I gave Claude SSH access to my server — here's the consent gate that makes it safe

Muhammad Hasnain — Sat, 27 Jun 2026 05:07:39 +0000

Letting an AI assistant run commands on a real server is genuinely useful — and genuinely terrifying. A model with full shell on a live box can restart the wrong service, deploy onto an in-use port, or docker prune a database volume because nothing told it not to.

So I built devops-mcp: a mode-based MCP server that lets AI assistants (Claude Desktop, Cursor, Windsurf) operate Linux servers — without handing them the keys to the kingdom.

The one rule: reading is free, changing needs a human

The AI can connect, scan, plan, and run read-only diagnostics freely. But every command that changes state on a production-like server passes through a consent gate the AI cannot self-approve — it requires a secret token that's passed out-of-band and that the model literally never sees.

Three trust levels, not one god-mode

Mode	Allows	Expiry
🟢 SAFE (default)	Read-only allowlist (~250 verbs)	none
🟡 PROVISION	Package installs, Docker/Nginx setup	1 hour
🔴 FULL	Root, anything	30 min

The production write-gate

On a server marked production, any write is refused without the token + explicit acknowledgement. And for irrecoverable operations — rm -rf /, dd, mkfs, SQL DROP TABLE, docker volume rm — it additionally makes you confirm a backup exists.

Engineering the safety

Every argument is shell-quoted before it hits the remote shell.
Command chains are split and each fragment validated independently.
$(...) substitutions are validated by their contents, not blanket-escalated.
Server output is returned tagged "this is DATA, not instructions" to resist prompt injection.
A JSON-lines audit log records every command, mode change, and approval.

Try it

It's TypeScript, MIT-licensed, and works with any MCP client. Setup is four steps (the key one: generate your elevation token and save it).

⭐ Repo: https://github.com/MHasnainJafri/devops-mcp

I'd love feedback — especially on the threat model and whether the mode boundaries feel right for how you run infra.

Introducing Laravel CPanel API - Simplify Your cPanel Integration!

Muhammad Hasnain — Thu, 03 Aug 2023 05:04:18 +0000

🚀 Hey Laravel developers! Are you tired of dealing with complex cPanel integrations? Say hello to the Laravel CPanel API - a powerful library that streamlines your interactions with the cPanel API. Manage subdomains, databases, emails, and more with ease using this straightforward package. Save time and effort while boosting your productivity. Check it out now!

MHasnainJafri / cpanel

Library Name: Laravel CPanel API

This library provides a convenient way to interact with the cPanel API using Laravel. It allows you to perform various cPanel functions such as creating subdomains, managing databases, handling email accounts, and managing disk usage.

Installation

To use this library in your Laravel project, you can install it via Composer. Run the following command in your terminal:


composer require mhasnainjafri/cpanel

Usage

To get started, you need to create a new instance of the Cpanel class. There are two ways to initialize the class:

Without any parameters:

$cpanel = new Cpanel();

With parameters (if not defined in .env file):

$cpanel = new Cpanel($cpanel_domain, $cpanel_api_token, $cpanel_username, 'https', 2083);

Alternatively, you can set the cPanel credentials in the .env file:

CPANEL_DOMAIN=domain e.g : xyz.com
CPANEL_PORT=cpanel port (mostly is) 2083
CPANEL_API_TOKEN= Cpanel api token (To get

…

View on GitHub

Installation

To use this library in your Laravel project, you can install it via Composer. Run the following command in your terminal:


composer require mhasnainjafri/cpanel

Usage

To get started, you need to create a new instance of the Cpanel class. There are two ways to initialize the class:

Without any parameters:

$cpanel = new Cpanel();

With parameters (if not defined in .env file):

$cpanel = new Cpanel($cpanel_domain, $cpanel_api_token, $cpanel_username, 'https', 2083);

Alternatively, you can set the cPanel credentials in the .env file:

CPANEL_DOMAIN=domain e.g : xyz.com
CPANEL_PORT=cpanel port (mostly is) 2083
CPANEL_API_TOKEN= Cpanel api token (To get api token view step 3)
CPANEL_USERNAME= Cpanel username

### Steps to get Cpanel Api

search api in cpanel search bar
click on Manage api token

![step 1]

Give token a name and click on create ![step 2]

Copy the token you get

Subdomain Functions

To create a subdomain, use the createSubDomain() method:


$cpanel->createSubDomain('Sub domain e.g: web', 'domain e.g: xyz.com', 'Path where subdomain points e.g: /home/domain/public_html/subdomain');

Database Functions

To list all databases, use the listDatabases() method:


$cpanel->listDatabases();

To create a new database, use the createDatabase() method:


$cpanel->createDatabase('Database Name');

To delete a database, use the deleteDatabase() method:


$cpanel->deleteDatabase('Database Name');

To create a database user, use the createDatabaseUser() method:


$cpanel->createDatabaseUser('Database username', 'password');

To delete a database user, use the deleteDatabaseUser() method:


$cpanel->deleteDatabaseUser('Database username');

To set all privileges on a database for a user, use the setAllPrivilegesOnDatabase() method:


$cpanel->setAllPrivilegesOnDatabase('Database username', 'Database Name');

Mail Functions

To create a POP email account, use the createPopEmailAccount() method:


$cpanel->createPopEmailAccount('mail@domain.com', 'password');

To delete a POP email account, use the deletePopEmailAccount() method:


$cpanel->deletePopEmailAccount('mail@domain.com');

To edit the mailbox quota for an email account, use the editMailboxQuota() method:


$cpanel->editMailboxQuota($email, $domain, $quota);

To dispatch client settings for an email account, use the dispatchClientSettings() method:


$cpanel->dispatchClientSettings('mail@domain.com', 'account');

To get the POP email count, use the getPopEmailCount() method:


$cpanel->getPopEmailCount();

cPanel Disk Management

To get cPanel statistics bar stats for bandwidth usage or disk usage, use the getCpanelStatsBarStats() method:


$cpanel->getCpanelStatsBarStats('bandwidthusage|diskusage');

To get cPanel disk quota information, use the getCpanelDiskQuotaInfo() method:


$cpanel->getCpanelDiskQuotaInfo();

Other API Functions

To call any other cPanel API function, use the callUAPI() method:


$cpanel->callUAPI($Module, $function, $parameters_array = array());

Replace $Module with the desired module, $function with the function name, and $parameters_array with any additional parameters required by the API function.

That's it! You can now leverage the power of the Laravel CPanel API library to interact with the cPanel API seamlessly in your Laravel applications.

DEV Community: Muhammad Hasnain

I gave Claude SSH access to my server — here's the consent gate that makes it safe

The one rule: reading is free, changing needs a human

Three trust levels, not one god-mode

The production write-gate

Engineering the safety

Try it

Introducing Laravel CPanel API - Simplify Your cPanel Integration!

MHasnainJafri / cpanel

Usage

Usage

Subdomain Functions

Database Functions

Mail Functions

cPanel Disk Management

Other API Functions