Servonaut
PYPI · SERVONAUT
Manage AWS, Hetzner, OVH and SSH servers: status, logs, CloudWatch, IP bans, safe command exec.
Available components
Last scanned (1 hour ago)
Scores higher than 84% of PyPI servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 4 of 41 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 11479 tokens (~166/item across 69 items; 69 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "transfer_file" implies "transfer" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 70 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 4 Nov 26 0
- Package version: 2.29.0 → 2.31.0 functional
- 3 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 2 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 1 Nov 26 0
- Stability: 0.97 → pass security
- Package version: 2.30.0 → 2.31.0 functional
- 31 Oct 26 0
- Stability: pass → 0.97 functional
- 30 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 25 Oct 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/servonaut@2.31.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 41 packages
| Packages resolved | 41 |
|---|---|
| Stale | 4 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
remember_server_finding ~329
Persist a hard-won, non-obvious discovery (quirk, gotcha, root-cause, constraint) about an instance that is NOT visible in a fresh probe — e.g. a misconfigured cron, a hidden dependency, a port blocked by an upstream policy, a bug triggered only under load. Saved locally immediately and queued for end-to-end encrypted sync. The title is the searchable recall key — keep it short and specific. Returns {finding_id, instance_id, title, auto_inject, superseded, secret_warning}. auto_inject=true means the title will be surfaced automatically in future context (confidence >= threshold); false = recall-only.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Full finding text, evidence, and context (≤8000 chars). |
| confidence | number | – | Confidence score 0.0–1.0. Values >= threshold (default 0.6) cause the title to be auto-injected into future context; lower values are recall-only. |
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
| supersede_id | string | – | ID of an existing finding this corrects or replaces. The old finding is marked superseded; pass the finding_id returned by a previous remember_server_finding call. |
| tags | array | – | Optional tags for filtering (max 12, lowercased). |
| title | string | yes | Short, searchable title for this finding (≤200 chars). This is the primary recall key — make it specific. |
No output schema declared.
No examples provided.
run_command ~138
Run a command on any managed instance. Defaults to SSH with automatic failover to AWS SSM when sshd is unreachable (e.g. under heavy load) on SSM-managed AWS instances.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | Command to execute. |
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
| transport | string | – | Execution channel. 'auto' (default) tries SSH then falls back to AWS SSM if the SSH connection fails; 'ssh' forces SSH; 'ssm' forces AWS Systems Manager (AWS-only). |
No output schema declared.
No examples provided.
s3_copy_object ~198
Server-side copy of an S3 object within the same provider. Overwrites the destination if it exists. Reserved for dangerous guard mode.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| dst_bucket | string | yes | Destination bucket name. |
| dst_key | string | yes | Destination object key. |
| provider | string | yes | Storage provider. |
| region | string | – | Region the DESTINATION bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets… |
| src_bucket | string | yes | Source bucket name. |
| src_key | string | yes | Source object key. |
No output schema declared.
No examples provided.
s3_create_bucket ~167
Create a new S3 bucket on the given provider. Costs money — billing starts immediately. Reserved for dangerous guard mode. Confirm with the user (provider, bucket name, region) before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Bucket name to create. |
| provider | string | yes | Storage provider. |
| region | string | – | Region to create the bucket in (e.g. 'eu-central-1'). Omit to use the configured region for the provider. AWS, and OVH when no endpoint URL is configured. For Hetzner, or an OVH endpoint URL set by h… |
No output schema declared.
No examples provided.
s3_delete_bucket ~172
Delete an EMPTY S3 bucket. Operation fails if any object remains. Irreversible. Reserved for dangerous guard mode. ALWAYS confirm with the user before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Bucket name to delete (must be empty). |
| provider | string | yes | Storage provider. |
| region | string | – | Region the bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets reports). Re… |
No output schema declared.
No examples provided.
s3_delete_object ~178
Delete a single object from S3. Irreversible. Reserved for dangerous guard mode. ALWAYS confirm with the user (provider, bucket, key) before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Bucket name. |
| key | string | yes | Object key to delete. |
| provider | string | yes | Storage provider. |
| region | string | – | Region the bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets reports). Re… |
No output schema declared.
No examples provided.
s3_download_object ~199
Download an object from S3 to a local file. local_path must resolve under the user's home directory, current working directory, or ~/Downloads ��� paths outside these roots are rejected for safety.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Bucket name. |
| key | string | yes | Object key. |
| local_path | string | yes | Local file path to write the downloaded object to. |
| provider | string | yes | Storage provider. |
| region | string | – | Region the bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets reports). Re… |
No output schema declared.
No examples provided.
s3_generate_presigned_url ~217
Generate a time-limited pre-signed URL granting read access to an S3 object. The URL is a bearer secret — anyone who possesses it can download the object until it expires. Reserved for dangerous guard mode. Confirm with the user before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Bucket name. |
| expires_in | integer | – | URL expiry in seconds (1–604800, default 3600). |
| key | string | yes | Object key. |
| provider | string | yes | Storage provider. |
| region | string | – | Region the bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets reports). Re… |
No output schema declared.
No examples provided.
s3_list_buckets ~68
List S3 buckets accessible with the configured credentials for the given provider (aws | hetzner | ovh).
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| provider | string | yes | Storage provider. |
No output schema declared.
No examples provided.
s3_list_objects ~230
List objects and virtual-folder prefixes in an S3 bucket. Returns a JSON object with 'folders', 'objects' (each with key/size/last_modified), and 'is_truncated' (true when the bucket has more than ~1000 keys matching the prefix — re-call with a more specific prefix).
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Bucket name. |
| delimiter | string | – | Delimiter for virtual folder grouping (default: '/'). |
| prefix | string | – | Key prefix to filter by (default: ''). |
| provider | string | yes | Storage provider. |
| region | string | – | Region the bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets reports). Re… |
No output schema declared.
No examples provided.
s3_move_object ~231
Move an S3 object (server-side copy then delete source). Irreversible on the source. Overwrites the destination if it exists. Reserved for dangerous guard mode.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| dst_bucket | string | yes | Destination bucket name. |
| dst_key | string | yes | Destination object key. |
| provider | string | yes | Storage provider. |
| region | string | – | Region the DESTINATION bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets… |
| src_bucket | string | yes | Source bucket name. |
| src_key | string | yes | Source object key. |
| src_region | string | – | Region the SOURCE bucket lives in. Only needed when the source and destination are in different regions. |
No output schema declared.
No examples provided.
s3_upload_object ~196
Upload a local file to an S3 bucket. local_path must resolve under home, cwd, or ~/Downloads. Overwrites the destination key if it exists. Reserved for dangerous guard mode.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Account label of the provider whose object storage to use; omit for that provider's default account. |
| bucket | string | yes | Destination bucket name. |
| key | string | yes | Destination object key. |
| local_path | string | yes | Local file path to upload. |
| provider | string | yes | Storage provider. |
| region | string | – | Region the bucket lives in (e.g. 'eu-central-1'). Omit unless you know it — it is resolved automatically. AWS, and OVH when no endpoint URL is configured (pass the region s3_list_buckets reports). Re… |
No output schema declared.
No examples provided.
security_audit ~172
Baseline security posture of one instance. Read-only, two signals: sshd effective config (sshd -T: permit-root-login, password-authentication, permit-empty-passwords, x11-forwarding) and a stat of a curated list of sensitive paths (sshd/sudoers/cron/passwd-family/root keys), flagging only those that are world-writable or not root-owned. Never changes sshd config or file permissions. Returns JSON: {sshd: {directive: value}, insecure_files: [{path, mode, owner, issue}]}. Powers the security-hardening detector (weak-sshd, insecure-perms).
| Name | Type | Req | Description |
|---|---|---|---|
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
No output schema declared.
No examples provided.
service_state ~115
Enablement / active / reload state of one instance's enabled systemd services. Read-only (systemctl is-enabled / is-active + NeedDaemonReload per unit; never changes state). Returns JSON: {units: [{unit, enabled, active, needs_reload}]}. Powers the service-state detector (enabled-but-inactive, needs-reload, active-but-unnecessary).
| Name | Type | Req | Description |
|---|---|---|---|
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
No output schema declared.
No examples provided.
tls_cert_check ~108
Discover TLS certificates on one instance (certbot live dirs + nginx/apache config references) and report expiry. Read-only. Returns JSON: {certs: [{domain, path, expires_at, days_left, issuer, self_signed}]}; a box with no certs returns an empty list. Errors: openssl_not_available.
| Name | Type | Req | Description |
|---|---|---|---|
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
No output schema declared.
No examples provided.
transfer_file ~76
Transfer a file via SCP to or from any managed instance.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | yes | – |
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
| local_path | string | yes | – |
| remote_path | string | yes | – |
No output schema declared.
No examples provided.
waf_rate_rule_set ~268
Create/attach (or remove) a WAF rate-based rule on a site's WebACL — the durable fix for a flood. 'site' is a WebACL ARN, ALB ARN, or instance id/name. 'limit' is requests per 5-min window per client IP; 'uri_scope' optionally restricts to a URI path prefix. Reversible (remove=true). DANGEROUS — confirm with the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | AWS account label a WebACL/ALB ARN site (or a named ban config) is in; omit for the default account. An instance site always uses its own account. |
| action | string | – | 'block' enforces; 'count' only meters (dry-run). |
| limit | integer | – | Requests per 5-minute window per IP (default 2000). |
| region | string | – | AWS region override. |
| remove | boolean | – | Remove the named rule instead of adding it. |
| rule_name | string | – | Rule name (idempotent — reusing it updates the limit). |
| site | string | yes | WebACL ARN, ALB ARN, or instance id/name. |
| uri_scope | string | – | Optional URI path prefix to scope the rule to (e.g. '/'). |
No output schema declared.
No examples provided.
web_traffic_summary ~239
Summarize a managed instance's OWN web access logs (X-Forwarded-For / mod_remoteip aware): per-vhost request volume, approx req/s, status-code mix, top client IPs and top URLs. Reads the decisive on-box data that cloudwatch_top_ips (WAF logs only) cannot see. Auto-discovers nginx/apache/httpd logs when log_path is omitted. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| hours_back | integer | – | Only count entries from the last N hours (1–168). Omit for no time filter; the window can never reach further back than the tailed lines cover. |
| instance_id | string | yes | Instance ID or name. '<account>/<name>' picks the server of one provider account; custom servers are 'custom/<name>'. |
| lines | integer | – | Lines to tail per log file (100–200000, default 10000). |
| log_path | string | – | Explicit access-log path. Empty = auto-discover nginx/apache/httpd access logs. |
| top_n | integer | – | How many top IPs/URLs to report (1–100, default 15). |
No output schema declared.
No examples provided.
whoami ~37
Describe the currently logged-in servonaut.dev session (email, plan, API base URL, token expiry). The OAuth bearer itself is never returned.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Servonaut MCP server?
Servonaut runs locally as a PyPI package, launched with uvx servonaut. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · servonaut
claude mcp add dev-servonaut-servonaut -- uvx servonaut
What is the Servonaut MCP server?
Servonaut is an MCP server listed in the public MCP registry as dev.servonaut/servonaut. Manage AWS, Hetzner, OVH and SSH servers: status, logs, CloudWatch, IP bans, safe command exec. This page covers its PyPI package (servonaut).
Is the Servonaut MCP server safe to use?
Servonaut scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Servonaut MCP server expose?
Servonaut exposes 69 tools: list_instances, check_status, get_server_info, run_command, get_logs, and 64 more. Their descriptions and schemas cost roughly 10,842 tokens of context every time the server is loaded.
Is the Servonaut MCP server still maintained?
Servonaut is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Servonaut MCP server under?
Servonaut declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.