A generic run-any-command server on a live box is one confident mistake away from a deleted volume. Here the split is structural: reads are free, writes on a production-like server need a string only you hold, and the genuinely irrecoverable operations need a separate backup attestation on top. The author is equally clear about the limit — once you are in FULL mode with the token, the model can do anything the SSH user can, and `backupVerified` is your word, not a check.
A mode-based MCP server for running real servers from an AI client. Reading is always allowed inside a read-only allowlist; changing anything on a production-like box requires a consent token passed out of band, which the model cannot read or fabricate. Discovery is read-only by design, and deployments go through a reviewable script rather than a stream of ad-hoc commands.
- 32 tools covering server lifecycle, discovery, execution and audit
- Three access modes: `SAFE` (default, read-only allowlist, no expiry), `PROVISION` (system installs, 1 hour default expiry) and `FULL` (root, 30 minutes default expiry); sessions drop back to SAFE when they lapse
- A read-only discovery scan of OS, hardware, listening ports, installed stack, containers, nginx sites and systemd services, persisted as a profile — `scan_server`, `get_server_profile`, and `diff_server_profile` to see what changed since
- Deployment that plans instead of firing: `check_port_conflict` names the process holding a port and suggests a free one, and `plan_deployment` returns an idempotent bash script that the server explicitly does not execute
- A production write-gate — on a server with `role: production`, or one the scanner flags as production-like, a non-SAFE command needs `consentToken` plus `acknowledgeProductionWrite: true`, and irrecoverable operations additionally need `backupVerified: true`. Refusals echo the exact resolved command
- Around 250 read-only verbs that run in SAFE, with quote-aware chain splitting so a diagnostic pipeline like `du -sh /opt/* ; echo --- ; df -h /` does not force elevation
- One SSH connection per server keyed by `serverId`, so two conversations working on two boxes cannot clobber each other; `run_command` refuses an ambiguous call rather than guessing when two or more servers are connected
- A JSON-lines audit log of every command, mode change, approval and scan, readable through `get_audit_log`
SSH access to the servers you add — password, a copied key file, an inline key, an external key path, or your existing `~/.ssh/id_*`; encrypted keys take a passphrase. Node 18 or newer; clone, `npm install`, `npm run build`. **Generate the elevation token before you configure anything** with `openssl rand -hex 24` and store it in a password manager: it goes in `DEVOPS_MCP_ELEVATION_TOKEN` in your client config, it never expires, and there is no recovery flow — without it, `set_mode`, `approve_action` and the production write-gate fall back to accepting the model's own boolean as consent. `LOG_LEVEL`, `LOG_DIR` and `DEVOPS_MCP_NO_CONSOLE_LOG` are optional. MIT licensed.
Run a container — pull the image and point your client at it