Kastell
kastelldev/kastell
Runs 413+ security checks across your Linux servers and exposes them through MCP tools so Claude can audit SSH configs, review firewall rules, and scan for CIS compliance gaps. Beyond read-only audits, it provisions servers on Hetzner, DigitalOcean, AWS, and Linode, applies SSH hardening and fail2ban setup, manages UFW firewall rules, and handles full maintenance cycles with pre-update snapshots. The MCP layer surfaces 14 tools covering deployment, security lockdown, backup/restore, and health monitoring. If you're managing a fleet and want an AI agent that can both diagnose weak SSL ciphers and actually fix them, this bridges the gap between audit output and remediation commands.
- GitHub stars
- 52
- tools
- 14
- auth
- Secret needed
- transport
- STDIO
- env vars
- 4
- last updated
- Mar 24, 2026
Tools
14 toolsPublic tool metadata for what this MCP can expose to an agent.
server_infoQuery server information, check cloud provider and platform status
Query server information, check cloud provider and platform status
No parameter schema in public metadata yet.
server_logsFetch platform/Docker logs and system metrics via SSH
Fetch platform/Docker logs and system metrics via SSH
No parameter schema in public metadata yet.
server_manageRegister, unregister, or destroy cloud servers
Register, unregister, or destroy cloud servers
No parameter schema in public metadata yet.
server_maintainUpdate platform, restart servers, run full maintenance
Update platform, restart servers, run full maintenance
No parameter schema in public metadata yet.
server_secureSSH hardening, firewall rules, domain/SSL management (10 subcommands)
SSH hardening, firewall rules, domain/SSL management (10 subcommands)
No parameter schema in public metadata yet.
server_backupBackup/restore databases and create/manage VPS snapshots
Backup/restore databases and create/manage VPS snapshots
No parameter schema in public metadata yet.
server_provisionProvision new servers on cloud providers
Provision new servers on cloud providers
No parameter schema in public metadata yet.
server_audit449-check security audit with compliance framework filtering; use `--explain` for remediation guidance
449-check security audit with compliance framework filtering; use `--explain` for remediation guidance
No parameter schema in public metadata yet.
server_evidenceCollect forensic evidence package with checksums
Collect forensic evidence package with checksums
No parameter schema in public metadata yet.
server_guardManage autonomous security monitoring daemon
Manage autonomous security monitoring daemon
No parameter schema in public metadata yet.
server_doctorProactive health analysis with remediation commands
Proactive health analysis with remediation commands
No parameter schema in public metadata yet.
server_lock24-step production hardening (SSH, UFW, sysctl, auditd, AIDE, Docker)
24-step production hardening (SSH, UFW, sysctl, auditd, AIDE, Docker)
No parameter schema in public metadata yet.
server_fleetFleet-wide health and security posture dashboard
Fleet-wide health and security posture dashboard
No parameter schema in public metadata yet.
server_fixApply safe auto-fixes with backup (SAFE tier only, dryRun default)
Apply safe auto-fixes with backup (SAFE tier only, dryRun default)
No parameter schema in public metadata yet.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageConfiguration
HETZNER_TOKENsecretHetzner Cloud API token (optional — only for Hetzner servers)
DIGITALOCEAN_TOKENsecretDigitalOcean API token (optional — only for DigitalOcean servers)
VULTR_TOKENsecretVultr API token (optional — only for Vultr servers)
LINODE_TOKENsecretLinode API token (optional — only for Linode servers)
Readme
Details
- Repository
- github.com/kastelldev/kastell
- Category
- Security & Pentesting
- Package
kastell- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
