Lists a directory like ls -la: file type and permissions, link count, owner, group, size, modification time and symlink targets (symlinks are shown, never followed).

Precision reading of file contents with chunking/streaming support.

Create a new file or replace file contents.

Programmatically edit a file by appending text or replacing specific line ranges.

Search for files in a directory hierarchy.

Determines a file's MIME type - the answer file -b --mime-type gives, detected natively from the file's first bytes (no file(1) needed). A symlink is reported as inode/symlink, not followed. Use files/stat for size/permissions/ownership instead.

Changes a file's or directory's permission bits (chmod). Never follows symbolic links: a path containing a symlink in any component is refused, and recursive changes skip symlinks and report them. Numeric modes follow GNU chmod semantics (on directories a 4-digit mode keeps setuid/setgid; use 5 digits, e.g. 00755, to set them exactly).

Changes a file's or directory's owner and/or group (chown). Never follows symbolic links: a path containing a symlink in any component is refused, and recursive changes skip symlinks and report them. Changing the owner requires privileged: true.

Returns disk space statistics of the filesystem holding a path, like df - in bytes, or like df -h with human_readable. Use disks/list to see all block devices.

Calculates the disk space used by a directory, like du -s - in bytes, or like du -sh with human_readable. Use disks/free for overall partition stats.

A snapshot like top -b -n 1: header with uptime, logged-in users, load average, task counts by state, CPU breakdown (us/sy/ni/id/wa/hi/si/st) and memory/swap (bytes; MiB with human_readable), followed by the process table with all of top's columns (PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND). %CPU is measured over a short sampling interval, as top does. Use processes/list for a plain listing, processes/delete to signal a process.

Lists running processes on the system. Use this to find a PID, then use the process://{pid}/{target} resource for deep metrics or processes/delete to kill it.

Terminates a specific process by PID.

Query DNS records natively.

Transfer data from a URL using native HTTP client.

View the system ARP cache (IP to MAC address mappings).

Measure TCP reachability and latency to a host.

Lists TCP and UDP sockets in every state with their owning processes, like ss -tuanp - read natively from /proc/net (no ss needed). Owning processes of other users' sockets are shown only with privileged: true. state filters by LISTEN (includes unconnected UDP), ESTABLISHED, TIME_WAIT, ... or the groups connected/synchronized. Hint: For physical network links and IPs, use the network://interfaces resource.

Returns memory and swap utilization information. Use cpu/load-average to check compute load.

Control systemd services (start, stop, restart, enable, disable). To get detailed service properties and state, read the service://{name}/status resource. To view service logs, use the logs/journal-control tool.

Lists systemd services with optional filtering. Output includes ActiveState, LoadState, and SubState.

Queries the systemd journal (journalctl equivalent). Requires privileged: true in containerized deployments, since journalctl only exists on the host, never in this daemon's own image.

Read the kernel ring buffer for hardware/driver logs.

Lists login history (wraps last) or failed login attempts (type: "failed", wraps lastb). Returns raw text, not JSON - last/lastb's output isn't safe to hand-parse into structured data reliably.

Reads or writes kernel parameters (sysctl equivalent) at runtime, natively via /proc/sys. Writes require privileged: true, and may be restricted per user (read-only, or only certain keys) by mcp-sudo.yaml.

Retrieves CPU topology and architecture. See cpu/load-average for current utilization.

Retrieves system load averages (1m, 5m, 15m). See cpu/list for hardware topology.

Lists block devices as a tree (equivalent to lsblk): disks, their partitions, and LVM/dm-crypt/RAID volumes nested under the devices they're built on, with MAJ:MIN, RM, SIZE, RO, TYPE and MOUNTPOINTS. json/yaml output is the same tree under "blockdevices" (like lsblk -J), with nested "children". To check remaining free space or inode usage, use the disks/free tool. To check which folders are taking up the most space, use the disks/usage tool. (Use 'privileged: true' in containerized deployments to see the host's mount points.)

Lists mounted filesystems (device, mount point, type, options) - equivalent to mount/findmnt's basic view. Use disks/list for block devices instead.

Retrieves granular block device I/O performance metrics (equivalent to iostat). Provides read/write sectors, merged operations, and I/O wait times in milliseconds. Use disks/list first to find valid block devices. If you want static capacity instead, use disks/free.

Retrieves detailed SMART health data for a drive (equivalent to smartctl -j -a). Returns JSON containing self-assessment test results, temperature, wear leveling, and sector errors. Must be run as root (privileged: true). Use this to diagnose failing hardware.

Retrieves partition boundaries for a drive (start/size, in sectors and bytes), parsed natively from /sys/class/block - no fdisk dependency. Use this to understand the low-level geometry and partition boundaries of a disk.

Traces the network path to a host (equivalent to traceroute). Useful for debugging routing issues, identifying where packets are dropped, or measuring network latency across hops. Hint: Use network/ping for basic reachability before tracing the path.

Retrieves Linux distribution and kernel version.

Lists installed packages, auto-detecting the package manager (dpkg, apk; rpm-based systems aren't supported natively yet).

Lists user accounts from /etc/passwd (uid, gid, home, shell, group memberships). Never reads /etc/shadow - this reports account identity, not credentials.

Returns your authorized tools and privileges from mcp-sudo.yaml.