Just ask your agent.
Tell your agent what to fix in plain words. It reads the server through Stenvakt and proposes the change. Nothing runs until you approve it in the app, and the risky parts still run in safe mode.
Replayed from a real run on our own server, with the address changed. Pick an app to see it there; anything that runs local MCP servers works.
close any Docker ports on Cenner that are open to the internet
stenvaktaudit_server · Cenner
Two ports get past the firewall: 3001 is your API, reachable without Cloudflare, and 8080 is the proxy. The tunnel uses localhost, so blocking them from outside is safe.
stenvaktpropose_changes · block 3001, 8080
Proposed. Waiting for you to approve it in Stenvakt.
Done. Both ports time out from outside, and api.cenner.hr still answers through the tunnel.
Nothing waiting. Agents can only propose; you decide here.
Block Docker ports 3001, 8080
on Cenner, in safe mode
- Rollback armed, 300 s
- Ports blocked on eth0
- Fresh connection works
- Rollback cancelled, kept
203.0.113.7:3001closed
203.0.113.7:8080closed
A look inside
One server as Stenvakt sees it. Hover or tap any part to see what it means.
- Lime is fine, or a country you expect.
- Amber is worth a look when you have time.
- Red needs you now.
Everything here is read from the server over SSH, in a few seconds. Nothing is installed on it, and nothing changes until you pick a fix and read its preview.
Sample data from a demo server.
3 to fix now, 3 worth doing, 3 nice to have
from 63 addresses
v22.9.0 → v22.11.03.0.13 → 3.0.13-0ubuntu3.627.3.1 → 27.4.0They are open even with the firewall on.
No more security fixes since 2025-12.
And this server runs a database.
root@cenner:2222root@origigy:2222[email protected]:2299How a fix goes
First it
finds it.
Review reads the server and lists what to fix. It changes nothing.
Then you
read it.
Preview shows every command before anything runs.
Then it
runs safe.
A snapshot, a rollback timer on the server, a fresh connection test.
Then you
keep it.
You confirm. If you can't, the server undoes it by itself.
Exports
What you can save from Review and Watch. Sample data shown.
Security and health review: Cenner
| Security | 66/100 |
| Health | 83/100 |
Fix now
- Docker publishes sensitive ports to the internet: 8000 6001 (Firewall and network)
Docker bypasses ufw, so these are open even with the firewall on. - No sign of backups, and this server runs a database (Backups and recovery)
Should do
- 3 security updates waiting (Updates and lifecycle)
- Docker container logs are not rotated (Disk and logs)
Measurements
| Load | 0.62 |
| Memory free | 38 % |
| Disk | 78 % |
| Uptime | 41 d |
Outside activity report
Cenner
Window: last 60 minutes.
| SSH attempts | 1840 from 63 addresses |
| Blocked connections | 960 from 118 addresses |
| Web requests | 6120 (2310 client errors, 40 server errors) |
| Banned now | 14 |
Findings
- critical: Login from an unexpected country: [email protected] in Brazil.
- warning: SSH guessers from 203.0.113.54.
Countries
| Netherlands (NL) | 1612 |
| United States (US) | 498 |
| Brazil (BR) | 1, not on the expected list |
# Stenvakt blocklist, 2026-10-24T09:15:11Z # 6 public addresses seen on Cenner, busiest first. Your own addresses are left out. # Review before use: shared networks and search engines can show up here. 203.0.113.54 198.51.100.23 192.0.2.140 203.0.113.9 198.51.100.88 192.0.2.17
server,scanned_at,user,ip,country,method,time,status,unexpected_country Cenner,2026-10-24T09:14:02Z,root,198.51.100.88,BR,publickey,16:31,public,yes Cenner,2026-10-24T09:14:02Z,root,192.0.2.10,HR,publickey,08:02,your address,no Cenner,2026-10-24T09:14:02Z,coolify,192.0.2.10,HR,publickey,07:40,your address,no
Questions
No. Stenvakt sends short shell scripts over SSH, reads what it needs and leaves nothing running. You can read every script in Preview before it runs.
Risky changes run in safe mode: a snapshot, a rollback timer on the server, a fresh connection test, then you confirm. If it never hears back, the server undoes the change itself.
Nowhere. The server list, keys and logs stay on your Mac, and there is no account. Country lookups use a database on your Mac, so addresses are never sent anywhere.
Yes, through MCP. Agents propose and you approve in the app. Test servers can opt in to auto-approval, and agents can never turn safe mode off.
Mark them as shared. Stenvakt never changes SSH access on a shared server, so other people's logins keep working.
Linux servers you can reach over SSH, built and tested on Ubuntu 24.04. The app needs macOS 14 or newer. There is no Windows version yet.
Sleep throughthe night.
Stenvakt isn't out yet. Leave your email and I'll write when the first build is ready.