sysknife

Describe what you want in plain language. Review a typed plan with risk levels. Approve explicitly. Watch it execute with live output. Atomic-host changes (rpm-ostree) roll back automatically on failure. Every action is Ed25519-signed and audited.

SysKnife never runs a shell command. Every action is a typed operation with a formal risk level. The AI cannot touch your system directly. A privileged daemon executes only what you approve, writes a tamper-evident Ed25519-signed audit chain, and rolls back atomic-host (rpm-ostree) changes automatically on failure.

Why typed actions and not a guarded shell? Red-team research (GuardFall) found that 10 of 11 AI agents bypass raw-string shell guards — an allowlist or regex is filtering a language rich enough to hide intent. SysKnife removes the shell string entirely: the model emits typed actions, and a public-key-verifiable audit chain records every one.

Install

The fastest path is the setup wizard. It installs the daemon and wires SysKnife into your AI IDE — Claude Code, Cursor, or Codex CLI — so you can plan and execute from chat.

npx sysknife-setup

What this does:

1. Downloads the prebuilt sysknife + sysknife-daemon binaries for your architecture (x86_64 / aarch64) from GitHub Releases, SHA-256-verifies each against the release checksum file — a mismatch aborts the install — and places them in ~/.local/bin (no sudo). Pass --no-binary to skip the download and build from source instead.

2. Asks for your LLM provider, key, and model — OpenAI / Anthropic / Gemini / Ollama / Groq / DeepSeek / Mistral / xAI (Ollama needs no key). The key prompt is skipped when the matching env var is already set.

3. Asks which AI integration to wire up (or pick --claude / --cursor / --codex / --all) and your daemon target(s) — socket, plus an optional vsock token for a remote VM.

4. Writes the integration-specific MCP config (merging into any existing file, never clobbering) so the next chat session sees the sysknife_* tools — sysknife_plan, sysknife_execute, sysknife_history, sysknife_doctor, sysknife_audit_verify — as first-class tools.

5. Installs and starts the daemon as a service (last step) — a systemd user service by default (no sudo; kept alive across logout via linger). Pick the system-level service for a production, multi-user host.

Then in your chat: ask for what you want and review the plan with risk pills. Approve each transaction with sysknife approve <transaction-id> in a terminal, return the one-time receipts, and watch it execute. The daemon, not the prompt, enforces the receipt boundary.

Prefer the standalone CLI? Same engine, no IDE — see the CLI guide for sysknife "...", --dry-run, --json, approval prompts, and audit-log inspection.

git clone https://github.com/lacs-project/sysknife
cd sysknife
make build                            # builds sysknife (CLI) + sysknife-daemon
sudo make install                     # installs both; daemon runs as a system service
sudo systemctl enable --now sysknife-daemon

# Then wire your IDE — --no-binary skips the download since you just built them
# (choose "skip" at the daemon-service prompt; make install already set it up)
npx sysknife-setup --no-binary

Ubuntu 24.04 is validated with 65/65 stories on a live VM. Ubuntu 22.04 and 26.04 have passed bootstrap and smoke tests but not the full story suite. Fedora Atomic is the rpm-ostree target; record a current Silverblue 44 VM run before treating a release as current-validated. Plain Fedora Workstation and Server remain experimental until the dnf action family ships. See the distro support matrix for evidence and scope.

# Requires the sysknife binary (see manual install above, or `npx sysknife-setup`).
# Plans only: no daemon, no approval, no execution.
export ANTHROPIC_API_KEY=sk-ant-...
sysknife --dry-run "show disk usage and list services that ate cpu in the last hour"

Related MCP server: systerd-lite

Prefer the terminal? The CLI is a first-class path

Same engine, no IDE and no MCP client — plain language to a typed plan to live execution, straight from your shell, with --dry-run, --json, --yes up to a risk ceiling, and sysknife audit verify. This is a fully supported way to run SysKnife, not an afterthought. See the CLI guide.

Also: a desktop GUI — a distant third option. An experimental Tauri desktop app (sysknife-shell) wraps the same plan → approve → execute loop in a window. It is the least frequently maintained surface, well behind the MCP integration and the CLI, so reach for it only if you specifically want a graphical approval flow.

How it works

sysknife-brain   →   sysknife-shell   →   sysknife-daemon
  (planner)         (approval gate)        (executor)
   talks to LLM      shows the plan,        only privileged
   never to OS       takes y/n              process; signs
                                            every action

1. You type a natural-language request.

2. The brain proposes a plan — each step is a typed action with a risk level (Low · Medium · High).

3. The shell shows the plan with previews, side-effects, and rollback metadata.

4. You approve each step explicitly (or set --yes up to a risk ceiling).

5. The daemon executes, streams live output, rolls back automatically on high-risk failure.

6. Every execution is logged to a hash-chained SQLite or Postgres audit trail you can verify with sysknife audit verify.

The brain proposes; only the daemon is privileged. The daemon enforces policy, executes typed actions, writes the signed chain, and triggers atomic-host rollback (rpm-ostree) on failure. The trust boundary is mechanical: no shell strings cross the wire.

Why not just X?

SysKnife is different by construction: typed actions, an Ed25519-signed audit chain, explicit approval gate, automatic rollback for atomic-host (rpm-ostree) changes, polkit-mediated privilege boundary. The AI never holds a shell. See the full SysKnife vs. alternatives breakdown (AIShell-Gate, gate-oc-audit, MCP gateways, generic mcp-shell).

Status

The trust chain is built, tested, and shipping. Multi-distro is the active milestone.

1,405 Rust tests and 72 frontend tests form the current deterministic release baseline.

Configure your LLM

SysKnife works with Ollama (no key, recommended for privacy / offline / homelab) or OpenAI, Anthropic, Gemini, Groq, DeepSeek, Mistral, xAI.

# ~/.config/sysknife/config.toml
[llm]
provider     = "ollama"          # or anthropic / openai / gemini / groq / ...
model        = "qwen3:8b"        # provider-specific
ollama_url   = "http://localhost:11434"
max_turns    = 10

[daemon]
socket   = "/run/sysknife/daemon.sock"
database = "/var/lib/sysknife/daemon.sqlite"

[storage]                         # production-recommended
backend = "postgres"
url     = "postgres://sysknife:${PG_PASSWORD}@db.example.com/audit?sslmode=verify-full"

Env vars always win over the config file. Full reference in docs/configuration.md.

MCP protocol

SysKnife implements the Model Context Protocol and exposes approval-gated planning and execution tools. sysknife_plan returns a daemon-issued transaction ID for each step. After reviewing the plan, the user runs sysknife approve <transaction-id> in a real terminal and gives the one-time receipt to the agent. sysknife_execute rejects missing, expired, mismatched, or replayed receipts. The MCP server cannot mint approval receipts itself.

Use the setup wizard (above) to wire it into Claude Code, Cursor, or Codex CLI. All config files that may contain API keys are created with chmod 0600.

Roadmap

See ROADMAP.md for the full milestone breakdown.

• ✅ Ubuntu 24.04 — 65/65 stories validated on a live VM (gpt-4.1)

• ✅ Ubuntu 22.04 / 26.04 — VM tooling complete; smoke tests pass on all three LTSes

• 📋 Telegram inline-button approvals

• 📋 sysknife audit export (CEF / NDJSON for SIEM ingest)

• 📋 Fleet plan/execute (one plan, N targets, parallel approval)

Protocol

SysKnife is the reference implementation of the LACS (Linux Agent Control Standard) protocol — typed actions, risk classification, approval gates, audit requirements. The spec is CC0 (public domain):

→ lacs-project/specification

Other implementations for other distros and languages are explicitly encouraged.

Contributing

We want help. Multi-distro is the highest-impact area to plug into right now — see docs/distro-support.md for the roadmap matrix and CONTRIBUTING.md for the workflow.

Issues labelled good first issue are scoped with clear acceptance criteria.

Documentation

• Typed actions — why never a shell string

• Action reference — every action, generated from the code

• The audit chain — Ed25519, public-key verifiable

• Automatic rollback

• SysKnife vs. alternatives

• Architecture overview

• Distro support matrix

• Configuration

• Audit storage and recovery

• Developer guide

• Testing guide

• VM daemon setup

• Security policy

• Release readiness checklist

• Roadmap

• ADR 0001 — System boundaries

• ADR 0002 — Brain provider layer

• ADR 0003 — IPC wire protocol

Where to find SysKnife

License

MIT. Free to use, modify, distribute, and embed in proprietary products without restriction.

The LACS specification is CC0 1.0 — public domain.