server_fix
Destructive
Apply safe auto-fixes to a server after auditing. Preview fixes by default, apply only SAFE-tier fixes, and re-audit to measure score improvement.
Instructions
Apply safe auto-fixes to a server. Runs audit, filters SAFE tier fixes, creates backup, applies fixes, and re-audits for score delta. dryRun defaults to true (preview only). SAFE_MODE forces preview. SSH/Firewall/Docker fixes are FORBIDDEN and always rejected. Use checks and category params to target specific fixes.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| server | No | Server name or IP. Auto-selected if only one server exists. | |
| action | No | apply: run fixes (default), rollback: restore single fix, rollback-all: revert all applied fixes, rollback-to: revert down to specific fix-id, history: list fix operations | apply |
| dryRun | No | Preview fixes without applying. Defaults to true. Forced to true when KASTELL_SAFE_MODE=true. | |
| rollbackId | No | Fix ID to rollback (e.g. fix-2026-03-29-001) or 'last' | |
| checks | No | Specific check IDs to fix (e.g. ['KERN-SYNCOOKIES']). AND-filtered with category if both provided. | |
| category | No | Category name to filter fixes (e.g. 'Kernel'). AND-filtered with checks if both provided. | |
| top | No | Apply top N highest-impact SAFE fixes. Requires action:'apply'. Mutually exclusive with target. | |
| target | No | Apply SAFE fixes until score reaches this value (1-100). Requires action:'apply'. Mutually exclusive with top. | |
| profile | No | Server profile to filter applicable checks (built-in: web-server, database, mail-server; or custom profile name) | |
| diff | No | Include per-fix diff preview in results | |
| report | No | Generate markdown fix report file in current directory | |
| force | No | Bypass regression gate and force baseline update |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |