Handing an agent a terminal is the risk this is built around, and the answer is the policy: the secure default confines paths to your home and temp dirs, allows a short command whitelist, and turns off sudo and raw shell. The dev policy loosens that for development. Every operation is audit-logged, so you can see afterwards exactly what ran.
A hardened server for Ubuntu operations — file reads and writes, command execution and system info — with path allowlisting, command filtering and audit logging.
- read_file, write_file and list_directory with permission validation
- execute_command with a command whitelist and shell-injection-safe argument parsing
- get_system_info for OS details, memory and disk usage; search_packages for APT search and listing
- Path traversal protection with symlink resolution against allow and deny lists
- Resource limits on file size, execution time and output; all operations audit-logged
- Selectable policies — a secure default and a more permissive dev policy
Ubuntu 18.04+ and Python 3.9 or higher. Clone, create a venv, install requirements, then launch main.py with a policy — the client passes --policy secure or --policy dev. The secure policy allows ~/, /tmp and /var/tmp, whitelists commands like ls, cat and grep, caps files at 1MB with 15s timeouts, and disables sudo and shell execution.