An approval is bound to the principal, the capability, the resolved target identity, the resource and the normalized arguments — so approving a restart on one host is not approval to restart another. There is deliberately no raw shell tool: the privileged surface is a fixed list of validated operations, which is the point of the 2.0 rewrite.
A hardened MCP server for managing mikr.us VPS instances and remote Linux hosts over SSH. Reads and mutations are separate classes, and privileged actions are exposed as specific validated operations rather than a shell.
- mikr.us API targets and ordinary SSH hosts through the same server
- VPS operations: get_server_info, list_servers, get_server_stats, restart_server, boost_server, get_ports, get_cloud, assign_domain
- Files and services: read_file, write_file, list_directory, tail_file, search_in_files, get_service_status, change_service_state
- System inspection: analyze_disk, check_port, list_processes, terminate_process, get_memory_info, get_network_info, get_process_tree, update_system
- Docker and journald: list_docker_containers, get_docker_logs, get_docker_stats, get_journal_logs, find_system_errors, search_journal_logs
- A response sanitizer over credential fields, so get_db_info does not leak them into the conversation
- SSH host-key verification on by default, with the verified SHA-256 fingerprint bound into mutation identity
Python 3.12 or newer; version 2.0.0. Either MIKRUS_API_KEY with MIKRUS_SERVER_NAME, or SSH targets defined in MCP_SERVERS. Writes need MCP_WRITE_ENABLED plus an approval file at MCP_APPROVAL_FILE. Transport is local stdio, or authenticated loopback-only Streamable HTTP.
One command plus a key — .venv/bin/python -m pip install ., then supply credentials