SysKnife

SysKnife

The Linux sysadmin MCP server. Plan. Approve. Audit.

Distros

MCP server · Install · How it works · Why not X ? · Distro matrix · Roadmap · Contribute · Discuss

A deterministic reproduction of the Claude Code MCP flow on Ubuntu 24.04, rendered offline by ubuntu-flow-mock.sh so it replays identically from a fresh checkout. Every action name, risk level and command shown is the one the catalogue carries. The same flow works in Cursor and Codex CLI.

On an atomic host the plan uses rpm-ostree instead: the Fedora Atomic recording . Looking for the standalone CLI? See the CLI guide .

Describe what you want in plain language. Review a typed plan with risk

levels. Approve explicitly. Watch it execute with live output. Atomic-host

changes (rpm-ostree) roll back automatically on failure. Every action is

Ed25519-signed and audited.

The AI never supplies a command. Every action is a typed operation with a formal risk level, and the daemon builds the command line itself from the action's own definition — some actions do run through sh -c, but the shell fragment is constructed by SysKnife, never by the model. The AI cannot touch your system directly. A privileged daemon executes only what you approve, writes a tamper-evident Ed25519-signed audit chain, and rolls back atomic-host (rpm-ostree) changes automatically on failure.

Why typed actions and not a guarded shell? Red-team research (GuardFall) found that 10 of 11 AI agents bypass raw-string shell guards — an allowlist or regex is filtering a language rich enough to hide intent. SysKnife removes the shell string entirely: the model emits typed actions, and a public-key-verifiable audit chain records every one.

---

MCP server

SysKnife is an MCP server first. Point Claude Code, Cursor or Codex CLI at it and your assistant gets typed, risk-classified sysadmin tools in place of a shell:

npx sysknife-setup

One command wires the server into your client and installs the daemon. Install has the detail, and MCP protocol has the wire behaviour.

Your assistant cannot approve its own work. sysknife_plan hands back a transaction ID and stops there. The receipt sysknife_execute demands comes from sysknife approve , typed in your terminal, on a channel the model does not sit on. Missing, expired, mismatched and replayed receipts are all refused.

Prefer to stay in the shell? The CLI is the same engine with no client in front of it.

---

Install

The fastest path is the setup wizard. It installs the daemon and wires SysKnife into your AI IDE — Claude Code, Cursor, or Codex CLI — so you can plan and execute from chat.

npx sysknife-setup

Needs Node 22 or newer; older Node releases no longer receive security fixes. On Ubuntu 22.04 apt install nodejs gives Node 12, which is too old; the installer says so and how to get a current Node. No Rust toolchain and no compile: it downloads verified prebuilt binaries.

What this does:

1. Downloads the prebuilt `sysknife` + `sysknife-daemon` binaries for your architecture (x86_64 / aarch64) from GitHub Releases, SHA-256-verifies each against the release checksum file — a mismatch aborts the install — and places them in ~/.local/bin (no sudo). Pass --no-binary to skip the download and build from source instead.
2. Asks for your LLM provider, key, and model — OpenAI / Anthropic / Gemini / Ollama / Groq / DeepSeek / Mistral / xAI (Ollama needs no key). The key prompt is skipped when the matching env var is already set.
3. Asks which AI integration to wire up (or pick --claude / --cursor / --codex / --all) and your daemon target(s) — socket, plus an optional vsock token for a remote VM.
4. Writes the integration-specific MCP config (merging into any existing file, never clobbering) so the next chat session sees the sysknife_* tools — sysknife_plan, sysknife_execute, sysknife_history, sysknife_doctor, sysknife_audit_verify, and distro-compatible direct read-only queries such as sysknife_get_disk_usage — as first-class tools.
5. Installs and starts the daemon as a service (last step) — a systemd *user* service by default (no sudo; kept alive across logout via linger). That service runs as you, so read-only actions work but mutating ones do not: installing packages or restarting services needs the system-level service, whose sudoers grants belong to the sysknife system user. Pick the system service on any host where you intend to change something, and pass --daemon-mode=system|user|skip to choose without a prompt. --daemon-mode=system does not install the system service from the wizard — it needs root-owned sudoers, polkit and helper policy that sudo make install owns — so it prints the exact sequence and reports the daemon as not yet installed.

To verify the download against a checksum list you trust independently of the release, set SYSKNIFE_PINNED_SHA256SUMS=/path/to/sums; see SECURITY.md.

To check where a release binary was built, download it from the release page and run gh attestation verify sysknife-vX.Y.Z-linux-x86_64 --repo lacs-project/sysknife. It succeeds only if the file matches a provenance statement GitHub signed for a build of this repository by release.yml. Each release also ships that provenance as sysknife-vX.Y.Z-linux- .intoto.jsonl, so the same check works with --bundle; see Verify the published release.

Then in your chat: ask for what you want and review the plan with risk pills. Approve each transaction with sysknife approve in a terminal, return the one-time receipts, and watch it execute. The daemon, not the prompt, enforces the receipt boundary.

Prefer the standalone CLI? Same engine, no IDE — see the

CLI guide for sysknife "...", --dry-run, --json,

approval prompts, and audit-log inspection.

Manual install — Ubuntu 20.04+

Needs Rust stable and a C compiler (build-essential): the TLS and SQLite dependencies build native code, so a rustup-only machine stops at error: linker cc not found. cmake is not required. Budget 7 to 12 minutes for the ~400-crate build (6m56s on Ubuntu 24.04, 11m43s on 22.04).

sudo apt-get install -y build-essential

git clone https://github.com/lacs-project/sysknife cd sysknife make build # builds sysknife (CLI) + sysknife-daemon sudo make install # installs both; daemon runs as a system service sudo systemctl enable --now sysknife-daemon

Join the socket group and one role group, or every request is refused with

"Permission denied" before any role check runs: /run/sysknife is 0750

sysknife:sysknife, and a sudo admin is not in that group automatically.

Role groups: sysknife-observer (read-only), sysknife-dev (medium risk),

sysknife-ad