# SysKnife

Runs Linux administration tasks through typed actions with terminal approval receipts. Helps when an assistant needs system access without exposing a raw shell.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 17
- Author: lacs-project
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/lacs-project/sysknife
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/sysknife

## What it does

SysKnife replaces direct shell access with strict, typed system procedures. The assistant proposes changes by calling `sysknife_plan` to inspect risk scores and generate transaction identifiers. The daemon constructs the underlying system calls itself. This architecture prevents prompt injections from hiding malicious flags inside shell text.

Privileged actions cannot run automatically. The model pauses execution once it produces a transaction identifier. To proceed, the user enters `sysknife approve <transaction-id>` directly in a separate terminal window. This creates a one-time cryptographic receipt for `sysknife_execute`. An Ed25519-signed journal logs every operation to prevent tampering.

The setup wizard requires Node 22 or newer. Default packages on distributions like Ubuntu 22.04 supply older runtimes and cause the setup process to stop immediately. On hosts using `rpm-ostree`, failed changes revert to their earlier state automatically.

## Requirements
- Environment variables: `SYSKNIFE_SOCKET` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- replace raw shell string execution with structured typed actions
- enforce out-of-band user approval for dangerous system operations
- track administrative tasks in an Ed25519-signed verification log
- roll back failed package updates automatically on atomic hosts

## Example prompts
- Plan opening port 80 with UfwAllow and show the risk level
- Check disk space usage using sysknife tools
- Inspect recent sysadmin runs and verify the cryptographic audit chain

## Similar
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md