SysKnife

Describe what you want in plain language.Review a typed plan with risk levels. Approve explicitly. Watch it execute with live output. Atomic-host changes (rpm-ostree) roll back automatically on failure. Every action is Ed25519-signed and audited.

The AI never supplies a command. Every action is atyped operationwith a formal risk level, and the daemon builds the command line itself from the action's own definition — some actions do run throughsh -c, but the shell fragment is constructed by SysKnife, never by the model. The AI cannot touch your system directly. A privileged daemon executes only what you approve, writes a tamper-evident Ed25519-signed audit chain, and rolls back atomic-host (rpm-ostree) changes automatically on failure.

The fastest path is the setup wizard. It installs the daemon and wires SysKnife into your AI IDE — Claude Code, Cursor, or Codex CLI — so you can plan and execute from chat.

NeedsNode 18 or newer. On Ubuntu 22.04apt install nodejsgives Node 12, which is too old; the installer says so and how to get a current Node. No Rust toolchain and no compile: it downloads verified prebuilt binaries.
-

Downloads the prebuiltsysknife+sysknife-daemonbinariesfor your architecture (x86_64 / aarch64) from GitHub Releases,SHA-256-verifieseach against the release checksum file — a mismatch aborts the install — and places them in~/.local/bin(no sudo). Pass--no-binaryto skip the download and build from source instead.

Asks for yourLLM provider, key, and model— OpenAI / Anthropic / Gemini / Ollama / Groq / DeepSeek / Mistral / xAI (Ollama needs no key). The key prompt is skipped when the matching env var is already set.

Askswhich AI integrationto wire up (or pick--claude/--cursor/--codex/--all) and yourdaemon target(s)— socket, plus an optional vsock token for a remote VM.

Writes the integration-specific MCP config(merging into any existing file, never clobbering) so the next chat session sees thesysknife_tools —sysknife_plan,sysknife_execute,sysknife_history,sysknife_doctor,sysknife_audit_verify— as first-class tools.

Installs and starts the daemon as a service(last step) — a systemduser*service by default (no sudo; kept alive across logout via linger). That service runs as you, so read-only actions work butmutating ones do not: installing packages or restarting services needs the system-level service, whose sudoers grants belong to thesysknifesystem user. Pick the system service on any host where you intend to change something, and pass--daemon-mode=system|user|skipto choose without a prompt.--daemon-mode=systemdoes not install the system service from the wizard — it needs root-owned sudoers, polkit and helper policy thatsudo make installowns — so it prints the exact sequence and reports the daemon as not yet installed.

Then in your chat: ask for what you want and review the plan with risk pills. Approve each transaction withsysknife approve <transaction-id>in a terminal, return the one-time receipts, and watch it execute. The daemon, not the prompt, enforces the receipt boundary.