Kastell
Runs 413+ security checks across your Linux servers and exposes them through MCP tools so Claude can audit SSH configs, review firewall rules, and scan for CIS compliance gaps. Beyond read-only audits, it provisions servers on Hetzner, DigitalOcean, AWS, and Linode, applies SSH hardening and fail2ban setup, manages UFW firewall rules, and handles full maintenance cycles with pre-update snapshots. The MCP layer surfaces 14 tools covering deployment, security lockdown, backup/restore, and health monitoring. If you're managing a fleet and want an AI agent that can both diagnose weak SSL ciphers and actually fix them, this bridges the gap between audit output and remediation commands.
- GitHub stars
- 52
- tools
- 14
- auth
- Secret needed
- transport
- STDIO
- env vars
- 4
- last updated
- Mar 24, 2026
Tools
14 toolsPublic tool metadata for what this MCP can expose to an agent.
server_infoQuery server information, check cloud provider and platform status
Query server information, check cloud provider and platform status
No parameter schema in public metadata yet.
server_logsFetch platform/Docker logs and system metrics via SSH
Fetch platform/Docker logs and system metrics via SSH
No parameter schema in public metadata yet.
server_manageRegister, unregister, or destroy cloud servers
Register, unregister, or destroy cloud servers
No parameter schema in public metadata yet.
server_maintainUpdate platform, restart servers, run full maintenance
Update platform, restart servers, run full maintenance
No parameter schema in public metadata yet.
server_secureSSH hardening, firewall rules, domain/SSL management (10 subcommands)
SSH hardening, firewall rules, domain/SSL management (10 subcommands)
No parameter schema in public metadata yet.
server_backupBackup/restore databases and create/manage VPS snapshots
Backup/restore databases and create/manage VPS snapshots
No parameter schema in public metadata yet.
server_provisionProvision new servers on cloud providers
Provision new servers on cloud providers
No parameter schema in public metadata yet.
server_audit449-check security audit with compliance framework filtering; use `--explain` for remediation guidance
449-check security audit with compliance framework filtering; use `--explain` for remediation guidance
No parameter schema in public metadata yet.
server_evidenceCollect forensic evidence package with checksums
Collect forensic evidence package with checksums
No parameter schema in public metadata yet.
server_guardManage autonomous security monitoring daemon
Manage autonomous security monitoring daemon
No parameter schema in public metadata yet.
server_doctorProactive health analysis with remediation commands
Proactive health analysis with remediation commands
No parameter schema in public metadata yet.
server_lock24-step production hardening (SSH, UFW, sysctl, auditd, AIDE, Docker)
24-step production hardening (SSH, UFW, sysctl, auditd, AIDE, Docker)
No parameter schema in public metadata yet.
server_fleetFleet-wide health and security posture dashboard
Fleet-wide health and security posture dashboard
No parameter schema in public metadata yet.
server_fixApply safe auto-fixes with backup (SAFE tier only, dryRun default)
Apply safe auto-fixes with backup (SAFE tier only, dryRun default)
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
HETZNER_TOKENsecretHetzner Cloud API token (optional — only for Hetzner servers)
DIGITALOCEAN_TOKENsecretDigitalOcean API token (optional — only for DigitalOcean servers)
VULTR_TOKENsecretVultr API token (optional — only for Vultr servers)
LINODE_TOKENsecretLinode API token (optional — only for Linode servers)
Readme
Details
- Repository
- github.com/kastelldev/kastell
- Category
- Security & Pentesting
- Package
kastell- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
ContrastAPIupinar/contrastapi55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.36stars
Grasp — Code Architecture & Dependency Analysisashfordeou/graspCodebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab.31stars
Mcp Cinema4dkumoproductions/mcp-cinema4dMCP server for Cinema 4D — entity CRUD, parameter-level access, batched undo, security controls.29stars
Repository Intelligencenirholas/lyra-intelAnalyze repos of any size - security scanning code analysis monorepo support0stars
Interactive Leetcode Mcpsperekrestova/interactive-leetcode-mcpInteractive LeetCode MCP server with authorization and solution submission capabilities12stars
Bawbel Scannerbawbel/scannerSecurity scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.7stars