Everything here is a read — nothing restarts a service or changes a rule — so pointing an assistant at a box is a triage decision rather than a control decision. It assumes Ubuntu or Debian and shells out to the usual tools, so the results are exactly what those commands return for the user the server runs as, including nothing at all where that user lacks permission.
An MCP server that wraps the commands you would run over SSH when something is wrong on an Ubuntu box. They are grouped into network reachability, service and process state, disk and memory, ports and firewall, and who has access — each one a named tool rather than a shell string the model has to compose.
- Reachability: is a TCP port open, does the host answer ICMP, what does DNS resolve to, what does a URL return, where does the path go — `check_port`, `ping_host`, `dns_lookup`, `http_check`, `traceroute_host`
- Machine basics — uptime, hostname, and CPU, memory and disk at a glance — `get_uptime`, `get_hostname`, `get_sys_info`
- Service and process state, the latest logs for one unit, and the current user's cron jobs — `list_processes`, `list_services`, `service_status`, `read_journal`, `cron_list`
- Storage and memory pressure, including the inode stats a plain disk-usage check misses — `check_disk_usage`, `check_memory`, `check_inode_usage`, `list_mounts`
- Network exposure: which TCP/UDP ports are listening, what UFW or iptables allows, interface IP, MAC and link state, and traffic counters — `list_open_ports`, `check_firewall_status`, `list_network_interfaces`, `check_bandwidth_usage`
- Access review: local users, last login attempts, who can sudo, who is logged in right now — `list_users`, `last_logins`, `check_sudoers`, `who_is_logged_in`
- A full GET with headers, and reverse DNS for an address — `curl_url`, `resolve_host`
Python 3.8+ on an Ubuntu or Debian-based system, and `pip install system-diag-mcp` — `uv pip install system-diag-mcp` also works (0.1.0 in pyproject). The binary is `system-diag-mcp` and speaks stdio, so the client's `command` points straight at it. The tools shell out, so `ping`, `dig`, `traceroute`, `systemctl`, `ps`, `df`, `free` and `curl` need to be present, and every answer reflects what the account running the server can see.
One command — pip install system-diag-mcp