SYSKNIFE_SOCKET — Where the privileged daemon listens: a unix:// path, a vsock:// target, or a bare path. Defaults to wherever the daemon bound, so it is only needed for a non-default install or a remote VM.
Claude Code にはローカルコマンド用のインストールリンクがありません。下のコマンドをコピーして、ターミナルで実行してください。
The AI never supplies a command. Every action is a typed operation with a
formal risk level, and the daemon builds the command line itself from the
action's own definition — some actions do run through sh -c, but the shell
fragment is constructed by SysKnife, never by the model. The AI cannot touch
your system directly. A privileged daemon executes only what you approve, writes
a tamper-evident Ed25519-signed audit chain, and rolls back atomic-host
(rpm-ostree) changes automatically on failure.
An AI that administers Linux through typed, approval-gated, Ed25519-audited actions. The model selects the action; the daemon builds the command.
SYSKNIFE_SOCKET
最終チェック
2026-10-27
スター
57
ツール
—
稼働率
—
Why typed actions and not a guarded shell? Red-team research (GuardFall)
found that 10 of 11 AI agents bypass raw-string shell guards — an allowlist
or regex is filtering a language rich enough to hide intent. SysKnife removes
the shell string entirely: the model emits
typed actions, and a
public-key-verifiable audit chain records every one.
MCP server
SysKnife is an MCP server first. Point Claude Code, Cursor or Codex CLI at it and
your assistant gets typed, risk-classified sysadmin tools in place of a shell:
Tool
What it does
sysknife_plan
Turns plain language into typed steps, each with a risk level, a resolved command and a daemon transaction ID
sysknife_execute
Runs steps that carry a one-time receipt, and nothing else
sysknife_history
Reads past runs out of the signed audit log
sysknife_doctor
Reports daemon, provider and audit-chain health
sysknife_audit_verify
Walks the Ed25519 chain and says whether it is intact
sysknife_get_disk_usage, and the rest of the read-only catalogue
Direct queries, selected for the distro you are on
npx sysknife-setup
One command wires the server into your client and installs the daemon.
Install has the detail, and MCP protocol has the
wire behaviour.
Your assistant cannot approve its own work.sysknife_plan hands back a
transaction ID and stops there. The receipt sysknife_execute demands comes
from sysknife approve <transaction-id>, typed in your terminal, on a channel
the model does not sit on. Missing, expired, mismatched and replayed receipts
are all refused.
Prefer to stay in the shell? The CLI
is the same engine with no client in front of it.
Install
The fastest path is the setup wizard. It installs the daemon and wires
SysKnife into your AI IDE — Claude Code, Cursor, or Codex CLI — so you can
plan and execute from chat.
npx sysknife-setup
Needs Node 22 or newer; older Node releases no longer receive security fixes.
On Ubuntu 22.04 apt install nodejs gives Node 12, which is too old; the installer
says so and how to get a current Node. No Rust
toolchain and no compile: it downloads verified prebuilt binaries.
What this does:
Downloads the prebuilt sysknife + sysknife-daemon binaries for your
architecture (x86_64 / aarch64) from GitHub Releases, SHA-256-verifies
each against the release checksum file — a mismatch aborts the install — and
places them in ~/.local/bin (no sudo). Pass --no-binary to skip the
download and build from source instead.
Asks for your LLM provider, key, and model — OpenAI / Anthropic / Gemini
/ Ollama / Groq / DeepSeek / Mistral / xAI (Ollama needs no key). The key
prompt is skipped when the matching env var is already set.
Asks which AI integration to wire up (or pick --claude / --cursor /
--codex / --all) and your daemon target(s) — socket, plus an optional
vsock token for a remote VM.
Writes the integration-specific MCP config (merging into any existing
file, never clobbering) so the next chat session sees the sysknife_* tools —
sysknife_plan, sysknife_execute, sysknife_history, sysknife_doctor,
sysknife_audit_verify, and distro-compatible direct read-only queries such
as sysknife_get_disk_usage — as first-class tools.
Installs and starts the daemon as a service (last step) — a systemd
user service by default (no sudo; kept alive across logout via linger).
That service runs as you, so read-only actions work but mutating ones do
not: installing packages or restarting services needs the system-level
service, whose sudoers grants belong to the sysknife system user. Pick the
system service on any host where you intend to change something, and pass
--daemon-mode=system|user|skip to choose without a prompt. --daemon-mode=system
does not install the system service from the wizard — it needs root-owned
sudoers, polkit and helper policy that sudo make install owns — so it prints
the exact sequence and reports the daemon as not yet installed.
To verify the download against a checksum list you trust independently of the
release, set SYSKNIFE_PINNED_SHA256SUMS=/path/to/sums; see
SECURITY.md.
To check where a release binary was built, download it from the release page and
run gh attestation verify sysknife-vX.Y.Z-linux-x86_64 --repo lacs-project/sysknife.
It succeeds only if the file matches a provenance statement GitHub signed for a
build of this repository by release.yml. Each release also ships that
provenance as sysknife-vX.Y.Z-linux-<arch>.intoto.jsonl, so the same check works
with --bundle; see Verify the published release.
Client
Files written
Claude Code
.mcp.json + .claude/hookify.*.local.md
Cursor
.cursor/mcp.json + .cursor/rules/sysknife.mdc
Codex CLI
~/.codex/config.toml (appended) + AGENTS.md
Then in your chat: ask for what you want and review the plan with risk pills.
Approve each transaction with sysknife approve <transaction-id> in a
terminal, return the one-time receipts, and watch it execute. The daemon, not
the prompt, enforces the receipt boundary.
Prefer the standalone CLI? Same engine, no IDE — see the
CLI guide for sysknife "...", --dry-run, --json,
approval prompts, and audit-log inspection.
Needs Rust stable and a C compiler (build-essential): the TLS and SQLite
dependencies build native code, so a rustup-only machine stops at
error: linker cc not found. cmake is not required. Budget 7 to 12
minutes for the ~400-crate build (6m56s on Ubuntu 24.04, 11m43s on 22.04).
sudo apt-get install -y build-essential
git clone https://github.com/lacs-project/sysknife
cd sysknife
make build # builds sysknife (CLI) + sysknife-daemon
sudo make install # installs both; daemon runs as a system service
sudo systemctl enable --now sysknife-daemon
# Join the socket group and one role group, or every request is refused with
# "Permission denied" before any role check runs: /run/sysknife is 0750
# sysknife:sysknife, and a sudo admin is not in that group automatically.
# Role groups: sysknife-observer (read-only), sysknife-dev (medium risk),
# sysknife-admin (high risk). Members of wheel are treated as admin.
sudo usermod -aG sysknife,sysknife-admin "$USER"
newgrp sysknife # or log out and back in
# Then wire your IDE — --no-binary skips the download since you just built them
# (--daemon-mode=skip: make install already set the service up)
npx sysknife-setup --no-binary --daemon-mode=skip
Uninstall
Whichever way you installed, there is one command for it.
# Removes the user service, the binaries in ~/.local/bin, and the SysKnife
# entries in the MCP and agent config it wrote: Claude Code's in the current
# directory, .cursor/mcp.json and .cursor/rules/sysknife.mdc, the sysknife block
# in ~/.codex/config.toml, and the SysKnife block in AGENTS.md.
npx sysknife-setup --uninstall
# See exactly what that would touch, without touching it.
npx sysknife-setup --uninstall --dry-run
Your audit history is kept by default. Removing the software should not
destroy the record of what it did, so the audit database, the safety-audit log
and ~/.config/sysknife are left in place and their paths printed. Delete those
too, only if you mean to, with:
npx sysknife-setup --uninstall --purge # names each file before deleting it
If you installed the system service with sudo make install, remove it with
the Makefile that owns its sudoers grants, polkit rules and privileged helpers.
--uninstall deliberately will not touch those, because half a removed
privilege boundary is worse than none:
sudo make uninstall
All three Ubuntu LTS releases record a live-VM run of 79 stories from the Ubuntu
suite (which has since grown to 90+), and each run has a replay twin that reproduces it: 22.04, 24.04 and 26.04
all at 79/79, every twin serving every call with zero misses. The runs are in
tests/evidence/story-runs/. The suite grew from 50 when every Debian-only
action got a story, GetHostState first.
Fedora Atomic is the rpm-ostree target; make install does not complete on
rpm-ostree yet (#301), and
a release needs a current Silverblue 44 VM run before it counts as validated. Plain Fedora Workstation and
Server remain experimental until the dnf action family ships. See the
distro support matrix for evidence and scope.
# Requires the sysknife binary (see manual install above, or `npx sysknife-setup`).
# Plans only: no daemon, no approval, no execution.
export ANTHROPIC_API_KEY=sk-ant-...
sysknife --dry-run "show disk usage and list services that ate cpu in the last hour"
Prefer the terminal? The CLI is a first-class path
Same engine, no IDE and no MCP client — plain language to a typed plan to live
execution, straight from your shell, with --dry-run, --json, --yes up to a
risk ceiling, and sysknife audit verify. This is a fully supported way to run
SysKnife, not an afterthought. See the CLI guide.
Also: a desktop GUI — development paused. An experimental Tauri desktop
app (sysknife-shell) wraps the same plan → approve → execute loop in a
window. Its development is paused for now, and effort is going to Ubuntu
across its supported versions instead. The code stays in the tree and still
builds, but it is not being reviewed, tested, or extended, so reach for it
only if you specifically want a graphical approval flow and can live with
that. The MCP integration and the CLI are the maintained surfaces.
How it works
sysknife-brain → approval gate → sysknife-daemon
(planner) (you, in a (executor)
talks to LLM terminal) only privileged
never to OS shows the plan, process; signs
takes y/n every action
The approval gate is a surface, not a component, and it depends on how you
reach SysKnife:
MCP: a plan from an AI client needs a receipt from
sysknife approve <transaction-id>, typed in your terminal, so the client
cannot approve its own plan.
The standalone CLI:sysknife "<intent>" asks about each step at its own
prompt, or approves up to --max-risk under --yes. It never calls
sysknife approve.
An agent with a shell on your account can drive the CLI by itself. In that
case the daemon's role limits
(SECURITY.md, layer 3)
are the boundary that holds.
The paused Tauri GUI (sysknife-shell) is a third implementation of the gate,
not a step the other two route through.
You type a natural-language request.
The brain proposes a plan — each step is a typed action with
a risk level (Low · Medium · High).
The shell shows the plan with previews, side-effects, and rollback
metadata.
You approve each step explicitly (or set --yes up to a risk ceiling).
The daemon executes, streams live output, and rolls back atomic-host
(rpm-ostree) changes automatically on failure.
Every execution is logged to a hash-chained SQLite or Postgres audit
trail you can verify with sysknife audit verify.
The brain proposes; only the daemon is privileged. The daemon enforces
policy, executes typed actions, writes the signed chain, and triggers
atomic-host rollback (rpm-ostree) on failure. The trust boundary is
mechanical: no shell strings cross the wire.
Why not just X?
Tool
The gap
Open Interpreter
Runs arbitrary Python/Shell. No formal risk model. No audit chain.
Goose / Continue
General-purpose. Ad-hoc confirmation, not typed risk levels.
Claude Computer Use
Uncontrolled desktop automation, not system administration.
Ansible
YAML written in advance. Not conversational. No risk classification.
shell-gpt / Copilot
Suggests raw shell commands. You still run raw shell.
AIShell-Gate
Closest peer, but proprietary and closed; audit is symmetric HMAC (the verifier holds the signing secret, so a proof convinces no one else). No rollback.
Manual
No audit trail. No rollback. One typo = lost work.
SysKnife is different by construction: typed actions, an Ed25519-signed audit
chain, explicit approval gate, automatic rollback for atomic-host (rpm-ostree)
changes, a privilege boundary scoped per action across sudo and polkit. The AI
never holds a shell. See the
full SysKnife vs. alternatives breakdown (AIShell-Gate,
gate-oc-audit, MCP gateways, generic mcp-shell).
Status
The trust chain is built, tested, and shipping. Multi-distro is the active
milestone.
SysKnife implements the Model Context Protocol
and exposes approval-gated planning and execution tools. sysknife_plan
returns a daemon-issued transaction ID for each step. After reviewing the
plan, the user runs sysknife approve <transaction-id> in a real terminal and
gives the one-time receipt to the agent. sysknife_execute rejects missing,
expired, mismatched, or replayed receipts. The MCP server cannot mint approval
receipts itself.
Use the setup wizard (above) to wire it into Claude Code, Cursor, or Codex CLI.
All config files that may contain API keys are created with chmod 0600.
✅ Ubuntu 22.04 — 79/79 stories on a live VM (recorded in tests/evidence/story-runs/)
✅ Ubuntu 24.04 and 26.04 — 79/79 and 79/79 on live VMs; every LTS run has a replay twin that reproduces it
✅ sysknife audit export — stored signed chain rows as JSON with --since / --limit
📋 Telegram inline-button approvals
📋 CEF / NDJSON output modes for SIEM ingest
📋 Fleet plan/execute (one plan, N targets, parallel approval)
Protocol
SysKnife is the reference implementation of the LACS (Linux Agent Control
Standard) protocol — typed actions, risk classification, approval gates,
audit requirements. The spec is CC0 (public domain):
Other implementations for other distros and languages are explicitly
encouraged.
Contributing
We want help. Multi-distro is the highest-impact area to plug into right
now — see docs/distro-support.md for the
roadmap matrix and CONTRIBUTING.md for the workflow.
Issues labelled
good first issue
are scoped with clear acceptance criteria.
If you send a patch, watching
Releases is the quickest way
to see it ship and to catch new good first issue entries as they land. A star
helps other people find the project.
Needs build-essential; ~7-12 min build. Published by reviewed version tags; see docs/release.md
MCP Registry
io.github.lacs-project/sysknife
registry.modelcontextprotocol.io — resolves to the crates.io install above. Directory pages that sandbox a server list every tool but cannot call the ones needing the daemon; docs/mcp-registry.md explains the split
最終チェックは 2026-10-27 です。 An AI that administers Linux through typed, approval-gated, Ed25519-audited actions. The model selects the action; the daemon builds the command.