kennyBLOCK
Self-hosted remote administration and fleet monitoring for Windows PCs in a family setting, operated through Claude (MCP) and a web dashboard.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Self-hosted remote administration _and fleet monitoring_ for Windows and Linux, driven by Claude (MCP) and a web dashboard.
[](LICENSE) [](https://github.com/nullthrone/kenny/actions/workflows/ci.yml) [](https://nullthrone.github.io/kenny/) [](https://github.com/nullthrone/kenny/releases)
kenny administers a small fleet of Windows and Linux machines from one place: pushed telemetry with server-side health rules and alerting, capability tools that act on a host, account governance, a web filter and screen time, and a ticket queue the people who use those machines can open themselves. Operate it through Claude over MCP, through the built-in chat, or by hand in the console. It is for the machines you administer, with the consent of the people who use them — family PCs, a home lab, a small office.
flowchart LR
Operator(("Operator"))
Claude["Claude(local client, optional)"]
subgraph Server["kenny-server (cloud)"]
UI["Dashboard + Chat"]
MCP["MCP endpoint /mcp"]
Tunnel["Agent tunnel /agent/ws"]
Store[("Telemetry storeSQLite")]
end
Agent["kenny-agent (Windows / Linux host)PowerShell / shell · winget · systemdfilesystem · screenshot · collectors"]
Operator -->|https dashboard + chat| UI
Operator --> Claude -->|MCP, OAuth| MCP
UI --> Tunnel
MCP --> Tunnel
Tunnel |WSS, agent dials out| Agent
Agent -->|telemetry push| Store
Store --> UI- kenny-server (Python / FastMCP): stable MCP endpoint for Claude, the agent tunnel,
the telemetry store (SQLite), and the operator dashbo
dbc11fcc11d8OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add kenny-web --env KENNY_AGENT_TOKENS=${KENNY_AGENT_TOKENS} --env KENNY_ALLOW_TOKEN_AUTH=${KENNY_ALLOW_TOKEN_AUTH} --env KENNY_GITHUB_TOKEN=${KENNY_GITHUB_TOKEN} --env KENNY_KEY_GRACE_SECS=${KENNY_KEY_GRACE_SECS} -- npx -y [email protected]{
"mcpServers": {
"kenny-web": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"KENNY_AGENT_TOKENS": "${KENNY_AGENT_TOKENS}",
"KENNY_ALLOW_TOKEN_AUTH": "${KENNY_ALLOW_TOKEN_AUTH}",
"KENNY_GITHUB_TOKEN": "${KENNY_GITHUB_TOKEN}",
"KENNY_KEY_GRACE_SECS": "${KENNY_KEY_GRACE_SECS}"
}
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agent_health | read | _require_scope(_mcp_principal(), id) |
fleet_overview | read | principal = _mcp_principal() |
list_agents | read | principal = _mcp_principal() |
Trust audit
BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (14 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
"powershell_exec" => handlers::powershell::exec(args).await,
"shell_exec" => handlers::shell::exec(args).await,
let err = exec(json!({"nope": 1})).await.unwrap_err();let result = exec(json!({"script": "Write-Output hi"})).await.unwrap();let err = exec(json!({"script": "Start-Sleep -Seconds 5", "timeout_s": 1}))check("fs_read", &json!({ "path": "/home/user/.ssh/id_rsa" })).unwrap_err();In scope: authentication/authorization bypass, the agent-side safety guard or kill-switch
secret = "correct-horse-battery-staple"
.pages
module = importlib.import_module(name)
"../../../../etc/passwd",
import { HOSTILE, KENNY_REPLY } from '../../test/markdownSamples'vi.mock('../../api/client', () => ({import { useAgentBinary, useRetryAgentBinaryFetch } from '../../api/agentBinary'import { api } from '../../api/client'code=$(curl -sL -o /dev/null -w '%{http_code}' http://127.0.0.1:8000/login || true)f"http://127.0.0.1:{port}/mcp",f"http://127.0.0.1:{port}/mcp",f"http://127.0.0.1:{port}/mcp",self.url = f"http://127.0.0.1:{self._server.server_address[1]}"Ed25519PublicKey.from_public_bytes(base64.b64decode(public_key_b64))
Ed25519PublicKey.from_public_bytes(base64.b64decode(public_key_b64))
sig = base64.b64decode(sig_b64)
pub = Ed25519PublicKey.from_public_bytes(base64.b64decode(public_key_b64))
seed = base64.b64decode(row["seed_b64"])
Gates applied: instruction_override, no_behavioural_pass.
dbc11fcc11d8full audit observations/trust-audit/mcp-server/nullthrone__kenny.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | dbc11fcc11d8 | BLOCK | F | 50 | first audit |
Questions
What is the kenny MCP server?
Self-hosted remote administration and fleet monitoring for Windows PCs in a family setting, operated through Claude (MCP) and a web dashboard.
What tools does kenny expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is kenny safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (50/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does kenny need?
It reads KENNY_AGENT_TOKENS, KENNY_ALLOW_TOKEN_AUTH, KENNY_GITHUB_TOKEN, KENNY_KEY_GRACE_SECS, KENNY_OPERATOR_TOKEN, KENNY_OPERATOR_TOKENS, KENNY_SERVER_PRIVATE_KEY, KENNY_SERVER_PRIVATE_KEY_FILE and KENNY_TOKEN_GRACE_SECS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does kenny run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as kenny-web at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (dbc11fcc11d8), read on 2026-10-12. The repository is watched and re-audited when it changes.