VPS Guardian

VPS Guardian MCP

VPS Guardian is a secure Model Context Protocol server for AI agents that work with Linux VPSs. It replaces an unrestricted “run this command and paste the result” loop with named, structured and safety-checked operations.

An agent can inspect a workload, collect bounded diagnostics, preview the impact of a change, and request an exact confirmation for a mutation. The server never exposes a general-purpose shell tool.

Explore the project: capabilities · agent workflows · security model · tool catalogue · release notes

Quick start

VPS Guardian has two parts:

• The Python MCP server runs on the VPS.
• The small npm launcher runs on the computer where Codex, Claude, Cursor or another AI client is installed. It opens an SSH stdio connection and never uploads the private key.

What you need

• A Linux VPS reachable via SSH.
• An SSH key for that VPS.
• Python 3.10+ on the VPS and Node.js 16+ on the AI client's computer.
• A verified SSH host key. Password-based SSH is intentionally unsupported by the launcher.

Optional: local MCP access panel

The English-language panel runs on your computer, not on the VPS or this project's website. Its main screen manages agent permissions: pause/resume MCP calls, cap the safety mode, allow individual tools and set project roots. A collapsed server overview provides optional read-only monitoring. The npm package remains the MCP launcher; the panel comes with the Python package.

With uv installed on your computer:

uvx --from vps-guardian-mcp==0.37.0 vps-guardian-panel

Without uv, install in a local virtual environment. Windows PowerShell:

py -m venv .guardian-panel

.\.guardian-panel\Scripts\python.exe -m pip install vps-guardian-mcp==0.37.0 .\.guardian-panel\Scripts\python.exe -m src.local_panel

Linux/macOS:

python3 -m venv .guardian-panel

.guardian-panel/bin/pip install vps-guardian-mcp==0.37.0 .guardian-panel/bin/vps-guardian-panel

The browser opens automatically. Enter the VPS address, SSH user, port and path to your local key, not its contents. Leave the key field empty to use ssh-agent; load encrypted keys into the agent beforehand. Advanced settings accept the Guardian executable path on the VPS and an optional local known_hosts file. Access management requires Guardian 0.30.0+ on the VPS; Projects and Limits require 0.31.0+, Operations requires 0.32.0+, with the adjacent vps-guardian-access executable from the same installation. Older compatible installations can show monitoring only, with an upgrade warning. No server-side web service is installed.

To upgrade an existing pip installation on the VPS:

/opt/vps-guardian-mcp/.venv/bin/pip install --upgrade vps-guardian-mcp==0.37.0

Upgrade any other Guardian environments used by your agents, then reconnect all agents once so they start the policy-aware server. Subsequent permission changes affect new calls in those sessions without a restart. In-flight operations are not cancelled, and cached client tool lists may still show disabled tools; calls to those tools are rejected.

Use Apply permissions to save a shared per-SSH-user policy on the VPS at ~/.local/share/vps-guardian-access/policy.json. Connection settings stay in local RAM, but the access policy persists across panel/server restarts. Reload policy fetches the current server values; concurrent edits are rejected rather than overwriting another operator's changes. No policy means the existing launch settings remain in force. Invalid or unsafe stored policies fail closed and pause normal MCP access; get_safety_status remains available for recovery. Unsafe file ownership, permissions or symlinks require manual repair by the operator.

• Allow agent access: pause/resume normal MCP tool and resource entry points. The separate operator helper remains reachable over SSH so you can restore access.
• Maximum safety mode: the effective mode is the stricter of the agent's launch mode and this cap. Setting controlled cannot elevate a client launched as read-only. Confirmation tokens are the existing same-caller mechanism, not independent human approval.
• Allowed tools: allow all installed/future tools, or uncheck that option and choose an explicit allowlist. New tools are denied by default in an explicit allowlist. get_safety_status cannot be disabled. Read-only mode can still create bookkeeping records; use tool permissions when you also need to block those entry points.
• Project roots: inherit each process's VPS_GUARDIAN_PROJECT_ROOTS, or replace it with up to 16 absolute VPS directory paths, one per line. An empty custom list blocks project workspaces. Filesystem roots and symlink roots are rejected. This controls project tools, not the separate fixed configuration-file directory whitelist.

The operator helper is not registered as an ordinary agent tool. Tools and the three read resources enforce access restrictions on the server. Policies apply to upgraded Guardian processes under the same SSH user, not to individually authenticated agent identities. An agent with independent root SSH access, the same account's shell, or permission to change Guardian's code can bypass this MCP boundary. For stronger separation use a restricted dedicated OS account; do not treat the panel as a sandbox or independent approval service.

Agent Gateway (opt-in, Linux)

The Gateway section creates a distinct, password-locked Unix account and accepts only that agent's Ed25519 public key. The root-owned authorized_keys file forces vps-guardian-gateway serve and disables SSH forwarding and PTY access for that key. Guardian checks a root-owned policy under /etc/vps-guardian/gateway/ on every tool call, including expiration and revocation. The panel runs locally as before; Gateway adds no web listener or always-on daemon on the VPS.

Use Guardian 0.34.0+ on both devices, with a separate administrator SSH account capable of running the operator helper as root. The VPS package and its Python interpreter must be root-owned, protected against group/other writes and readable/executable by the new accounts. A venv under /root will not work: use a protected installation such as /opt/vps-guardian-mcp/.venv. Open Gateway, enter a short agent name, paste its .pub key, choose existing project directories, a duration (1–168 hours) and one of three presets:

• Observer: read-only diagnostics and project reading.
• Project editor: project search, staged patch/check/apply tools in controlled mode. The agent can modify only files the dedicated Unix account can modify. Controlled-mode tokens are generated in that same agent session; they are not independent human approval.
• Mission worker: read-only production access and private proposal workspaces. Only the separate root operator can review, approve and apply a snapshot. See Mission Control below.

After creation, configure that agent's MCP client with the returned vg_ SSH username and its own private key, using the normal npm launcher. The client-supplied remote command and --mode cannot override the SSH forced command or the root-owned cap. Keep your administrator key out of the agent's environment. Project roots and tool allowlists narrow the MCP surface, but Linux file permissions are the hard boundary: grant the dedicated account only the required file permissions, never sudo, broad privileged groups or access to the Docker socket. Check that the selected directories are actually readable/writable by the account; Gateway does not change project ownership or ACLs.

For example, an enrolled deploy-bot uses --user vg_deploy_bot --key alongside the normal --host option. Only the preset's 6, 14 or 13 tools are advertised at connection time; their permissions are rechecked live. At most 32 accounts can be enrolled, including expired/revoked records; there is no automatic deletion or reactivation. Gateway accounts have separate Access/Limits/history/state from the administrator account. The root user's Access pause/roots/limits do not automatically apply to them; use Gateway revocation for a Gateway agent. Private account-local audit files are not a tamper-proof central audit log.

SSH compatibility: the server must permit public-key login for locked accounts (normally UsePAM yes on Debian/Ubuntu) and use the account's .ssh/authorized_keys. Custom AllowUsers, DenyUsers, AuthorizedKeysCommand, trusted SSH CAs or ForceCommand settings can block or override this setup; an administrator must review them. Do not add alternative unrestricted keys/certificates for these accounts. Gateway does not rewrite or restart sshd.

Atomic project writes preserve the original file's owner/group. Directory write permission alone may not suffice for another owner's existing file: the kernel can reject ownership preservation. Use appropriately owned files/a separate worktree for an editor account; Guardian does not silently drop file ownership to force a write. Gateway is a restricted MCP entry point, not a container or a filesystem sandbox.

Revoke immediately blocks new normal MCP calls and removes that account's key for new SSH logins. It does not cancel an already-running operation or delete the Unix account and its private work/history; inspect those separately if needed. Expiration similarly denies later tool calls and future Gateway starts. get_safety_status remains available for recovery metadata. If an agent also possesses another independent SSH credential, Gateway cannot constrain that credential. There is no public HTTP endpoint or general shell tool. Independent approval is available only through the separate Mission worker workflow; it does not change Project editor tokens.

Mission Control: assigned tasks and independent evidence

Requires Guardian 0.36.0+ on the VPS and your computer, Linux, a newly enrolled Mission worker identity and a separate root operator connection. The English panel runs locally. Guardian does not start an LLM, dispatch prompts to an AI provider or execute arbitrary project commands. You must connect an external agent and ask it to inspect its assignments. Upgrading never silently expands an existing worker's tool allowlist.

1. Upgrade both Python installations, enroll a new Mission worker in Gateway, and scope it to a suitable root-protected project (requirements below). Give the AI client only that worker's separate SSH key. Never share the operator key, worker Unix group, sudo or Docker access.
2. Open Mission Control → New mission. Enter the existing worker name, project directory, goal and 1–8 acceptance criteria. Choose fixed Python/JSON/TOML syntax checks. With 0.37.0+ on both installations, optionally select required Python unittest, npm test or Node syntax capsules (setup below). Selecting a static check affects matching files only; unsupported formats are not cov