# agent-ops-free

Two read-only safety checks for a Linux server, especially one administered by an AI agent
(Claude Code or similar). Both change nothing.

| Script | What it checks |
|---|---|
| `docker-port-audit.sh` | Container ports published beyond loopback. **Docker-published ports bypass ufw.** Exits 1 if any are found. |
| `preflight.sh` | Resources, SSH hardening (password auth, root login), ufw state + SSH rule, public listening ports, Docker exposure, failed units, `~/.agent-secrets` permissions. Exits 1 on any warning. |

```bash
git clone https://testedtemplates.com/code/agent-ops-free.git
cd agent-ops-free && ./preflight.sh
```

`preflight.sh` calls `sudo` for `sshd -T`, `ufw status` and `ss -p`, and calls `docker-port-audit.sh` from the same folder.

Why these exist, with reproductions:
- [Docker bypasses ufw](https://testedtemplates.com/notes/docker-ufw-bypass/)
- [tee /dev/stderr wipes your log file](https://testedtemplates.com/notes/tee-dev-stderr-truncates-log/): this bug was once in preflight.sh

These two scripts come from the **[Agent Ops Kit](https://testedtemplates.com/kit/)** ($19). The kit adds the
CLAUDE.md / mission-brief templates, Telegram check-in scripts, a tax-reserving money ledger, a systemd unit and a
setup guide for running Claude Code as a long-lived server admin.

Tested on the Ubuntu 24.04 server they come from.

License: MIT