Packageactivev0.1.0b5

io.github.DustinTrap/kvm-pilot

AI-agent control of physical machines via IP-KVM, Redfish BMC, and SSH: gated, verified, audited.

Auth

API key

Data

Handles secrets

License

Apache-2.0

Unknown facts are omitted here and listed as pending in the profile.

Trust verdict

No blockers found

No blockers found across the assessed dimensions.

assessed on 3 of 4 dimensions · 1 not applicable

MaintenanceActively maintained — last activity 1 days ago.GitHub · as of Jul 14, 2026
Pass
ProvenanceOrigin linked to a public source repository.Official MCP Registry · as of Jul 13, 2026
Pass
Supply chainNo known vulnerabilities in scanned package dependencies (OSV).OSV (Google Open Source Vulnerabilities) · as of Jul 14, 2026
Pass
Manifest integrity

Profile

What this server is — descriptive, not a rating. The verdict above judges it; this describes it.

Classification

CapabilityPending — classifier not yet run

IndustryPending — classifier not yet run

Exposure

Side effectsPending — tools not yet classified

Auth modelAPI keymcp_registry

Data surfaceHandles secretsmcp_registry

Geography

Hosting

Tool surface

Not yet probed — this server's live tool surface hasn't been captured yet, so its tools and measurements aren't available.

Adoption

No adoption signal captured yet for this package.

Connect

pypi package · v0.1.0b5 · stdio

uvx kvm-pilot

KVM_PILOT_PROFILE
Profile name from ~/.config/kvm-pilot/config.toml naming the KVM/BMC to target
KVM_PILOT_MCP_READ_ONLY
Least-privilege posture: only read-only tools are registered; effect gates force-closed. Recommended for first contact (set to 1)
KVM_PILOT_MCP_DRY_RUN
Rehearsal posture: destructive calls are logged, never sent (set to 1)
KVM_PILOT_MCP_ALLOW_POWER
Operator opt-in enabling power control of the managed host (per-effect gate; see also _ALLOW_HID, _ALLOW_MEDIA, _ALLOW_SSH, _ALLOW_APPLIANCE, _ALLOW_EXTERNAL_WRITE)
KVM_PILOT_PASSWDsecret
Device password when not using a config-file profile (KVM_PILOT_HOST / KVM_PILOT_USER accompany it)
ANTHROPIC_API_KEYsecret
Optional: enables server-side vision for classify_screen / wait_for_state; without it, classification falls back to the calling agent

Sources

Every verdict and label is attributable to its source and recomputed from our own landed copy, never read live on this page.