kastell

Server security auditing, hardening, and fleet management. 457 security checks across 30 categories (SSH, Firewall, Docker, TLS, HTTP Headers), CIS/PCI-DSS/HIPAA compliance mapping, 24-step production hardening, and 13 MCP tools. Supports Hetzner, DigitalOcean, Vultr, and Linode with Coolify, Dokploy, and bare VPS modes. Install: claude plugins add kastell

Kastell CLI patterns, architecture, anti-patterns, and decision trees. Use automatically when working in Kastell codebase or when asked about Kastell server infrastructure, security audit, hardening, lock, provision, or provider management.

Read-only Kastell codebase exploration. Use when tracing a bug across files, mapping callsites before refactoring, or exploring unfamiliar subsystems. Runs in isolated context with Explore agent.

Generate new Kastell components from templates. Creates boilerplate for CLI commands, audit checks, providers, and MCP tools following current architecture (commands thin, core fat, adapters dispatch).

Safety guard for destructive Kastell operations. Intercepts destroy and restore commands and requires explicit confirmation before proceeding.