blaktron/server-maintenance-audit
autonomousv0.1.0
Audits a Linux server you name: checks its logs, looks up package CVEs, applies the updates you ask for, and schedules a reboot you want.
Declared capabilities
network: 1 hostdata: files, othertarget hosts: server
Capabilities are the author's declaration and the basis for policy and scanning. The registry cannot enforce them at run time. Your runtime should.
MCP servers & tools
agentry run serves exactly the tools this contract declares, through a per-run MCP gateway. An undeclared capability is a tool that does not exist at run time.
Tools the runner grants
| Manifest declaration | Tool(s) granted |
|---|---|
| (always) | write_report — reports → the run's output folder |
| (always) | list_inputs, read_input, search_inputs — operator-provided input files, read-only |
| (always) | scratch_list, scratch_read, scratch_write, scratch_search — the run's own scratch folder at /scratch, private to the run and deleted at its end; the runner's grant, not a line of the contract |
| (always) | export_pdf — a Markdown report as a PDF in reports/, laid out in your report design; the runner's grant, not a line of the contract |
| (always) | grep, glob — search file contents by regular expression and list files by path pattern (ripgrep), one area a call: the inputs, attached knowledge, /scratch; the runner's grant, not a line of the contract |
| network.egress | fetch — pinned to api.osv.dev |
| targetHosts | host_run, host_read, host_write, host_put, host_get, host_shell_open, host_shell_send, host_shell_read, host_shell_close — on the server server names at run time, as the account you sign in with, through the host link; runs on your own computer only |
MCP servers involved
- QuickAgent Tools — the runner's companion server, served through a per-run Docker MCP Gateway; its tool surface is exactly the table above.
- Operator-cataloged MCP servers may be attached for the declared dataAccess categories (files, other); undeclared categories are never wired in.
In an embedded install
Installed into an existing coding agent (agentry install), the same contract maps to the host's built-in tools — enforcement there is the host's. Allowed tools: WebFetch(domain:api.osv.dev).
Install
agentry install blaktron/server-maintenance-audit@0.1.0git clone https://secureagentry.net/blaktron/server-maintenance-audit.gitgit clone ssh://git@git.secureagentry.net/blaktron/server-maintenance-audit.gitclaude-skill is this agent's default target, so the flag is not needed.
agent.yaml
1.5 kBBack to files
schemaVersion: "2"
name: server-maintenance-audit
namespace: blaktron
modes: [autonomous]
version: 0.1.0
summary: 'Audits a Linux server you name: checks its logs, looks up package CVEs, applies the updates you ask for, and schedules a reboot you want.'
license: MIT
tags: [linux, server, maintenance, vulnerabilities]
entrypoints:
instruction: AGENT.md
intake:
- id: server
prompt: The server to maintain (user@host, or user@host:port)
type: host
required: true
inputs:
kinds: [documents, data]
view: text
guide:
overview: Signs in to the Linux server you name and establishes what it is supposed to do from your runbook, service docs or knowledge pack, checking the system and application logs and the packages and applications it runs for known vulnerabilities. It applies only the updates the task asks for, schedules a reboot only when the task asks for one, and returns a PDF report of findings, changes and recommendations.
files: 'Optional: runbooks, service documentation, package inventories or log files, as PDF, Word, Markdown, text or CSV.'
task: e.g. Check-only, then update the system and schedule a reboot tonight at 02:00.
capabilities:
network:
egress: [api.osv.dev]
filesystem:
read: none
write: none
exec: none
dataAccess: [files, other]
targetHosts: [server]
knowledge:
accepts:
prompt: Runbooks, service documentation, package inventories or log files that describe what this server is supposed to do.
publish:
include: [agent.yaml, AGENT.md, README.md, LICENSE]