server_audit
Read-onlyIdempotent
Run a security audit on any server with 457 checks across 30 categories. Returns a score (0-100), per-category scores, and quick wins for hardening.
Instructions
Run a security audit on a server. Scans 30 categories with 457 checks. Returns score (0-100), per-category scores, and quick wins. Formats: 'summary' (compact text), 'json' (full AuditResult), 'score' (number only). Supports compliance filtering (cis-level1, cis-level2, pci-dss, hipaa), category/severity filtering, snapshot save/compare, threshold gate, and profile filtering. Requires SSH access. For health trends use server_doctor instead.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| server | No | Server name or IP. Auto-selected if only one server exists. | |
| format | No | Output format: summary (default), json (full result), score (number only) | summary |
| framework | No | Compliance framework filter. Returns per-control pass/fail summary alongside audit results. | |
| explain | No | When true, include why + fix explanation for each failing check in summary format output. Capped at 10 checks. | |
| category | No | Filter results to a specific category (e.g. 'SSH', 'Firewall', 'Docker'). | |
| severity | No | Filter checks by severity level. | |
| snapshot | No | Save audit snapshot. true for auto-name, string for custom name. | |
| compare | No | Compare two snapshots: format before:after (e.g. pre-upgrade:latest) | |
| threshold | No | Minimum passing score (1-100). Returns error if score is below threshold. | |
| profile | No | Server profile filter (web-server, database, mail-server). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- src/mcp/resources/servers.ts:23-67 (helper)Resource helper function readServerAudit - provides read-only access to the latest cached audit score for a server via MCP resource kastell://servers/{name}/audit. Registered in server.ts as a resource, distinct from the tool that runs audits.
export function readServerAudit(serverName: string): ReadResourceResult { const server = findServer(serverName); if (!server) { return { contents: [{ uri: `kastell://servers/${serverName}/audit`, mimeType: "application/json", text: JSON.stringify({ error: `Server not found: ${serverName}` }), }], }; } const history = loadAuditHistory(server.ip); if (history.length === 0) { return { contents: [{ uri: `kastell://servers/${serverName}/audit`, mimeType: "application/json", text: JSON.stringify({ serverName, latestScore: null, message: "No audit run yet. Use server_audit to run a security scan.", }), }], }; } const latest = history[history.length - 1]; return { contents: [{ uri: `kastell://servers/${serverName}/audit`, mimeType: "application/json", text: JSON.stringify({ serverName, latestScore: latest.overallScore, latestTimestamp: latest.timestamp, categoryScores: latest.categoryScores, historyCount: history.length, }), }], }; }