Server security audit (413 checks), hardening, and fleet management across 4 cloud providers.
Server security audit (413 checks), hardening, and fleet management across 4 cloud providers. That is what the kastell mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
The server publishes 4 tools. What each one is for:
Deploy — The Deploy tool exposed by this serverManage — The Manage tool exposed by this serverSnapshots — The Snapshots tool exposed by this serverSecurity — The Security tool exposed by this serverBecause this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
Configuration is passed through the environment: HETZNER_TOKEN, DIGITALOCEAN_TOKEN, VULTR_TOKEN, LINODE_TOKEN, KASTELL_STRICT_HOST_KEY. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Among the cloud and infrastructure options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Kastell's toolset — Deploy, Manage, Snapshots and 1 more — is a fair guide to whether it matches your workflow. It is maintained by kastelldev; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Kastell's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| Deploy | The Deploy tool exposed by this server. |
| Manage | The Manage tool exposed by this server. |
| Snapshots | The Snapshots tool exposed by this server. |
| Security | The Security tool exposed by this server. |
{
"mcpServers": {
"kastell": {
"command": "npx",
"args": ["-y", "-p", "kastell", "kastell-mcp"],
"env": {
"HETZNER_TOKEN": "your-token",
"DIGITALOCEAN_TOKEN": "your-token",
"VULTR_TOKEN": "your-token",
"LINODE_TOKEN": "your-token"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| HETZNER_TOKEN | Credential the server authenticates with. | Yes |
| DIGITALOCEAN_TOKEN | Credential the server authenticates with. | Yes |
| VULTR_TOKEN | Credential the server authenticates with. | Yes |
| LINODE_TOKEN | Credential the server authenticates with. | Yes |
| KASTELL_STRICT_HOST_KEY | Credential the server authenticates with. | Yes |
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.