systems-managerBLOCK
System-Manager will update your system and install/upgrade applications. Supports Agentic AI through MCP Server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Version: 2.1.0
systems-manager is the typed host-operations provider for Agent Utilities and GraphOS. It exposes cross-platform package, service, process, network, disk, managed-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion capabilities without exposing a raw command tool.
The current package requires Python 3.11–3.14 and agent-utilities>=2.0.0,<3.0.0.
Install and run
Install only the interface the operator need:
pip install "systems-manager[mcp]" systems-manager-mcp --transport stdio
The optional extras are:
For an ephemeral MCP start:
uvx --from "systems-manager[mcp]" systems-manager-mcp --transport stdio
The checked-in mcp_config.json is a reference-only client catalog. It contains env:// references and safe deny defaults, never deployment endpoints, credentials, certificate paths, filesystem paths, hostnames, or identities. Project-specific values belong in AgentConfig or the process launcher.
Security contract
- Network MCP listeners require configured authentication. Non-loopback listeners also
require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the current Agent Utilities transport checks.
- Host mutations are denied unless
SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=trueand the
individual request receives destructive-operation approval.
- Managed-file writes also require
SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true.
- Sensitive reads and active probes have independent default-deny gates.
- Managed paths are confined beneath an explicit
SYSTEMS_MANAGER_FILESYSTEM_ROOT; there is no working-directory fallback.
- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,
and compatibility command aliases are not capab
02c7e19cd40cOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add systems-manager -- uvx systems-manager
{
"mcpServers": {
"systems-manager": {
"command": "uvx",
"args": [
"systems-manager"
]
}
}
}Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
capture_system_snapshot | read | |
get_management_capabilities | read | root_configured = bool( |
get_network_connections | read | |
health_check | read | return |
list_kernel_modules | read | |
list_services | read | |
unclassified_tool | read | return |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (13 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
auth_keys = ssh_dir / "authorized_keys"
def _read_authorized_keys(auth_keys: Path) -> str:
def _write_authorized_keys(
ssh_dir = os.path.expanduser("~/.ssh")existing = _read_authorized_keys(auth_keys)
A2A_URL = os.environ.get("A2A_URL", "http://127.0.0.1:9016/a2a/").bumpversion.cfg
.codespellignore
.pre-commit-config.yaml
mod = importlib.import_module(pkg_name)
mod = importlib.import_module(pkg_name)
mod = importlib.import_module(pkg_name)
decoded = base64.b64decode(fields[1], validate=True)
agent-utilities, pydantic, psutil, distro
Gates applied: no_behavioural_pass.
02c7e19cd40cfull audit observations/trust-audit/mcp-server/knuckles-team__systems-manager.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 02c7e19cd40c | BLOCK | D | 69 | first audit |
Questions
What is the systems-manager MCP server?
System-Manager will update your system and install/upgrade applications. Supports Agentic AI through MCP Server
What tools does systems-manager expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is systems-manager safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does systems-manager need?
No credential environment variables were found in its source, so it appears to need none.
How does systems-manager run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as systems-manager.
How current is this page?
The grade is for one exact copy of the source (02c7e19cd40c), read on 2026-10-11. The repository is watched and re-audited when it changes.