Epeaky host

io.github.zyn-ioPublished by GitHub account zyn-iov0.1.1Updated Oct 25, 2026

Set up and run an Epeaky den on a server you already have, over your own SSH.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

An MCP server that sets up and runs an Epeaky den on a server you already own, driving it over your own SSH connection.

What you can do
Check a server's readiness: system, memory, disk, sudo, ports 80/443, Docker, domain resolution, NAT and firewall, reported as fine or to fix. Install the den: Docker if missing, the den and Caddy under /opt/epeaky, a certificate, firewall ports, returning the first invite. Inspect the den: owner, members, join requests, invites and recent log lines. Manage membership: set the owner device, create one-use invites, withdraw invites, approve or decline join requests. Change settings in the den's environment file and restart, or update to the latest Epeaky.
When to use it
Use it when you already have a server reachable by SSH and want an assistant to check it, install an Epeaky den on it, and handle invites, join requests and settings without manual shell work.
Requirements
Runs locally via npx, so Node 22 or later is needed. Your SSH key must already reach the target server without a password. The EPEAKY_HOST_SSH environment variable can point at a different ssh binary; otherwise ssh on PATH is used. Network access to the server and a public resolver is needed.
Before you install
Most tools change the server: install, owner change, invites, withdraw, approve/decline, settings and update. The README says this server has root on the den's server, unlike the separate epeaky-mcp agent, so grant it knowingly. It accepts a server's host key on first contact. It holds no keys itself and never creates or buys servers, and it does not handle passwords: if sudo asks for one, it returns the command for you to run.

Installation

In SourceWeft

  1. Open Epeaky host in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

epeaky-host-mcp

Set up and run an Epeaky den on a server you already have, from any MCP client (Claude Desktop, Claude Code, others). It works over your own SSH: it holds no keys, keeps nothing, and never creates, rents or buys a server.

sh
claude mcp add epeaky-host -- npx -y epeaky-host-mcp

or, in any MCP client's config:

json
{ "command": "npx", "args": ["-y", "epeaky-host-mcp"] }

Your SSH key must already reach the server (ssh user@server works without a password). Node 22 or later.

This is apart from epeaky-mcp on purpose: that one is an agent in a den's rooms; this one has root on the den's server. Give each to an agent knowingly.

Tools

ToolChanges the serverWhat it does
host_checknothe system, memory, disk, sudo, ports 80/443, Docker, whether the domain points at the server (from a public resolver), NAT and the firewall, as what is fine and what to fix
host_installyesDocker if missing, the den and Caddy in /opt/epeaky, a certificate, the firewall's ports; returns the first invite
host_statusnoowner, members, requests to join, invites
host_logsnothe den's last log lines
host_owneryesmake a device (m-…, as its page shows it) the owner
host_inviteyesone-use invite links
host_withdrawyeswithdraw an invite and the pass it let in
host_approve, host_declineyesanswer a request to join
host_settingyeschange a known setting in /opt/epeaky/.env (backed up first), then restart
host_updateyesthe latest Epeaky

Tools that change the server are marked so (readOnlyHint: false), so your client asks you before each call. Invite links come back with an instruction to show them only to you.

What keeps it safe

  • Every value is checked to a strict shape before it reaches ssh: the server (user@host), the domain, ids (hex), device names, counts, and each setting by its own rule. ssh hands its command to the server's shell as one string, so this check, not argument lists, is what keeps a value from becoming a command; values are single-quoted as well.
  • Only these settings: DEN_ENTRY, DEN_ROOMS, DEN_DONATE, DEN_DONATE_LABEL, DEN_ISSUER_LABEL, DEN_SCREEN, DEN_SCREEN_BITRATE, DEN_RETENTION_DAYS, DEN_LIMITS, DEN_PUBLIC_IP. Secrets and the domain are never touched.
  • No passwords. If sudo asks for one, the tool returns the exact command for you to run yourself.
  • ssh runs in batch mode and accepts a server's host key the first time it sees it (StrictHostKeyChecking=accept-new), as a first manual ssh would after you said yes; a changed key is refused.

EPEAKY_HOST_SSH points at another ssh.

Tests

sh
npm test

They check the tool list (nothing makes a server; what changes is marked), that bad values never reach ssh, the commands each tool runs, the settings rules, the check's report, and that every epeaky command and setting used exists in the installer and the den.

Source: agents/host-mcp/README.md at commit 7afc78a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestOct 17, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts