VPS Guardian
PYPI · VPS-GUARDIAN-MCP · 2 COMPONENTS
Secure SSH bridge for AI agents to observe and safely administer Linux VPSs.
Available components
Last scanned (9 hours ago)
Scores higher than 74% of PyPI servers
Category Cloud Infrastructure
Recent critical change
GHSA-6q48-6c7w-9gw2 affects this package (21 Oct 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 0 of 35 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to murzirius/VPS-Guardian-MCP). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 22 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 9075 tokens (~58/item across 155 items; 152 tools + 3 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "execute_agent_job_recovery" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 154 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 4 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 28 Oct 26 +7
- Stability: fail → pass ▲ security
- 25 Oct 26 −15
- Malware scan: pass → unverified ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/vps-guardian-mcp@0.37.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | murzirius/VPS-Guardian-MCP |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/murzirius/VPS-Guardian-MCP/.github/workflows/publish.yml@refs/tags/v0.37.0 |
| Rekor log index | 3245169792 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:3d4f9e0d4f961eac43f7c86b8d907e1deee1cfff9a545f61363f855e2edcc400 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 35 packages
| Packages resolved | 35 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
generate_incident_report ~99
Generate one prioritized, read-only VPS incident report. Args: include_updates: Include operating-system patch and reboot status. include_security: Include SSH hardening assessment. include_network: Include listening ports; disabled by default to keep reports compact. Returns: JSON string with severity-ranked findings and the underlying diagnostic sections.
| Name | Type | Req | Description |
|---|---|---|---|
| include_network | boolean | – | – |
| include_security | boolean | – | – |
| include_updates | boolean | – | – |
No output schema declared.
No examples provided.
get_agent_job ~41
Get job progress and compact results; use after_revision to receive only new steps.
| Name | Type | Req | Description |
|---|---|---|---|
| after_revision | integer | – | – |
| job_id | string | yes | – |
No output schema declared.
No examples provided.
get_agent_session ~33
Read a session's objective, findings, handoff note, and expiry state.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | – |
No output schema declared.
No examples provided.
get_audit_events ~48
Return recent redacted audit events for state-changing operations. Args: limit: Number of newest events to return (1-500, default 50).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
No output schema declared.
No examples provided.
get_backup_status ~30
List isolated Guardian backups with sizes and creation times, without reading contents.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
No output schema declared.
No examples provided.
get_change_impact ~54
Show what a prospective restart, stop, config deployment, or update may affect. This tool never executes the action and does not issue a confirmation token.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| target | string | yes | – |
No output schema declared.
No examples provided.
get_database_health ~61
Discover running databases and verify responsiveness, latency, and socket states. Detects Redis, PostgreSQL, MySQL/MariaDB, and SQLite databases in application directories. Returns: JSON string with operational state, socket accessibility, and ping latency for each engine.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_docker_container_logs ~87
Safely read stdout/stderr logs from a specific Docker container. Args: container_name: Container name or container short/full ID. lines_count: Number of recent log lines to retrieve (default: 50, max: 1000). Returns: JSON string containing the container logs.
| Name | Type | Req | Description |
|---|---|---|---|
| container_name | string | yes | – |
| lines_count | integer | – | – |
No output schema declared.
No examples provided.
get_docker_stats ~57
Retrieve live resource utilization metrics for all running Docker containers. Provides real-time CPU %, Memory %, Network I/O, and Block I/O (equivalent to `docker stats`). Returns: JSON string listing resource metrics per running container.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_event_watch ~41
Retrieve events seen since an active event watch was opened; this does not push notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| watch_id | string | yes | – |
No output schema declared.
No examples provided.
get_fail2ban_status ~42
Check Fail2ban status, active protection jails, and currently banned IP addresses. Returns: JSON string detailing active jails and banned IP addresses.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_failed_systemd_units ~45
Find all degraded or failed systemd services across the entire system. Returns: JSON string with list of failed units ('systemctl --failed') and overall health indicator.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_firewall_status ~27
Return normalized UFW, firewalld, or nftables firewall state and rules.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_guardian_launch ~32
Report whether this Guardian runs through SSH/stdio, systemd, or a container and how to reload it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_mission_brief ~47
Recover a mission goal, linked IDs and next state; an unchanged revision returns a tiny status reply.
| Name | Type | Req | Description |
|---|---|---|---|
| after_revision | integer | – | – |
| mission_id | string | yes | – |
No output schema declared.
No examples provided.
get_open_ports ~55
Discover all listening network ports (TCP and UDP) and identify bound processes. Returns: JSON string listing open ports, protocols (TCP/UDP), binding addresses (IPv4/IPv6), and process names/PIDs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_operation ~34
Read shared operation metadata, bounded timeline and outcome after reconnect; never executes or approves anything.
| Name | Type | Req | Description |
|---|---|---|---|
| operation_id | string | yes | – |
No output schema declared.
No examples provided.
get_package_updates ~33
List available updates via APT, DNF, YUM, Pacman, or Zypper without changing state.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_platform_capabilities ~27
Detect package, firewall, service-manager, and Docker Compose backends on this host.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_process_details ~73
In-depth diagnostics for a specific PID: hierarchy, threads, memory, open files, sockets, I/O. Args: pid: The target process ID to inspect (positive integer). Returns: JSON string detailing process tree, memory breakdown, sockets, files, and sanitized env.
| Name | Type | Req | Description |
|---|---|---|---|
| pid | integer | yes | – |
No output schema declared.
No examples provided.
get_project_changes ~30
Read Git working-tree changes and diff statistics without modifying the project.
| Name | Type | Req | Description |
|---|---|---|---|
| project_path | string | yes | – |
No output schema declared.
No examples provided.
get_project_diff ~62
Read a bounded, secret-redacted Git diff for a project or one file.
| Name | Type | Req | Description |
|---|---|---|---|
| context_lines | integer | – | – |
| max_bytes | integer | – | – |
| project_path | string | yes | – |
| relative_path | – | – | – |
| staged | boolean | – | – |
No output schema declared.
No examples provided.
get_project_import_map ~54
Map bounded local Python import candidates; unresolved modules and partial scans are explicit.
| Name | Type | Req | Description |
|---|---|---|---|
| after_fingerprint | – | – | – |
| max_results | integer | – | – |
| project_path | string | yes | – |
| relative_path | – | – | – |
No output schema declared.
No examples provided.
get_project_symbols ~46
Map Python classes and functions to line ranges without returning their bodies.
| Name | Type | Req | Description |
|---|---|---|---|
| max_symbols | integer | – | – |
| project_path | string | yes | – |
| relative_path | string | yes | – |
No output schema declared.
No examples provided.
get_project_task_context ~68
Bundle a Python definition, use-site fragments and test candidates; mask literals/comments and cap output.
| Name | Type | Req | Description |
|---|---|---|---|
| after_fingerprint | – | – | – |
| max_chars | integer | – | – |
| project_path | string | yes | – |
| relative_path | string | yes | – |
| symbol_name | string | yes | – |
No output schema declared.
No examples provided.
get_recent_server_events ~42
Return a compact timeline of Guardian actions and important journal events.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| since_minutes | integer | – | – |
| target | – | – | – |
No output schema declared.
No examples provided.
get_resource_alerts ~28
Evaluate active resource watches once and return current threshold alerts.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
No output schema declared.
No examples provided.
get_runtime_budget ~25
Show the active low-resource profile and limits VPS-Guardian applies on this host.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_safety_status ~25
Return the active safety mode, confirmation policy, TTL, and audit destination.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_server_event_delta ~54
Return only server events after the supplied cursor, with a bounded response and next cursor.
| Name | Type | Req | Description |
|---|---|---|---|
| after_cursor | – | – | – |
| max_events | integer | – | – |
| since_minutes | integer | – | – |
| target | – | – | – |
No output schema declared.
No examples provided.
get_system_health ~117
Retrieve a complete system health snapshot of the Linux VPS. Returns a JSON string containing: - CPU: overall percentage, per-core breakdown, core counts, 1/5/15m load averages. - RAM & Swap: total, used, available, percentage. - Disk: root partition usage, read/write I/O counters. - Network: sent/received bytes, packets, and error counts. - Uptime: boot timestamp and human-readable duration (e.g. '12d 4h 32m 10s').
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_test_capsule_status ~22
Inspect local Docker and resource prerequisites for isolated project checks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_top_processes ~103
Retrieve the top resource-consuming processes running on the VPS. Args: sort_by: Metric to rank processes by ('cpu' or 'memory'). Default: 'cpu'. limit: Number of top processes to return (1 to 50, default: 10). Returns: JSON string listing process PID, name, user, CPU %, RAM %, RSS memory, and command summary.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| sort_by | string | – | – |
No output schema declared.
No examples provided.
get_ufw_status ~48
Inspect the status and active filtering rules of the UFW firewall. Returns: JSON string containing UFW active state, default incoming/outgoing policies, and all active firewall rules.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_vps_topology ~58
Map websites, reverse proxies, Compose projects, containers, ports, and databases. The map is read-only and excludes configuration content, environment values, and credentials. Use it before diagnosing an application whose location on the VPS is unknown.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_web_deployment_status ~81
Verify one website end to end: public HTTPS response, local Nginx host, and certificate. Returns a single diagnosis identifying whether an issue is public availability, virtual-host configuration, or the matching TLS certificate.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| expected_status | integer | – | – |
| expected_text | – | – | – |
| path | string | – | – |
No output schema declared.
No examples provided.
get_workload_brief ~61
One compact, selectable workload report; request full detail only when needed.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | – |
| if_fingerprint | – | – | – |
| max_chars | integer | – | – |
| sections | string | – | – |
| target | string | yes | – |
No output schema declared.
No examples provided.
get_workload_health ~33
Return concise health, resource, container, and matching SSL state for one workload.
| Name | Type | Req | Description |
|---|---|---|---|
| target | string | yes | – |
No output schema declared.
No examples provided.
handoff_agent_session ~48
Leave a concise handoff note so another agent can continue without rediscovery.
| Name | Type | Req | Description |
|---|---|---|---|
| next_agent | string | yes | – |
| session_id | string | yes | – |
| summary | string | yes | – |
No output schema declared.
No examples provided.
heartbeat_agent_task ~46
Extend a task lease while its owning agent session is still working.
| Name | Type | Req | Description |
|---|---|---|---|
| lease_minutes | integer | – | – |
| session_id | string | yes | – |
| task_id | string | yes | – |
No output schema declared.
No examples provided.
inspect_compose_project ~34
Return Docker Compose service topology, images, ports, dependencies, and healthchecks.
| Name | Type | Req | Description |
|---|---|---|---|
| compose_file | string | yes | – |
No output schema declared.
No examples provided.
inspect_docker_container ~67
Deep inspection of container networks, volume mounts, restart policy, healthcheck, and masked env vars. Args: container_name: Name or short/full ID of the target container. Returns: JSON string detailing full container architecture and runtime state.
| Name | Type | Req | Description |
|---|---|---|---|
| container_name | string | yes | – |
No output schema declared.
No examples provided.
inspect_project ~33
Inspect an approved project: stack markers, Git branch/commit, and dirty state.
| Name | Type | Req | Description |
|---|---|---|---|
| project_path | string | yes | – |
No output schema declared.
No examples provided.
inspect_project_environment ~47
Inspect Python venv/package metadata and a running systemd MainPID without executing project code.
| Name | Type | Req | Description |
|---|---|---|---|
| environment_path | – | – | – |
| project_path | string | yes | – |
| service_name | – | – | – |
No output schema declared.
No examples provided.
list_agent_checkpoints ~28
List active pre-change checkpoints and optional completed history.
| Name | Type | Req | Description |
|---|---|---|---|
| include_closed | boolean | – | – |
No output schema declared.
No examples provided.
list_agent_jobs ~33
List persistent job summaries without returning step outputs.
| Name | Type | Req | Description |
|---|---|---|---|
| include_finished | boolean | – | – |
| limit | integer | – | – |
No output schema declared.
No examples provided.
list_agent_sessions ~29
List active shared agent sessions; expired sessions are marked automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| include_closed | boolean | – | – |
No output schema declared.
No examples provided.
list_agent_tasks ~39
List prioritized tasks and release expired leases on demand.
| Name | Type | Req | Description |
|---|---|---|---|
| include_finished | boolean | – | – |
| limit | integer | – | – |
| status | – | – | – |
No output schema declared.
No examples provided.
list_assigned_missions ~27
List this Mission worker's private operator assignments; no automatic model or production execution.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_compose_projects ~37
Discover conventional Docker Compose files in an authorized directory tree.
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | integer | – | – |
| root_path | string | – | – |
No output schema declared.
No examples provided.
How do I install the VPS Guardian MCP server?
VPS Guardian runs locally as a PyPI package, launched with uvx vps-guardian-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · vps-guardian-mcp
claude mcp add murzirius-vps-guardian-mcp -- uvx vps-guardian-mcp
What is the VPS Guardian MCP server?
VPS Guardian is an MCP server listed in the public MCP registry as io.github.murzirius/vps-guardian-mcp. Secure SSH bridge for AI agents to observe and safely administer Linux VPSs. This page covers its PyPI package (vps-guardian-mcp).
Is the VPS Guardian MCP server safe to use?
VPS Guardian scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the VPS Guardian MCP server expose?
VPS Guardian exposes 152 tools: get_system_health, get_top_processes, check_service_status, get_failed_systemd_units, read_service_logs, and 147 more. Their descriptions and schemas cost roughly 8,918 tokens of context every time the server is loaded.
Is the VPS Guardian MCP server still maintained?
VPS Guardian is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the VPS Guardian MCP server under?
VPS Guardian declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.