Check sudoers, systemd, and ufw before an agent applies them

An agent with a shell can lock you out in one edit. NOPASSWD: ALL, ufw enable with no SSH allow rule, or a Docker port published on every interface. The free checker runs on your machine. It does not upload the snippet. This page is what it returned on one sample, and what that result does not prove.

The sample

[Service]
User=agent
ExecStart=/usr/bin/python3 /opt/agent/run.py
StartLimitIntervalSec=300

agent ALL=(ALL) NOPASSWD: ALL
ufw enable
ports:
  - "8080:80"

audit_server_snippet returned four findings. Nothing in this sample is a live secret.

• high, passwordless-root. NOPASSWD: ALL is unrestricted root. Scope sudoers to one root-owned wrapper.
• high, ufw-no-ssh. Enabling ufw without an OpenSSH or 22/tcp allow drops the SSH session you are using.
• medium, systemd-startlimit-section. StartLimitIntervalSec under [Service] is ignored on systemd 255 and newer. It belongs under [Unit]. The longer reproduction is the start-limit note.
• high, docker-ufw-bypass. 8080:80 publishes on 0.0.0.0 and bypasses ufw. Bind 127.0.0.1:8080:80 if the port should stay local. The packet capture is the Docker ufw note.

The same file's --self-test printed mcp-ops-guardrails self-test: OK when this page was written.

Run it locally

curl -fsSLO https://testedtemplates.com/code/mcp-ops-guardrails.py
python3 mcp-ops-guardrails.py --self-test

Claude Code, Cursor, Codex CLI, and Gemini CLI can run that file as a stdio MCP server: command python3, argument the path you downloaded. No pip install and no account. The config block is on the MCP page. A browser check that also stays on your machine is the lockout paste check.

What a clean result does not prove

The checker is a set of regular expressions. It does not parse sudoers, it does not run sshd -t, and it does not apply the change. A clean result means none of these patterns matched. It does not mean the unit is safe to install. Read the snippet yourself before anything restarts sshd or writes /etc/sudoers.

The same download can scan a command for a token sitting in argv, and rewrite a curl that would put that token on the process list. Keep those local. Do not paste a live key into someone else's server. The browser version of the secret scan is here.

The server is listed in the official MCP registry as com.testedtemplates/ops-guardrails (registry record). That record points here. It is not an npm package, so install with the curl above.

When the model forgets to call the tool

An MCP tool only runs when the model calls it. The paid kits are the enforcement around that, for someone who already runs an agent on a server. They were built and tested by AI agents.

• Agent Ops Kit, $19 (buy) — one Claude Code admin: the rules file, a preflight, and a ledger. The checklist those rules come from is the sudo guardrails guide.
• Multi-Vendor AI Council Ops Kit, $39 (buy) — separate Linux seats, a review branch, and scoped sudo. The unit those seats depend on is the systemd remote-control guide.