{
  "markdown": "# Server Ops MCP\n\n**English** | [简体中文](./README.zh-CN.md)\n\n[![npm version](https://img.shields.io/npm/v/server-ops-mcp.svg)](https://www.npmjs.com/package/server-ops-mcp)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)\n[![Node.js](https://img.shields.io/badge/node-%3E%3D18-brightgreen)](https://nodejs.org)\n[![MCP](https://img.shields.io/badge/MCP-Server-blue)](https://modelcontextprotocol.io)\n[![GitHub stars](https://img.shields.io/github/stars/GT-dinuo/server-ops-mcp?style=social)](https://github.com/GT-dinuo/server-ops-mcp)\n\nA general-purpose server-ops MCP Server. Let AI tools like Claude Code / Cursor / Codex manage multiple projects or servers through `.mcp.json` — **log troubleshooting, system resource inspection, code read/write, and Nginx / certificate management**.\n\nSupports **local** and **remote (SSH)** modes, with built-in two-step confirmation, command whitelisting, path-traversal protection, and automatic secret redaction.\n\n## Features\n\n- 🔍 **Log troubleshooting**: list / read / search project logs, multi-channel logs & system logs\n- 📊 **Resource monitoring**: CPU / memory / disk / load / processes / service status at a glance\n- 📁 **Code operations**: read, write, patch, delete, and search files — all sandboxed to the project root\n- 🌐 **Nginx & certificates**: config test & read, safe reload, certificate install & renewal\n- 🔒 **Secure by design**: two-step confirmation for writes, command whitelist, path-traversal protection, auto redaction\n\n## Installation\n\nRequires Node.js 18+. No clone or build needed — `npx` fetches and runs the published npm package on first use (see the config below).\n\nTo build from source instead (e.g. for development):\n\n```bash\ngit clone https://github.com/GT-dinuo/server-ops-mcp.git\ncd server-ops-mcp\nnpm install\nnpm run build\n```\n\nBuild output goes to `dist/`; the entry point is `dist/index.js`.\n\n## Configuration\n\nIn each project where you want to use this tool, create (or append to) `.mcp.json` and declare an MCP Server per environment. Local mode only needs `OPS_PROJECT_ROOT`; remote mode adds the SSH variables.\n\n```json\n{\n  \"mcpServers\": {\n    \"myproject-server\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"server-ops-mcp\"],\n      \"env\": {\n        \"OPS_PROJECT_ROOT\": \"/www/wwwroot/your-project\",\n        \"OPS_SSH_HOST\": \"<server-ip-or-domain>\",\n        \"OPS_SSH_PORT\": \"22\",\n        \"OPS_SSH_USER\": \"ubuntu\",\n        \"OPS_SSH_KEY\": \"~/.ssh/id_rsa\"\n      }\n    }\n  }\n}\n```\n\nIf you built from source, point the command at the local build instead: `\"command\": \"node\"`, `\"args\": [\"/absolute/path/to/server-ops-mcp/dist/index.js\"]`.\n\n### Environment Variables\n\n| Variable | Required | Description |\n|----------|----------|-------------|\n| `OPS_PROJECT_ROOT` | Yes | Project root path; all file operations are sandboxed here |\n| `OPS_SSH_HOST` | No | Remote server IP / domain; leave empty to run locally |\n| `OPS_SSH_PORT` | No | SSH port, default `22` |\n| `OPS_SSH_USER` | No | SSH username |\n| `OPS_SSH_KEY` | No | Path to SSH private key (choose either key or password) |\n| `OPS_SSH_PASSWORD` | No | SSH password (choose either key or password) |\n| `OPS_SSH_PASSPHRASE` | No | Private key passphrase |\n| `OPS_CONFIG_PATH` | No | Path to an extra config file — see \"Custom Configuration\" |\n\n## Usage\n\nOnce configured, just give ops instructions in natural language in your AI tool. The AI picks and calls the right tool automatically.\n\n### Read-only operations (run directly)\n\n```\nCheck the server's CPU, memory, and disk usage\nSearch for error-level logs from the last hour\nList the project's log files\nRead the Nginx config and check for problems\nFind every place in the code that calls sendSms\n```\n\n### Write operations (require confirmation)\n\nFor writes, deletes, command execution, Nginx reload, certificate install, and similar, the tool first returns a `confirmationId`. The AI shows you exactly what will run, and it **only executes after you confirm**:\n\n```\nYou: Reload nginx\nAI: (calls nginx_reload, returns the pending action + confirmationId)\n    About to run: nginx -s reload. Confirm?\nYou: Confirm\nAI: (calls confirm_execute to run it)\n```\n\n`file_write`, `file_patch`, `file_delete`, `command_exec`, and similar all follow the same confirmation flow.\n\n### Typical scenarios\n\n- **Production troubleshooting**: \"Why is the server memory full?\" → `memory_analysis` + `log_search` working together\n- **Routine inspection**: \"Is the disk almost full? Which directory uses the most?\" → `disk_analysis`\n- **Security audit**: \"Audit the project config for leaked secrets\" → `config_audit` (output is auto-redacted)\n\n## Tool List\n\n### System Ops\n\n| Tool | Description |\n|------|-------------|\n| `system_info` | CPU / memory / disk / load / processes |\n| `memory_analysis` | Memory usage analysis |\n| `disk_analysis` | Disk usage analysis |\n| `service_status` | Service status |\n| `log_search_system` | Search system logs |\n| `nginx_config_test` | Test Nginx config |\n| `nginx_config_read` | Read Nginx config |\n| `nginx_reload` | Reload Nginx (requires confirmation) |\n| `certbot_install` | Install certificate (requires confirmation) |\n| `certbot_renew` | Renew certificate (requires confirmation) |\n\n### Project Code\n\n| Tool | Description |\n|------|-------------|\n| `log_list` | List project logs |\n| `log_read` | Read a log |\n| `log_search` | Search logs |\n| `file_read` | Read a file |\n| `file_list` | List a directory |\n| `file_search` | Search code |\n| `file_write` | Write a file (requires confirmation) |\n| `file_patch` | Patch a file (requires confirmation) |\n| `file_delete` | Delete a file (requires confirmation) |\n| `command_exec` | Run whitelisted commands |\n| `project_overview` | Project overview |\n| `config_audit` | Audit config (auto-redacted) |\n| `confirm_execute` | Confirm and run a pending action |\n\n## Security\n\n1. **Read-only tools** run directly.\n2. **Writes, command execution, Nginx reload, certificate install** require two-step confirmation (`confirm_execute`).\n3. Command execution uses a whitelist — dangerous operations like `rm -rf`, `sudo`, and piping into a shell are rejected.\n4. File operations are sandboxed to `OPS_PROJECT_ROOT`; path traversal is blocked.\n5. Passwords, tokens, and other secrets in `.env` files and logs are automatically redacted.\n\n## Custom Configuration\n\nDownload `config.example.json` as `config.json`, then point `OPS_CONFIG_PATH` at it to customize log channels, the command whitelist, read limits, and more.\n\n```bash\ncurl -o config.json https://raw.githubusercontent.com/GT-dinuo/server-ops-mcp/main/config.example.json\n# (if you cloned the repo: cp config.example.json config.json)\n# After editing config.json, set in the .mcp.json env:\n# \"OPS_CONFIG_PATH\": \"/absolute/path/to/config.json\"\n```\n\nMain fields of `config.example.json`:\n\n- `logChannels`: channel name → log directory path (relative to project root)\n- `maxReadLines` / `maxReadBytes`: per-read line / byte limits\n- `commandWhitelist.direct`: commands that run directly\n- `commandWhitelist.confirm`: commands that require confirmation\n\n## Development\n\n```bash\nnpm run dev    # watch mode, recompiles on change\nnpm run build  # build to dist/\nnpm run clean  # remove dist/\nnpm start      # run the built Server\n```\n\n## Notes\n\n- Remote operations rely on SSH — use a **read-only account** or a tightly-scoped command whitelist for the AI.\n- Private key files should have permission `600` (`chmod 600 ~/.ssh/id_rsa`).\n- Never commit `.mcp.json` or `config.json` containing passwords to a repository.\n\n## License\n\n[MIT](./LICENSE) © 2026 server-ops-mcp\n",
  "bytes": 7602,
  "sha": "48207bd086ea7db2cb328b74b3339971e983d46c271f4c993d178046b3f58b03",
  "repo_slug": "gt-dinuo/server-ops-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_gt_dinuo_server_ops_mcp_d9bfffdb/readme"
}