linux-mcp-server-administration

Use get_service_status to check the service state, then read_journal filtered by the service unit and error priority, followed by get_listening_ports to verify expected ports are open. All tools accept a host parameter like admin@web01 for remote execution over SSH.

Use read_journal for systemd journal entries with optional line count, unit, and priority filters, or read_log_file for specific files like /var/log/messages. Log files must be listed in the LINUX_MCP_ALLOWED_LOGS environment variable before access is granted.

No, all tools are strictly read-only by design. The server can inspect services, processes, logs, network, and storage but cannot start, stop, or modify any system resources, making it safe for production diagnostics.

The server is optimized for RHEL-based systemd systems and relies on commands like systemctl, journalctl, ss, and df. Other systemd distributions may work if these commands are available, but non-systemd systems are not supported.

Connection failures usually stem from missing key-based authentication or an inactive SSH agent. Verify manual access with ssh user@host, confirm SSH_AUTH_SOCK is set, start the agent with eval $(ssh-agent), and add your key with ssh-add.

The server only reads log files explicitly whitelisted in the LINUX_MCP_ALLOWED_LOGS environment variable. Add the desired log path as a comma-separated entry in your MCP client configuration and restart the server.