{"slug": "would-you-let-an-ai-agent-fix-things-on-your-servers", "title": "Would you let an AI agent fix things on your servers?", "summary": "An open-source project called Warden released a self-hosted AI agent that monitors Linux servers, diagnoses problems from logs and kernel counters, applies fixes, and emails a report, according to its GitHub repository. Warden pairs a deterministic sentinel that checks kernel counters and log streams at roughly 4 ms per check and bans attackers on its own with an LLM that is woken only when judgement is needed, so a quiet server costs zero LLM calls most of the time. The agent ships with a command denylist, autonomy levels including an observe-only mode, config validation with automatic rollback, protected IPs and an audit log of every action, and runs on the Python standard library with no pip dependencies, defaulting to DeepSeek with support for OpenAI, Claude, Gemini, Mistral, Groq, OpenRouter, Ollama or any OpenAI-compatible endpoint.", "body_md": "**Stops brute force and floods in seconds · investigates and fixes problems · follows them up until they're solved · emails you what happened**\n\n[Quick start](#-quick-start) · [How it works](#-how-it-works) · [What it catches](#-what-it-catches) · [Cost](#-what-it-costs) · [Safety](#-safety-model) · [Contributing](#-contributing)\n\nMost monitoring tools tell you something is wrong at 3 a.m. and leave the rest to you. Warden handles the 3 a.m. part itself. It reads the logs, works out the cause, fixes what is safe to fix, keeps watching until the fix holds, and writes you a short report.\n\nIt does this without paying an LLM to stare at your server all day.\n\n- 🧠 **Reflexes first, reasoning second.** A deterministic sentinel reads kernel counters and streams logs (~4 ms per check) and bans attackers on its own. The LLM is woken only when something needs judgement, so a quiet server costs**zero LLM calls** most of the time.\n- 🔁 **It follows through.** Unsolved problems become incidents with a next step. Follow-ups back off from 30 minutes to a day, and watchers tied to an incident wake it the moment something changes. When it needs a decision from you, it says exactly what to do.\n- 🧩 **It adapts to your server.** On first start it profiles the host and arms watchers for*your* services. Over time it mutes noise it has already reviewed and retunes its own routines.\n- 🔌 **Bring your own model.** DeepSeek by default; OpenAI, Claude, Gemini, Mistral, Groq, OpenRouter, Ollama or any OpenAI-compatible endpoint, with an optional fallback. You switch with one line.\n- 🪶 **Zero dependencies.** Pure Python standard library, using the`python3` that ships with Ubuntu. Nothing to`pip install` into a root daemon.\n- 🔒 **Guarded root.** A command denylist, autonomy levels, config validation with automatic rollback, protected IPs, prompt-injection-aware prompts, and an audit log of every action.\n\n```\ngit clone https://github.com/dyablohunter/warden.git && cd warden\ncp .env.example .env && nano .env      # LLM API key, EMAIL_TO, SMTP_*, WARDEN_ALLOWLIST\nsudo ./install.sh --extras             # --extras adds lynis, debsums, needrestart, smartmontools\n```\n\nThe installer:\n\n1. installs `nftables`\n2. copies the code to `/opt/warden` and your config to`/etc/warden/warden.env` (mode 600)\n3. **allowlists the IP you're installing from**\n4. checks the LLM connection and starts `warden.service`\n\nWarden then onboards itself and emails you an introduction to your own server.\n\n```\nwarden status                    # what it's watching, incidents, bans, token use\nwarden ask \"why is load high?\"   # give it a task\njournalctl -u warden -f          # watch it think\n```\n\n**Tip:** start with `WARDEN_AUTONOMY=observe` for a few days. Warden investigates and reports but can't change anything until you trust it.\n\n```\n ┌──────────────────────────── warden.service (root, Restart=always) ────────────────────────────┐\n │  JOURNAL STREAM (real time)          SENTINEL (every 10s, /proc only)      MAIN LOOP (sleeps)  │\n │  ssh / postgres / mysql / mail       SYN cookies, listen drops, conntrack, 1. notable events   │\n │  auth failures ──► ban               pps, Mbps, disk fill ETA...           2. incident follow- │\n │  log triggers ──► event              per-IP floods ──► ban                    ups (backoff)    │\n │  new error signatures ──► db         web: floods, scanners, credential     3. onboarding (1x)  │\n │                                        stuffing, exploits ──► ban          4. gated routines   │\n │                                      anomalies vs learned baseline ─┐            │             │\n │  warden event \"...\" ─────────────── triggers ─────────────────── wake            ▼             │\n │                                                                           LLM AGENT + tools    │\n │  nftables `inet warden` · expiring bans · per-source SYN/conn/ICMP limits (shell, files, bans, │\n │  + optional Cloudflare edge bans                                          incidents, triggers) │\n └───────────────────────────────────────────────────────────────────────┬───────────────────────┘\n                                                                         ▼\n                                                        email: alerts + weekly report\n```\n\n**Routines collect data without the LLM.** Each data source has a *gate*. The LLM is called only when a gate fires, and then it sees a **diff** against what it last reviewed, not a full dump.\n\n| Routine | Collects every | Wakes the LLM when… | \n|---|---|---|\n| `security_pulse` | 15 min | new privilege use, account changes, new listeners, exposed DB ports, new network-active processes or outbound ports | \n| `health_pulse` | 30 min | an error message **never seen before** on this host appears, or failed units change | \n| `system_sweep` | 24 h | security updates, reboot-required, expiring certs, time sync, containers, oversized logs | \n| `integrity_sweep` | 24 h | accounts, sudoers, SSH keys, cron, units, SUID files, critical hashes, `/tmp` executables change | \n| `weekly_review` | 7 d | always: hardening audit, self-tuning, and **your weekly report** | \n\n**Triggers** are deterministic watchers the agent creates for itself, for example \"wake me if Postgres connections > 80\", \"if nginx logs 50 upstream timeouts in 5 minutes\", or \"if this file changes again\". Kinds: `metric`, `log` (real time), `command`, `service`, `port`, `file`. Your own scripts can wake it too: `warden event --severity high \"backup failed\"`.\n\n| Threat | How it's detected (cheaply) | What happens | \n|---|---|---|\n| SYN / connection / ICMP floods | per-source kernel limits; SYN cookies, accept-queue drops, conntrack fill | dropped in-kernel; floods banned; the agent can tighten limits live | \n| Distributed floods | new connections/s, packets/s, Mbps and HTTP rates vs a **learned baseline** | anomaly wakes the agent with the top talkers | \n| Volumetric DDoS | inbound bandwidth vs link speed | critical alert telling you to enable upstream mitigation | \n| SSH / database / mail brute force | sshd, PostgreSQL, MySQL, Postfix, Dovecot failures, streamed live | escalating bans | \n| Web / API abuse | request floods, 4xx storms, **credential stuffing** , exploit probes, scanner user agents (sqlmap, nikto, nuclei…) in nginx/apache/Caddy logs | ban on the host, and **at the Cloudflare edge** if configured | \n| Disk trouble | usage, **time-until-full** from the fill rate, I/O saturation, read-only remounts, kernel I/O errors | the agent finds the writer or failing disk | \n| Compromise / persistence | changes to `passwd` ,`sudoers` , root keys,`ld.so.preload` ; new network processes (miners, reverse shells); deleted binaries;`/tmp` executables | the agent investigates | \n| Health | new error signatures, failed units, OOM kills, memory, load | the agent investigates and fixes | \n\nWarden works the same whether some sites, all sites, or none sit behind Cloudflare:\n\n- **Never bans Cloudflare's addresses.** It refreshes Cloudflare's published ranges weekly and exempts them from per-source limits.\n- **Tells you when real-IP logging is misconfigured.** If your logs record Cloudflare's IPs instead of visitors', it alerts you.\n- **Bans at the edge.** With`CLOUDFLARE_API_TOKEN` set, web attackers are blocked at Cloudflare, because a host firewall can't stop traffic that arrives through Cloudflare. Edge rules are removed automatically when the ban ends.\n- **Flags origin bypass.** It notices when your origin is reachable without going through Cloudflare.\n\nMeasured on Ubuntu 26.04 with `deepseek-chat`. \"Effective\" counts cached prompt tokens at 10%, which is roughly how providers bill them.\n\n| Run | Input tokens (cached) | Effective | \n|---|---|---|\n| Routine where nothing changed | 0 | **0** | \n| `health_pulse` with a new error | 31k (26k) | ~8k | \n| `security_pulse` with a change | 60k (53k) | ~14k | \n| Event triage | 27k (21k) | ~9k | \n| Onboarding (once) | 528k (484k) | ~105k | \n\nWhat keeps it cheap:\n\n- The system prompt is static, so the provider caches it (86–95% cache hits measured).\n- Old tool output in a run is trimmed in batches, and long runs are checkpointed into a summary.\n- Memory, incident history and per-run data are hard-capped.\n- `WARDEN_DAILY_TOKEN_BUDGET` pauses scheduled routines if you ever hit it. Attack handling never pauses.\n\nEverything Warden stores is **rotated automatically**: events, audit trail, emails, error signatures, incident notes, config backups. Hard row caps mean even a sustained attack can't bloat the database.\n\n| Guardrail | What it does | \n|---|---|\n| Autonomy levels | `observe` (read-only; it can still tune its own watchers) →`contain` (+ bans) →`full` (+ system changes) | \n| Denylist, always on | blocks disk wipes, `rm -rf /` ,`curl \\| sh` , flushing firewalls, stopping SSH or Warden, reboots (unless allowed), and reading secrets (`.env` files, private keys,`/etc/shadow` ) | \n| Read-only classifier | everything that runs without LLM review (collectors, command triggers) must be provably read-only | \n| Protected IPs | never banned: your allowlist, the host's own addresses, recent successful SSH logins, Cloudflare, and private IPs in web logs (usually your proxy) | \n| Config edits | backed up, written atomically, validated ( `sshd -t` ,`nginx -t` ,`visudo -c` ,`nft -c` …) and**rolled back** on failure | \n| Prompt-injection aware | log lines, URLs and user agents are wrapped as untrusted data, and the model is told never to follow instructions found in them | \n| Audit trail | every tool call is recorded ( `warden log` ) | \n\n**Honest limits:** a host can't absorb a flood that saturates its uplink. Put serious targets behind upstream protection (your provider's DDoS filtering, or Cloudflare). Warden will detect the saturation and tell you. Warden is a powerful root process; read the code, start in `observe` mode, and use it at your own risk.\n\nEverything lives in `/etc/warden/warden.env`. See [`.env.example`](https://github.com/dyablohunter/warden/blob/main/.env.example) for every knob.\n\n```\nLLM_PROVIDER=deepseek             # deepseek | openai | anthropic | gemini | mistral | groq | openrouter | ollama | custom\nDEEPSEEK_API_KEY=sk-...\n# LLM_MODEL=...  LLM_BASE_URL=...  LLM_FALLBACK_PROVIDER=ollama\n\nWARDEN_AUTONOMY=observe           # observe | contain | full\nWARDEN_ALLOWLIST=\"203.0.113.7\"    # your IPs: never banned\nEMAIL_TO=you@example.com          # alerts + weekly report\nSMTP_HOST=smtp.example.com\nCLOUDFLARE_API_TOKEN=...          # optional: edge bans\n```\n\n## **CLI reference**\n\n```\nwarden status                     routines, triggers, incidents, bans, token use, recent LLM runs\nwarden onboard                    (re)run the host profile\nwarden run <routine> [--force]    run a routine now (--force calls the LLM even if nothing changed)\nwarden ask \"...\"                  give the agent an instruction\nwarden event [--severity S] \"...\" wake the daemon with an event\nwarden incidents [ID] [--all]     incidents / full history        warden resolve ID \"note\"\nwarden bans | ban IP | unban IP\nwarden routines [-v] [enable|disable NAME]\nwarden triggers [-v] [enable|disable|delete NAME]\nwarden log -n 100                 audit log of everything the agent did\nwarden check | test-llm | test-email\n```\n\nIdeas we'd love help with. Each one is a good place to start contributing:\n\n-  **More notification channels:** Slack, Discord, Telegram, ntfy, generic webhooks\n-  **More auth \"jails\":** Gitea/Forgejo, Grafana, WordPress, Nextcloud, vsftpd, Asterisk\n-  **More distros:** Debian, Ubuntu 24.04 LTS, Rocky/Alma (firewalld)\n-  **Packaging:** a`.deb` / PPA, so it's`apt install warden`\n-  **Prometheus exporter** for the sentinel's metrics\n-  **A small read-only web/TUI dashboard**\n-  **XDP/eBPF fast path** for line-rate drops\n-  **Fleet mode:** several hosts, one brain, shared ban intelligence\n-  **Agent eval harness:** replay recorded incidents and score the agent's decisions across models\n-  **Local-model tuning:** prompts and tool schemas that work well with small Ollama models\n\n**Warden is young and contributions are very welcome**, whether you're a sysadmin with war stories, a security person who wants to break it, or a Python developer who likes clean, dependency-free code.\n\n- 🐛 **Found a bug or a false positive?**[Open an issue](https://github.com/dyablohunter/warden/issues) with the log line or scenario.\n- 🧪 **Have a detection idea?** Most detectors are a regex or a counter plus a test. See[CONTRIBUTING.md](https://github.com/dyablohunter/warden/blob/main/CONTRIBUTING.md#adding-a-detector) .\n- 🔌 **Use a provider we don't?** Adding one is usually a preset line.\n- 🔐 **Found a way to make Warden do something dangerous** , such as a denylist bypass or a prompt injection that works? Please report it privately; see[SECURITY.md](https://github.com/dyablohunter/warden/blob/main/SECURITY.md) . These are the most valuable reports of all.\n- 📝 **Docs, examples, translations of the weekly report** : all welcome.\n\nRead [CONTRIBUTING.md](https://github.com/dyablohunter/warden/blob/main/CONTRIBUTING.md) for the dev setup and design principles. The short version: stdlib only, cheap detection first, never weaken a safety invariant without discussion, and every parser comes with a test. `python3 -m unittest discover -s tests -t .` runs the full suite in a few seconds on any OS, with no root and no network.\n\nIf Warden saves you a night's sleep, **⭐ star the repo** and tell a fellow sysadmin.\n\n[MIT](https://github.com/dyablohunter/warden/blob/main/LICENSE) © 2026 dyablohunter. Architecture notes for contributors (and AI coding assistants) are in [CLAUDE.md](https://github.com/dyablohunter/warden/blob/main/CLAUDE.md).", "url": "https://wpnews.pro/news/would-you-let-an-ai-agent-fix-things-on-your-servers", "canonical_source": "https://github.com/dyablohunter/warden", "published_at": "2026-10-23 09:54:29+00:00", "updated_at": "2026-10-23 10:12:18.596459+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-infrastructure", "artificial-intelligence"], "entities": ["Warden", "DeepSeek", "OpenAI", "Claude", "Gemini", "Mistral", "Groq", "OpenRouter"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/would-you-let-an-ai-agent-fix-things-on-your-servers", "markdown": "https://wpnews.pro/news/would-you-let-an-ai-agent-fix-things-on-your-servers.md", "text": "https://wpnews.pro/news/would-you-let-an-ai-agent-fix-things-on-your-servers.txt", "jsonld": "https://wpnews.pro/news/would-you-let-an-ai-agent-fix-things-on-your-servers.jsonld"}}