🛡️ Secure Deployer

Let AI manage your servers — secure remote command execution & management platform

English | 简体中文

---

What is this?

Secure Deployer bridges the gap between AI applications and your servers. A lightweight Agent runs on each remote server; a local Client provides a unified dashboard to manage all servers from one place.

Problems it solves:

• AI applications refuse to handle server credentials → Agent provides a secure HTTP API for AI to operate your server
• Managing multiple servers is painful → One dashboard to rule them all
• Worried about AI messing up your server → Default approval mode requires your explicit approval for every command
• Non-technical users can't understand shell commands → AI must provide a natural language explanation for every command

Architecture

┌────────────────────────────────────────────────────────┐
│  Your Machine (Local Client)                           │
│  ┌──────────┐ ┌─────────────────────────────────────┐  │
│  │Dashboard │ │ Local API   /local/*                 │  │
│  │(React)   │→│ • Server CRUD • Approval proxy      │  │
│  │:9877     │ │ • SSE aggregation • Skill generation │  │
│  └──────────┘ └──────┬────────────────┬──────────────┘  │
└──────────────────────┼────────────────┼─────────────────┘
                       │ HTTP           │ HTTP
          ┌────────────▼──┐    ┌───────▼────────┐
          │ Remote Agent A │    │ Remote Agent B  │
          │ :9876          │    │ :9876           │
          │ /api/* (AI)    │    │ /api/* (AI)     │
          │ /manage/*      │    │ /manage/*       │
          └────────────────┘    └─────────────────┘

• Agent (remote servers): Lightweight process. Executes commands, manages files, monitors system. Two API layers: /api/* for AI (API Key), /manage/* for the Client (Management Secret).
• Client (your machine): Dashboard + aggregation layer. Manages multiple agents, proxies approval/history/alerts, generates a unified Skill document.

Key Features

🔒 Security First

• Default approval mode: every AI command requires manual approval
• AI must describe the purpose and risks of every command in natural language
• Dangerous commands are automatically blocked with real-time alerts
• Dual-key isolation: API Key for AI, Management Secret for the Client

⚡ Multi-Server Management

• Add/remove servers from one dashboard
• Server health monitoring at a glance
• Unified Skill document covers all servers and projects
• Seamless server switching

🛠️ Full Featured

• Command execution with streaming output
• Non-blocking approval: long-running commands (npm install, builds, etc.) run in background
• File browser with inline editor
• System monitoring (CPU / memory / disk)
• Operation history with visual statistics
• Web terminal for manual commands

🌐 User Friendly

• Web-based visual management dashboard
• Bilingual interface (English / 中文)
• Simple CLI for both Agent and Client

Branches

Branch	Version	Description
workgroup (default)	v2.x	Current — Client-Agent architecture, multi-server management
standalone	v1.x	Legacy — monolithic single-machine version (maintained for compatibility only)

All new development happens on workgroup. git clone pulls this branch by default.

Quick Start

Prerequisites: Node.js 18 or newer (recommended: 20 LTS) on both the remote server (for Agent) and your local machine (for Client). Check with node --version.

Do not use sudo apt install npm / sudo apt install nodejs on Ubuntu — the system packages are usually too old and will fail to run this project.

Install Node.js 20 LTS with nvm (recommended)

# Install nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
source ~/.bashrc   # or: source ~/.nvm/nvm.sh

# Install and use Node.js 20 LTS
nvm install 20
nvm use 20
nvm alias default 20

# Verify
node --version   # should show v20.x.x
npm --version

Note: Ubuntu 18.04 and older may hit GLIBC_2.28 not found with official Node binaries. Use Ubuntu 20.04+ (recommended), or install from unofficial-builds built against glibc 2.17.

1. Install Agent on each remote server

git clone https://github.com/chasedai/secure-deployer.git
cd secure-deployer
npm install
npm run start:agent

On first run, the Agent prints credentials:

  ★ First run — save these credentials!
  API Key:            sk-xxxxxxxx...
  Management Secret:  ms-xxxxxxxx...

Save both values — you'll need them to connect from the Client.

Tip: For production, run the Agent under pm2 so it survives reboots:

npm install -g pm2                                           # install pm2 (first time only)
pm2 start agent/bin/cli.mjs --name secure-deployer-agent
pm2 save && pm2 startup                                      # follow the printed instruction

Useful commands: pm2 logs secure-deployer-agent, pm2 restart secure-deployer-agent, pm2 stop secure-deployer-agent.

2. Run Client on your machine

npm install
npm run build   # Build the dashboard
npm start       # Start the client on port 9877

3. Connect

1. Open http://localhost:9877 and set an admin password
2. Go to Server Management → Add Server
3. Enter the server address and credentials from step 1
4. That's it! All features are now available for this server

4. Generate Skill & connect AI

1. Go to Skill Gen → click Generate
2. Download the SKILL.md file
3. Provide it to your AI application (Cursor, openClaw, Claude, etc.)
4. AI calls the API according to the document; you approve commands in the dashboard

The generated Skill covers all your registered servers and includes explicit guidance for AI to use non-interactive flags (-y, --non-interactive, etc.) and proper timeout values for long-running commands like npm install or build.

CLI Reference

Agent

npm run start:agent                      # Start agent (default)
node agent/bin/cli.mjs credentials       # Show API Key & Management Secret
node agent/bin/cli.mjs rotate-keys       # Generate new credentials
node agent/bin/cli.mjs --port 8080       # Custom port
node agent/bin/cli.mjs --help            # Help

Client

npm start                                # Start client (default: port 9877)
node client/bin/cli.mjs --port 3000      # Custom port
node client/bin/cli.mjs --help           # Help

Two Execution Modes

	Approval Mode (Default)	Auto-execute Mode
Security	AI commands require manual approval	Commands execute immediately
Best for	Getting started, less trust in AI	Familiar workflow, trusted AI
Switch via	Dashboard → Settings	Dashboard → Settings

Configuration

Agent config: ~/.secure-deployer/config.json

{
  "apiPort": 9876,
  "executionMode": "approval",
  "commandBlacklist": ["rm -rf /", "shutdown", "reboot"],
  "rateLimit": { "windowMs": 60000, "max": 60 }
}

Client config: ~/.secure-deployer/client-config.json

{
  "dashPort": 9877,
  "servers": [
    { "name": "prod", "host": "10.0.1.5", "port": 9876, "managementSecret": "ms-..." }
  ]
}

Tech Stack

• Backend: Node.js + Express
• Frontend: React + TypeScript + Vite + TailwindCSS

Security Recommendations

1. Use a strong dashboard password
2. Restrict Agent port access with a firewall — only allow your Client IP
3. Start with approval mode; switch to auto-execute after gaining confidence
4. Review operation history regularly
5. Rotate keys periodically with agent rotate-keys

Author

Chase Dai — GitHub · Email

License

CC BY-NC 4.0 — Free to use and modify with attribution. Not for commercial use.