{"id":"b2098e73-32e0-48bf-9fe9-926f0f374a17","slug":"hostlens","kind":"mcp","name":"hostlens","summary":"Linux host diagnostics over MCP, with policy-based access, bearer authentication, and privilege-separated collection. Written in Go.","owner":"Monska85","repoUrl":"https://github.com/Monska85/hostlens","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":1,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-09-10T16:47:44.000Z","addedAt":"2026-10-21T06:44:06.917Z","logoUrl":"https://avatars.githubusercontent.com/u/62102073?u=ece09ddc7de517b00b8045f04ca824896ce0139e&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","memory-knowledge"],"tags":["golang","host-diagnostics","linux","self-hosted","systemd"],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-27T00:43:41.657Z","sample":false,"url":"https://conduits.dev/tools/hostlens","language":"Go","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# HostLens\n\n[![CI](https://github.com/Monska85/hostlens/actions/workflows/ci.yml/badge.svg?branch=main&event=push)](https://github.com/Monska85/hostlens/actions/workflows/ci.yml)\n[![Release](https://github.com/Monska85/hostlens/actions/workflows/release.yml/badge.svg)](https://github.com/Monska85/hostlens/actions/workflows/release.yml)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)\n\nHostLens is a small MCP server for live Linux host, systemd service, and local Docker status. It starts in read-only mode. An administrator can enable two narrowly scoped repairs: restart an exact systemd service or a Docker container identified by its full ID.\n\nThe gateway authenticates bearer tokens and enforces active profile grants for both tool discovery and calls. A separate Docker observer exposes only named reads from the mixed Docker API. A separate repair worker checks role, profile, and live target again before a restart. Bounded service and container logs need separate grants. There is no generic shell, filesystem read, or Docker API tool. Observations are request scoped and report unavailable sources explicitly.\n\nLinux amd64 and arm64 are supported now. The shared CLI, gateway, authorization, and MCP packages build on macOS and Windows; those platforms need native status, identity, and repair adapters before they can run HostLens.\n\n## Start\n\nBuild a development candidate with `make package`, or use the [0.6.0 release](https://github.com/Monska85/hostlens/releases/tag/v0.6.0). Its configuration schema is version 2, separate from the product release number. Follow the [installation guide](docs/current/INSTALL.md) for download verification, preview and apply, service startup, and a first MCP request. Existing 0.5.0 installations require the [upgrade guide](UPGRADING.md); the MCP catalog and configuration change.\n\n```sh\nhostlens --help\nhostlens status\nsudo /usr/local/bin/hostlens config validate --config /etc/hostlens/config.yaml\nsudo /usr/local/bin/hostlens token create --name first-client --roles observe --expires \"$(date -u -d '+30 days' '+%Y-%m-%dT%H:%M:%SZ')\"\n```\n\nThe default endpoint is `http://127.0.0.1:8080/mcp` with bearer authentication. The [operations guide](docs/current/OPERATIONS.md) lists the tools, profile rules, limits, and a first request. The [installation guide](docs/current/INSTALL.md#enable-targeted-repair) explains repair activation. [Generated tool schemas](docs/current/tools.json) are checked against the SDK registry during validation. `hostlens uninstall` previews safe removal; `hostlens uninstall --apply` stops the packaged services and removes verified HostLens files while retaining administrator data and service identities.\n\n## Develop\n\nUse the repository's `Makefile` or lowercase `justfile`; the common targets call the same scripts or tools independently. Tests, systemd acceptance, and private Docker fixtures run in disposable containers. No validation target installs HostLens on the development host or changes its systemd units.\n\n```sh\nmake deps\nmake test-image\nmake test\nmake package\nmake verify-archives\n```\n\nSee [validation](docs/current/VALIDATION.md), [release engineering](docs/RELEASING.md), and the [current OpenSpec requirements](openspec/specs). The tag workflow publishes only after its validation passes.\n\n## License\n\n[Apache-2.0](LICENSE). [NOTICE](NOTICE) and the release archives record attribution and dependency licenses.\n"}