Kastell

What kastelldev/kastell MCP server does

kastelldev/kastell MCP server connects an MCP-compatible AI agent to Kastell's infrastructure security and server-management functions. The underlying Kastell CLI can provision servers, register existing hosts, inspect status, connect over SSH, configure firewalls, harden SSH, run audits, manage snapshots, perform backups, and maintain multiple servers.

Security auditing covers areas such as SSH, firewalls, Docker, TLS, and HTTP headers. Audit output can be rendered as JSON, HTML, a badge, a score, or a compact summary. Commands can also apply fixes interactively, preview changes with dry-run mode, watch for changes at an interval, and filter results by CIS, PCI-DSS, or HIPAA mappings.

How it works

Kastell runs as an npm-distributed command-line application and includes an MCP server for agent access. The README's quick start uses npx kastell to launch an interactive menu; known CLI commands can instead be entered directly. Server operations target Linux hosts over SSH, while cloud provisioning supports Hetzner, DigitalOcean, Vultr, and Linode according to the supplied listing.

The tool maintains server records locally and provides operations for individual servers or groups using options such as --all. Maintenance can combine a pre-update snapshot, platform update, health check, and reboot. Audits can target a registered server or an unregistered host supplied with --host.

Setup and configuration

The documented quick-start command is:

npx kastell

The interactive interface guides users through actions and configuration options. Direct commands include kastell init for deployment, kastell add for an existing server, and kastell config for configuration management. YAML configuration is supported for initialization through kastell init --config kastell.yml, and the README also documents validation of the servers.yaml structure and types.

Kastell can configure server access, firewall settings, SSH hardening, fail2ban, domains, and SSL as part of its management workflows. The supplied material does not specify required environment variables, an API key, or a separate MCP startup command.

Tools and capabilities

The kastelldev/kastell MCP server is intended for agent-driven infrastructure work, including:

• Checking server status and health
• Deploying, adding, removing, importing, and exporting server records
• Running security audits and explaining failed checks
• Applying or previewing audit remediations
• Configuring UFW, SSH hardening, and fail2ban
• Creating, listing, and deleting VPS snapshots
• Backing up and restoring databases and configuration
• Updating platforms and running maintenance across all servers
• Collecting forensic evidence and managing security-related workflows

The README comparison table describes 17 MCP tools, while the supplied listing description states 13. Treat the exact tool count as version-dependent until confirmed from the installed release.

Limitations and notes

The documented platform support is Linux over SSH; the supplied material does not establish support for Windows or macOS targets. Cloud-provider support is limited to the four providers named in the listing. Destructive operations exist, including server destruction, snapshot deletion, and remediation fixes, so agents should use dry-run or preview options where available.

The README contains differing security-check totals: the listing cites 413 checks across 29 categories, while CLI examples describe 449 checks across 31 categories. The same material also gives different MCP-tool counts. Verify the installed version before relying on precise totals or tool names.