Waxbix AI Scerti

Read-only VPS security agent — auto-discovers projects, checks system health, audits security, monitors SSL, analyzes logs, and sends Telegram reports in Arabic.

Features

| Capability | Description | |------------|-------------| | Project Discovery | Auto-scan /var/www/ — detects Node.js, Laravel, Python, static projects | | System Health | CPU, RAM, Disk, Uptime with configurable thresholds | | Service Monitor | systemd + PM2 process checks | | Security Audit | Fail2ban stats, open ports, Lynis hardening index | | Deep Security Scan | .env permissions, git secrets leak, npm audit, Redis auth, firewall status, system updates | | Health Check | HTTP curl to all discovered ports and domains | | SSL Monitoring | Certificate expiry tracking for all domains | | Log Analysis | Reads all project logs + PM2 logs + systemd journal + auth logs | | AI Analysis | Multi-provider agent (Groq primary → GLM/z.ai fallback) | | Telegram Reports | Formatted Arabic reports with risk levels and recommendations |

Architecture

agent/
├── index.ts              # Entry point + cron scheduler
├── orchestrator.ts       # Multi-stage analysis pipeline
├── config.ts             # Environment configuration
├── mcp-client.ts         # Tool registry
├── tools/                # MCP tools (9 tools)
│   ├── discover.ts       # Project auto-discovery
│   ├── system.ts         # CPU/RAM/Disk
│   ├── services.ts       # systemd + PM2
│   ├── security.ts       # Fail2ban, ports, Lynis
│   ├── deep-security.ts  # .env, git, npm, Redis, firewall
│   ├── health.ts         # HTTP health check
│   ├── ssl.ts            # SSL certificates
│   ├── logs.ts           # Log reading
│   └── telegram.ts       # Telegram sender
├── llm/
│   ├── provider.ts       # OpenAI-compatible API client
│   ├── router.ts         # Intelligent model routing
│   └── prompts.ts        # System prompts
└── skills/               # Agent skills (.skill.md)

AI Model Routing

The agent accepts any OpenAI-compatible provider. Defaults:

| Task | Provider | Model | |------|----------|-------| | Agent loop & quick analysis | Groq | llama-3.3-70b-versatile | | Deep security analysis | Groq | llama-3.3-70b-versatile | | Fallback (last resort) | GLM / z.ai | glm-4.7-flash |

Automatic fallback chain: primary → deep-analysis → fallback → built-in heuristic. Rate limits (429) are handled with exponential backoff + jitter, honouring the provider's retry-after header, capped to avoid endless loops.

Quick Start

Available on npm: waxbix-ai-scerti

Install & run (recommended)

# Install globally (or use npx directly without installing)
npm i -g waxbix-ai-scerti

# Configure
cp "$(npm root -g)/waxbix-ai-scerti/.env.example" .env
# OR copy the bundled example to your working directory
npx waxbix-ai-scerti --help   # print available options

# Run once (dry-run)
waxbix-ai-scerti --dry-run
# or without installing
npx waxbix-ai-scerti --dry-run

Keep .env in the folder you run the agent from, or set the variables in the environment / GUARDIAN_ENV_FILE path (see .env.example).

Download the direct tarball

wget https://registry.npmjs.org/waxbix-ai-scerti/-/waxbix-ai-scerti-1.0.1.tgz
tar -xzf waxbix-ai-scerti-1.0.0.tgz
cd package
npm install
npm run build

Run from source

# 1. Clone & install
git clone https://github.com/your-username/waxbix-ai-scerti.git
cd waxbix-ai-scerti
npm install

# 2. Configure
cp .env.example .env
# Edit .env with your API keys

# 3. Run once (dry-run)
npx tsx agent/index.ts --dry-run

# 4. Deploy with Docker
cd docker
docker compose up -d

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | GROQ_API_KEY | Yes* | Primary AI provider (Groq) — or swap AI_PROVIDER | | ZAI_API_KEY | No | Fallback provider (GLM / z.ai) key | | BRAVE_API_KEY | No | Live CVE web-search | | TELEGRAM_BOT_TOKEN | Yes | Telegram notifications | | TELEGRAM_CHAT_ID | Yes | Telegram target chat |

*All providers are OpenAI-compatible and interchangeable; set at least one key.

Security

• Read-only: Never modifies files or system state
• Docker: read_only: true, cap_drop: ALL, non-root user
• All commands: Only cat, tail, curl -s, ss, openssl, systemctl is-active — inspection only

Support

• Developer: waxbix.com
• Donate via PayPal: [email protected]

License

MIT — see LICENSE