedChecks", "scoreBefore", "scoreAfter" ], "additionalProperties": false } ] }, { "type": "object", "properties": { "action": { "type": "string", "const": "history" }, "server": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" } }, "required": [ "name", "ip" ], "additionalProperties": false }, "entries": { "type": "array", "items": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "totalEntries": { "type": "number" } }, "required": [ "action", "server", "entries", "totalEntries" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "rollback" }, "fixId": { "type": "string" }, "restored": { "type": "array", "items": { "type": "string" } }, "errors": { "type": "array", "items": { "type": "string" } }, "scoreBefore": { "type": "number" }, "scoreAfter": { "anyOf": [ { "type": "number" }, { "type": "null" } ] } }, "required": [ "action", "fixId", "restored", "errors", "scoreBefore", "scoreAfter" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "rollback-all" }, "rolledBack": { "type": "array", "items": { "type": "string" } }, "errors": { "type": "array", "items": { "type": "string" } }, "scoreAfter": { "anyOf": [ { "type": "number" }, { "type": "null" } ] } }, "required": [ "action", "rolledBack", "errors", "scoreAfter" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "rollback-to" }, "targetFixId": { "type": "string" }, "rolledBack": { "type": "array", "items": { "type": "string" } }, "errors": { "type": "array", "items": { "type": "string" } }, "scoreAfter": { "anyOf": [ { "type": "number" }, { "type": "null" } ] } }, "required": [ "action", "targetFixId", "rolledBack", "errors", "scoreAfter" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Safe Fix", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }	—	WritesDestructiveNon-idempotentOpen world	—
server_fleetGet fleet-wide health and security posture for all registered servers. Returns server name, IP, provider, health status (ONLINE/DEGRADED/OFFLINE), cached audit score, and SSH response time. Use sort parameter to order results. For per-server cloud status or available server sizes, use server_info instead. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "sort": { "default": "name", "description": "Sort field: score (descending), name (A-Z), provider (A-Z). Default: name.", "type": "string", "enum": [ "score", "name", "provider" ] }, "categories": { "default": false, "description": "Include weakest audit category per server. Default: false.", "type": "boolean" } } } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "type": "object", "properties": { "servers": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" }, "status": { "type": "string", "enum": [ "ONLINE", "DEGRADED", "OFFLINE" ] }, "auditScore": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "responseTime": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "weakestCategory": { "type": "string" }, "weakestCategoryScore": { "type": "number" } }, "required": [ "name", "ip", "provider", "status", "auditScore", "responseTime" ], "additionalProperties": false } }, "total": { "type": "number" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "servers", "total" ], "additionalProperties": false } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Fleet Visibility", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	Read onlyNon-destructiveIdempotentOpen world	—
server_guardManage autonomous security monitoring daemon on a server. Actions: 'start' installs guard as remote cron (checks disk/RAM/CPU/audit every 5 min), 'stop' removes guard cron entry, 'status' shows whether guard is active with last check time and any threshold breaches. Requires SSH access to target server. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "action": { "type": "string", "enum": [ "start", "stop", "status" ], "description": "Guard action: 'start' installs guard cron, 'stop' removes it, 'status' shows current state and recent breaches." } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "type": "object", "properties": { "success": { "type": "boolean" }, "message": { "type": "string" }, "isActive": { "type": "boolean" }, "lastRunAt": { "type": "string" }, "breaches": { "type": "array", "items": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "logTail": { "type": "array", "items": { "type": "string" } }, "installedAt": { "type": "string" } }, "required": [ "success" ], "additionalProperties": false } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Guard Daemon", "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	WritesNon-destructiveIdempotentOpen world	—
server_infoGet information about Kastell-managed servers. Actions: 'list' all servers, 'status' check cloud provider + Coolify/bare status, 'health' check Coolify reachability or SSH access for bare servers, 'sizes' list available server types with prices for a provider+region. Requires provider API tokens as environment variables (HETZNER_TOKEN, DIGITALOCEAN_TOKEN, VULTR_TOKEN, LINODE_TOKEN) for status/sizes checks. Avoid calling repeatedly in short intervals to prevent provider API rate limiting. For fleet-wide health and audit scores across all servers, use server_fleet instead. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "list", "status", "health", "sizes" ], "description": "Action to perform: 'list' all servers, 'status' check server/cloud status, 'health' check Coolify reachability (or SSH reachability for bare servers), 'sizes' list available server types with prices for a provider+region" }, "server": { "description": "Server name or IP. Required for single-server status/health. Omit for all servers.", "type": "string" }, "provider": { "description": "Cloud provider (required for 'sizes' action)", "type": "string", "enum": [ "hetzner", "digitalocean", "vultr", "linode" ] }, "region": { "description": "Region/location ID (required for 'sizes' action, e.g. 'nbg1' for Hetzner, 'fra1' for DigitalOcean)", "type": "string" }, "mode": { "description": "Server mode filter for 'sizes' action. Coolify requires min 2GB RAM. Default: coolify", "type": "string", "enum": [ "coolify", "bare" ] } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "list" }, "servers": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" }, "region": { "type": "string" }, "size": { "type": "string" }, "id": { "type": "string" }, "mode": { "type": "string" }, "createdAt": { "type": "string" } }, "required": [ "name", "ip", "provider", "region", "size", "id", "mode", "createdAt" ], "additionalProperties": false } }, "total": { "type": "number" }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "servers", "total", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "status" }, "results": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" }, "region": { "type": "string" }, "size": { "type": "string" }, "mode": { "type": "string" }, "serverStatus": { "type": "string" }, "platformStatus": { "type": "string" }, "error": { "type": "string" } }, "required": [ "name", "ip", "provider", "region", "size", "mode", "serverStatus", "platformStatus" ], "additionalProperties": false } }, "summary": { "type": "object", "properties": { "total": { "type": "number" }, "running": { "type": "number" }, "notReachable": { "type": "number" }, "errors": { "type": "number" } }, "required": [ "total", "running", "notReachable", "errors" ], "additionalProperties": false }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "results", "summary", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "health" }, "results": { "type": "array", "items": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "summary": { "type": "object", "properties": { "total": { "type": "number" }, "running": { "type": "number" }, "notReachable": { "type": "number" }, "bare": { "type": "number" } }, "required": [ "total", "running", "notReachable", "bare" ], "additionalProperties": false }, "server": { "type": "string" }, "ip": { "type": "string" }, "mode": { "type": "string" }, "sshReachable": { "type": "boolean" }, "hostKeyMismatch": { "type": "boolean" }, "platformStatus": { "type": "string" }, "coolifyUrl": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "dokployUrl": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "sizes" }, "provider": { "type": "string" }, "region": { "type": "string" }, "mode": { "type": "string" }, "sizes": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "vcpu": { "type": "number" }, "ram": { "type": "string" }, "disk": { "type": "string" }, "price": { "type": "string" } }, "required": [ "id", "name", "vcpu", "ram", "disk", "price" ], "additionalProperties": false } }, "total": { "type": "number" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "provider", "region", "mode", "sizes", "total", "suggested_actions" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Information", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	Read onlyNon-destructiveIdempotentOpen world	—
server_lockHarden a server to production standard. Applies 24 hardening steps in a single SSH session covering SSH, fail2ban, UFW, sysctl, unattended-upgrades, Docker daemon, auditd, AIDE, and more. Requires production=true (safety gate). Pass dryRun=true to preview. Platform-aware: preserves Coolify/Dokploy ports. Shows audit score before and after. Requires SSH access. For fine-grained SSH/firewall/domain changes use server_secure instead. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "production": { "default": false, "description": "Set to true to confirm hardening intent. Required to apply 19 hardening steps (safety gate). Omit or pass false to preview with dryRun=true.", "type": "boolean" }, "dryRun": { "default": false, "description": "Preview changes without applying. Returns what would be done. Bypasses the production safety gate.", "type": "boolean" }, "force": { "default": false, "description": "Force lock even if server already appears hardened.", "type": "boolean" } } } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "type": "object", "properties": { "success": { "type": "boolean" }, "steps": { "type": "number" }, "scoreBefore": { "type": "number" }, "scoreAfter": { "type": "number" }, "stepErrors": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "required": [ "success", "steps", "scoreBefore", "scoreAfter" ], "additionalProperties": false } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Lock", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }	—	WritesDestructiveNon-idempotentOpen world	—
server_logsFetch logs and system metrics from Kastell-managed servers via SSH. Actions: 'logs' retrieves recent log lines from Coolify container (Coolify servers only), Docker service, or system journal. Bare servers: use service 'system' or 'docker' (coolify service not available). 'monitor' fetches CPU, RAM, and disk usage metrics (works for all server modes). Requires SSH access to target server (root@ip). Note: live streaming (--follow) is not available via MCP — use the CLI for live log tailing. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "logs", "monitor" ], "description": "Action: 'logs' fetch recent log lines, 'monitor' fetch CPU/RAM/Disk metrics" }, "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "service": { "default": "coolify", "description": "Log source (only for 'logs' action): 'coolify' container (Coolify servers only), 'docker' service journal, 'system' full journal", "type": "string", "enum": [ "coolify", "docker", "system" ] }, "lines": { "default": 50, "description": "Number of log lines to fetch (only for 'logs' action, default: 50, max: 500)", "type": "number", "minimum": 1, "maximum": 500 }, "containers": { "default": false, "description": "Include Docker container list in metrics (only for 'monitor' action)", "type": "boolean" } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "logs" }, "server": { "type": "string" }, "ip": { "type": "string" }, "service": { "type": "string" }, "lines": { "type": "number" }, "logs": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "service", "lines", "logs", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "monitor" }, "server": { "type": "string" }, "ip": { "type": "string" }, "metrics": { "type": "object", "properties": { "cpu": { "type": "object", "properties": { "percent": { "type": "number" } }, "required": [ "percent" ], "additionalProperties": false }, "mem": { "type": "object", "properties": { "percent": { "type": "number" }, "total": { "type": "number" }, "used": { "type": "number" } }, "required": [ "percent", "total", "used" ], "additionalProperties": false }, "disk": { "type": "object", "properties": { "percent": { "type": "number" }, "total": { "type": "number" }, "used": { "type": "number" } }, "required": [ "percent", "total", "used" ], "additionalProperties": false } }, "required": [ "cpu", "mem", "disk" ], "additionalProperties": false }, "containers": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "status": { "type": "string" } }, "required": [ "id", "name", "status" ], "additionalProperties": false } }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "metrics", "suggested_actions" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Logs & Metrics", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	Read onlyNon-destructiveIdempotentOpen world	—
server_maintainMaintain Kastell servers. Actions: 'update' runs Coolify update via SSH (Coolify servers only — bare servers are blocked), 'restart' reboots server via cloud provider API (works for both Coolify and bare servers), 'maintain' runs full 5-step maintenance (Coolify servers only — bare servers are blocked). Snapshot not included — use server_backup tool. Requires SSH access for update, provider API tokens for restart/status. Manual servers: restart not available. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "update", "restart", "maintain" ], "description": "Action: 'update' runs platform update via SSH (managed servers — Coolify or Dokploy), 'restart' reboots server via cloud provider API (both modes), 'maintain' runs full 5-step maintenance (status → update → health → reboot → final, managed servers only)" }, "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "skipReboot": { "default": false, "description": "Skip reboot and final check steps (only for 'maintain' action). Useful during business hours.", "type": "boolean" } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "update" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "restart" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "finalStatus": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "finalStatus", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "maintain" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" }, "steps": { "type": "array", "items": { "type": "object", "properties": { "step": { "type": "number" }, "name": { "type": "string" }, "status": { "type": "string" }, "detail": { "type": "string" }, "error": { "type": "string" }, "hint": { "type": "string" } }, "required": [ "step", "name", "status" ], "additionalProperties": false } }, "summary": { "type": "object", "properties": { "total": { "type": "number" }, "success": { "type": "number" }, "failure": { "type": "number" }, "skipped": { "type": "number" } }, "required": [ "total", "success", "failure", "skipped" ], "additionalProperties": false }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "provider", "steps", "summary", "suggested_actions" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Maintenance", "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	WritesNon-destructiveIdempotentOpen world	—
server_manageManage Kastell servers. Actions: 'add' registers an existing Coolify or bare server to local config (validates API token, optionally verifies Coolify via SSH — pass mode:'bare' for servers without Coolify). 'remove' unregisters a server from local config only (cloud server keeps running). 'destroy' PERMANENTLY DELETES the server from the cloud provider and removes from local config. Requires provider API tokens as environment variables. Destroy is blocked when KASTELL_SAFE_MODE=true. Server mode for 'add' action: 'coolify', 'dokploy', or 'bare'. Default: coolify Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "add", "remove", "destroy" ], "description": "Action: 'add' register an existing server, 'remove' unregister from local config (server stays running), 'destroy' permanently delete from cloud provider AND local config" }, "server": { "description": "Server name or IP (required for 'remove' and 'destroy' actions)", "type": "string" }, "provider": { "description": "Cloud provider: 'hetzner', 'digitalocean', 'vultr', 'linode' (required for 'add' action). If omitted and client supports elicitation, a form will be shown.", "type": "string", "enum": [ "hetzner", "digitalocean", "vultr", "linode" ] }, "ip": { "description": "Server public IP address (required for 'add' action). If omitted and client supports elicitation, a form will be shown.", "type": "string" }, "name": { "description": "Server name, 3-63 chars, lowercase alphanumeric and hyphens (required for 'add' action). If omitted and client supports elicitation, a form will be shown.", "type": "string" }, "skipVerify": { "default": false, "description": "Skip Coolify SSH verification when adding a server (only for 'add' action)", "type": "boolean" }, "mode": { "default": "coolify", "description": "Server mode for 'add' action: 'coolify', 'dokploy', or 'bare'. Default: coolify", "type": "string", "enum": [ "coolify", "dokploy", "bare" ] } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "add" }, "success": { "type": "boolean" }, "message": { "type": "string" }, "server": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" }, "id": { "type": "string" }, "mode": { "type": "string" } }, "required": [ "name", "ip", "provider", "id", "mode" ], "additionalProperties": false }, "platformStatus": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "message", "server", "platformStatus", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "remove" }, "success": { "type": "boolean" }, "message": { "type": "string" }, "note": { "type": "string" }, "server": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" } }, "required": [ "name", "ip", "provider" ], "additionalProperties": false }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "message", "note", "server", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "destroy" }, "success": { "type": "boolean" }, "message": { "type": "string" }, "cloudDeleted": { "type": "boolean" }, "localRemoved": { "type": "boolean" }, "note": { "type": "string" }, "server": { "type": "object", "properties": { "name": { "type": "string" }, "ip": { "type": "string" }, "provider": { "type": "string" } }, "required": [ "name", "ip", "provider" ], "additionalProperties": false }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "message", "cloudDeleted", "localRemoved", "server", "suggested_actions" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Management", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }	—	WritesDestructiveNon-idempotentOpen world	—
server_pluginManage kastell plugins. Actions: 'list' shows installed plugins with check counts and status, 'validate' checks manifest integrity and entry point validity. Install/remove not available via MCP — use CLI for security (requires explicit user consent). No SSH connection required. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "list", "validate" ], "description": "Action: 'list' shows installed plugins, 'validate' checks manifest integrity. Install/remove not available via MCP — use CLI for security (requires explicit user consent)." }, "name": { "description": "Plugin name for validate action (validates all if omitted)", "type": "string" } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "list" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "status": { "type": "string" }, "checks": { "type": "number" }, "commandCount": { "type": "number" }, "mcpToolCount": { "type": "number" } }, "required": [ "name", "status" ], "additionalProperties": false } }, "count": { "type": "number" } }, "required": [ "action", "plugins", "count" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "validate" }, "results": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "valid": { "type": "boolean" }, "errors": { "type": "array", "items": { "type": "string" } } }, "required": [ "name", "valid" ], "additionalProperties": false } } }, "required": [ "action", "results" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Plugin Management", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }	—	Read onlyNon-destructiveIdempotentClosed world	—
server_provisionProvision a new server on a cloud provider. Default: Coolify auto-install via cloud-init. Pass mode:'bare' for a generic VPS without Coolify (installs UFW and runs system updates only). Requires provider API token as environment variable (HETZNER_TOKEN, DIGITALOCEAN_TOKEN, VULTR_TOKEN, LINODE_TOKEN). WARNING: Creates a billable cloud resource. Blocked when KASTELL_SAFE_MODE=true. Server takes 3-5 minutes to fully initialize after provisioning. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "provider": { "description": "Cloud provider to create server on. If omitted and client supports elicitation, a form will be shown.", "type": "string", "enum": [ "hetzner", "digitalocean", "vultr", "linode" ] }, "region": { "description": "Region/location ID (e.g. 'nbg1' for Hetzner, 'fra1' for DigitalOcean, 'ewr' for Vultr, 'us-east' for Linode). Uses template defaults if omitted", "type": "string" }, "size": { "description": "Server type/plan ID (e.g. 'cax11' for Hetzner, 's-2vcpu-2gb' for DigitalOcean). Uses template defaults if omitted", "type": "string" }, "name": { "description": "Server hostname, 3-63 chars, lowercase, starts with letter, only alphanumeric and hyphens, ends with letter or number. If omitted and client supports elicitation, a form will be shown.", "type": "string" }, "template": { "default": "starter", "description": "Template for default region/size. 'starter' = cheapest, 'production' = more resources, 'dev' = development. Explicit region/size override template defaults. Default: starter", "type": "string", "enum": [ "starter", "production", "dev" ] }, "mode": { "default": "coolify", "description": "Server mode: 'coolify' installs Coolify, 'dokploy' installs Dokploy, 'bare' provisions generic VPS. Default: coolify", "type": "string", "enum": [ "coolify", "dokploy", "bare" ] } } } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "created-persisted" }, "success": { "type": "boolean" }, "message": { "type": "string" }, "server": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "provider": { "type": "string" }, "ip": { "type": "string" }, "region": { "type": "string" }, "size": { "type": "string" }, "mode": { "type": "string" }, "createdAt": { "type": "string" } }, "required": [ "id", "name", "provider", "ip", "region", "size", "mode", "createdAt" ], "additionalProperties": false }, "replacedStaleServer": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "provider": { "type": "string" }, "ip": { "type": "string" }, "region": { "type": "string" }, "size": { "type": "string" }, "mode": { "type": "string" }, "createdAt": { "type": "string" } }, "required": [ "id", "name", "provider", "ip", "region", "size", "mode", "createdAt" ], "additionalProperties": false }, "readiness": { "type": "object", "properties": { "status": { "type": "string", "enum": [ "pending", "ready", "unknown" ] }, "message": { "type": "string" } }, "required": [ "status" ], "additionalProperties": false }, "hint": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "kind", "server" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "created-orphan" }, "provider": { "type": "string", "enum": [ "hetzner", "digitalocean", "vultr", "linode" ] }, "providerId": { "type": "string" }, "name": { "type": "string" }, "ip": { "type": "string" }, "suggestedCommand": { "type": "string" } }, "required": [ "kind", "provider", "providerId", "name", "ip", "suggestedCommand" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "cancelled" }, "status": { "type": "string", "const": "cancelled" }, "message": { "type": "string" } }, "required": [ "kind", "status", "message" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Provisioning", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }	—	WritesDestructiveNon-idempotentOpen world	—
server_secureSecure Kastell servers. Secure: 'secure-setup' applies SSH hardening + fail2ban, 'secure-audit' runs security audit with score. Firewall: 'firewall-setup' installs UFW with Coolify ports, 'firewall-add'/'firewall-remove' manage port rules, 'firewall-status' shows current rules. Domain: 'domain-set'/'domain-remove' manage custom domain with optional SSL, 'domain-check' verifies DNS, 'domain-info' shows current FQDN. All require SSH access to server. For full one-shot hardening (SSH + fail2ban + UFW + sysctl + unattended-upgrades), use server_lock instead. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "action": { "type": "string", "enum": [ "audit", "secure-setup", "secure-audit", "firewall-setup", "firewall-add", "firewall-remove", "firewall-status", "domain-set", "domain-remove", "domain-check", "domain-info" ], "description": "Action: Secure: 'secure-setup' hardens SSH + installs fail2ban, 'secure-audit' runs security audit with score. Firewall: 'firewall-setup' installs UFW, 'firewall-add'/'firewall-remove' manage port rules, 'firewall-status' shows rules. Domain: 'domain-set'/'domain-remove' manage FQDN, 'domain-check' verifies DNS, 'domain-info' shows current FQDN." }, "server": { "description": "Server name or IP. Auto-selected if only one server exists.", "type": "string" }, "port": { "description": "Port number. Required for firewall-add/remove. Optional SSH port for secure-setup.", "type": "number", "minimum": 1, "maximum": 65535 }, "protocol": { "default": "tcp", "description": "Protocol for firewall rules. Default: tcp.", "type": "string", "enum": [ "tcp", "udp" ] }, "domain": { "description": "Domain name. Required for domain-set and domain-check.", "type": "string" }, "ssl": { "default": true, "description": "Enable SSL (https) for domain. Default: true.", "type": "boolean" } }, "required": [ "action" ] } Output schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "result": { "oneOf": [ { "type": "object", "properties": { "action": { "type": "string", "const": "secure-setup" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "sshHardening": { "type": "boolean" }, "fail2ban": { "type": "boolean" }, "sshKeyCount": { "type": "number" }, "hint": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "sshHardening", "fail2ban", "sshKeyCount", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "audit" }, "server": { "type": "string" }, "ip": { "type": "string" }, "score": { "type": "number" }, "maxScore": { "type": "number" }, "checks": { "type": "object", "properties": { "passwordAuth": { "type": "boolean" }, "rootLogin": { "type": "boolean" }, "fail2ban": { "type": "boolean" }, "sshPort": { "type": "boolean" } }, "required": [ "passwordAuth", "rootLogin", "fail2ban", "sshPort" ], "additionalProperties": false }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "score", "maxScore", "checks", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "secure-audit" }, "server": { "type": "string" }, "ip": { "type": "string" }, "score": { "type": "number" }, "maxScore": { "type": "number" }, "checks": { "type": "object", "properties": { "passwordAuth": { "type": "boolean" }, "rootLogin": { "type": "boolean" }, "fail2ban": { "type": "boolean" }, "sshPort": { "type": "boolean" } }, "required": [ "passwordAuth", "rootLogin", "fail2ban", "sshPort" ], "additionalProperties": false }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "score", "maxScore", "checks", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "firewall-setup" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "firewall-add" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "firewall-remove" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "warning": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "firewall-status" }, "server": { "type": "string" }, "ip": { "type": "string" }, "active": { "type": "boolean" }, "rules": { "type": "array", "items": { "type": "object", "properties": { "port": { "type": "string" }, "proto": { "type": "string" }, "action": { "type": "string" }, "from": { "type": "string" } }, "required": [ "port", "proto", "action", "from" ], "additionalProperties": false } }, "ruleCount": { "type": "number" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "active", "rules", "ruleCount", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "domain-set" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "url": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "url", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "domain-remove" }, "success": { "type": "boolean" }, "server": { "type": "string" }, "ip": { "type": "string" }, "message": { "type": "string" }, "url": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "success", "server", "ip", "message", "url", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "domain-check" }, "server": { "type": "string" }, "ip": { "type": "string" }, "domain": { "type": "string" }, "resolvedIp": { "type": "string" }, "match": { "type": "boolean" }, "hint": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "domain", "resolvedIp", "match", "suggested_actions" ], "additionalProperties": false }, { "type": "object", "properties": { "action": { "type": "string", "const": "domain-info" }, "server": { "type": "string" }, "ip": { "type": "string" }, "fqdn": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "message": { "type": "string" }, "suggested_actions": { "type": "array", "items": { "type": "object", "properties": { "command": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "command", "reason" ], "additionalProperties": false } } }, "required": [ "action", "server", "ip", "fqdn", "message", "suggested_actions" ], "additionalProperties": false } ] } }, "required": [ "result" ], "additionalProperties": false } Annotations { "title": "Server Security", "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }	—	WritesNon-destructiveIdempotentOpen world	—

Endpoint	Transport	Authentication	Health	Observed
No verified remote endpoint is linked.

How do I install Kastell MCP Server?

Install the selected package version with: npm install --save-exact kastell@2.3.1

What tools does Kastell MCP Server provide?

Kastell MCP Server exposed 17 tools during independent protocol observation, including server_audit, server_backup, server_compare, server_doctor, server_evidence, server_explain, server_fix, server_fleet, and others.

Is Kastell MCP Server secure?

Our scanner tested version 2.3.1 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.

Kastell MCP Server

Install and connect

Install kastell from npm

Identity

Distributions

Current release

Continuously monitor this MCP for security risk

Current version evidence

Current protocol inventory

Tools 17

Resources 2

Resource templates 2

Prompts 3

Remote endpoints

Kastell MCP Server questions

Explore related MCP server guides

Let’s talk about MCP security.