AETHER_02 — Full-Spectrum Linux MCP Server

Rust | MIT | MCP stdio

12 tools. 99.9% Linux coverage. Zero compromises.

AETHER_02 is an MCP (Model Context Protocol) server written in Rust that gives AI assistants full control over Linux via standard input/output. From process management to GUI automation, from kernel security audit to hardware control — everything a system administrator needs.

Separate repository from AETHER_01 (Windows). Same philosophy, different OS.

---

Tool Coverage

#	Tool	Actions
1	process_control	list, tree, kill, signal, create, set_priority, set_nice, query_info, threads, set_affinity, memory_info, memory_limits, fd_list, fd_info, limits, environ, suspend, resume, cgroup_list, cgroup_info, cgroup_create, cgroup_delete, cgroup_set_limit, cgroup_move, namespace_list, namespace_enter*, oom_score, oom_kill, seccomp_info, ptrace_attach*, ptrace_detach*, container_list, container_info, container_start, container_stop, container_logs, container_exec, perf_top, perf_stat
2	file_system	read, write, append, delete, copy, move, rename, list_dir, stat, statvfs, mkdir, exists, acl_get, acl_set, xattr_list, xattr_get, xattr_set, xattr_delete, symlink_read, symlink_create, symlink_delete, chmod, chown, truncate, mount_list, mount, umount, remount, bind_mount, tmpfs_mount, disk_list, disk_info, part_list, part_create*, part_delete*, part_resize*, mdraid_list, mdraid_info, mdraid_create*, lvm_pvs, lvm_vgs, lvm_lvs, lvm_create*, swap_list, swap_on, swap_off, swap_create*, fsck_check*, fsck_repair*, nfs_list, nfs_mount, inotify_watch, inotify_read, btrfs_subvol_list, btrfs_snapshot, zfs_list, zfs_snapshot, overlay_mount
3	package_manager	list_installed, list_upgradable, search, info, install*, remove*, upgrade*, upgrade_all*, hold, unhold, list_repos, add_repo*, remove_repo*, clean_cache, history, verify, download, flatpak_list, flatpak_install*, flatpak_remove*, snap_list, snap_install*, snap_remove*, appimage_list, nix_list, nix_install*, nix_remove*
4	system_config	sysctl_list, sysctl_get, sysctl_set*, sysctl_load*, kernel_cmdline_get, kernel_cmdline_set*, modprobe_list, modprobe_load*, modprobe_unload*, modprobe_blacklist, dracut_rebuild*, dconf_list, dconf_get, dconf_set, gsettings_list, gsettings_get, gsettings_set, limits_get, limits_set*, hostname_get, hostname_set*, timezone_list, timezone_get, timezone_set*, locale_list, locale_get, locale_set*, keyboard_layout, etc_config_read, etc_config_write*, udev_info, udev_rules_list, udev_trigger, environment_list, environment_set*, os_release
5	service_manager	list, list_units, list_unit_files, status, start*, stop*, restart*, reload, enable*, disable*, mask, unmask, cat, edit*, show, list_dependencies, list_timers, list_sockets, list_paths, list_mounts, isolate*, default, rescue*, emergency*, daemon_reload, reset_failed, user_services, analyze + OpenRC + runit + s6
6	gui_automation	mouse_move, mouse_click, mouse_scroll, mouse_position, mouse_drag, keyboard_type, keyboard_press, keyboard_combo, keyboard_state, find_window, list_windows, set_window_pos, set_window_size, focus_window, get_window_rect, get_window_title, get_window_class, close_window, minimize_window, maximize_window, screenshot, screenshot_window, clipboard_read, clipboard_write, clipboard_clear, display_list, display_info, display_mode_set, display_scale, display_rotation, display_brightness_get, display_brightness_set, display_night_light, display_color_profile, compositor_info, audio_list_sinks, audio_list_sources, audio_volume_get, audio_volume_set, audio_mute, audio_default_sink, input_list_devices, input_device_info, input_remap*, notification_send, notification_history, screensaver_lock, screensaver_unlock, inhibit_idle
7	system_info	cpu_info, cpu_topology, cpu_freq, cpu_governor, cpu_vulnerabilities, cpu_microcode, cpu_cache, cpu_perf_flags, memory_info, memory_topology, memory_hugepages, memory_numa, memory_slab, disk_list, disk_info, disk_smart, disk_iostat, disk_partitions, os_info, os_release, kernel_info, kernel_modules, kernel_tainted, uptime, load_avg, env_vars, hostname, boot_time, gpu_list, gpu_info, gpu_usage, gpu_temperature, gpu_driver, pci_list, pci_info, usb_list, usb_info, dmi_bios, dmi_system, dmi_board, dmi_chassis, acpi_tables, acpi_power, edid_info, iommu_groups, irq_list, irq_affinity, sensors_list, sensors_temperature, sensors_fan, sensors_voltage, device_list, driver_list, firmware_list
8	network_manager	adapter_list, adapter_info, adapter_up*, adapter_down*, adapter_stats, adapter_speed, address_list, address_add*, address_delete*, route_list, route_add*, route_delete*, connection_list, connection_info, connection_create*, connection_modify*, connection_delete*, connection_up*, connection_down*, dns_servers, dns_cache, dns_flush, dns_set*, firewall_rules_list, firewall_rule_add*, firewall_rule_delete*, firewall_chain_list, nftables_table_list, nftables_chain_list, nftables_rule_add*, nftables_rule_delete*, wireguard_list, wireguard_info, wireguard_config*, bridge_list, bridge_create*, bridge_add_port*, bond_list, bond_create*, vlan_list, vlan_create*, network_namespace_list, network_namespace_create*, tc_qdisc_list, tc_qdisc_add*, socket_list, socket_info, wifi_list, wifi_connect*, wifi_disconnect, wifi_scan, bluetooth_list, bluetooth_info, bluetooth_connect*, bluetooth_pair*, proxy_list, proxy_set, hosts_read, hosts_write*
9	user_management	users_list, user_info, user_create*, user_delete*, user_modify*, user_password_set*, user_lock, user_unlock, groups_list, group_info, group_create*, group_delete*, group_add_user*, group_remove_user*, sessions_list, session_info, session_terminate*, current_user, whoami, id, nsswitch_conf, pam_list_modules, pam_conf_read, pam_conf_write*, polkit_list, polkit_info, sudoers_read, sudoers_write*, sudoers_list_users, ssh_authorized_keys_list, ssh_authorized_keys_add*, ssh_authorized_keys_remove*, faillock_list, faillock_reset, subuid_list, subgid_list, acl_users, last_logins, loginctl_list, loginctl_user_status
10	security_audit	selinux_status, selinux_mode, selinux_set_mode*, selinux_booleans, selinux_policy, selinux_context_list, selinux_set_context*, apparmor_status, apparmor_profiles, apparmor_set_mode*, auditd_status, auditd_rules_list, auditd_rule_add*, auditd_rule_delete*, firewall_status, firewall_profile, tpm2_info, tpm2_pcrs, tpm2_quote, secure_boot_status, ima_status, ima_policy, evm_status, fapolicyd_status, lockdown_status, kernel_lsms, kernel_mitigations, kernel_hardening, aslr_status, mmap_min_addr, kptr_restrict, dmesg_restrict, ptrace_scope, core_pattern, file_integrity_list, file_integrity_check, aide_check, lynis_check, cve_mitigations, uefi_variables, boot_chain
11	hardware_control	gpu_nvidia_info, gpu_nvidia_smi, gpu_nvidia_power, gpu_nvidia_fan, gpu_amdgpu_info, gpu_intel_info, gpu_vulkan_info, pci_rescan*, pci_remove*, usb_devices, usb_authorize*, usb_deauthorize*, acpi_info, acpi_wakeup, acpi_event, cpufreq_governor_list, cpufreq_governor_get, cpufreq_governor_set*, thermal_zones, thermal_temperature, thermal_cooling, cpu_microcode_version, cpu_microcode_reload*, iommu_groups, iommu_info, irq_list, irq_set_affinity*, hugepages_info, hugepages_alloc*, kdump_status, kdump_config, kdump_test*, memory_error_count
12	system_automation	journal_list, journal_query, journal_follow, journal_boot, journal_vacuum, journal_disk_usage, timer_list, timer_info, timer_enable*, timer_disable*, timer_create*, timer_delete*, cron_list, cron_user_list, cron_add*, cron_remove*, anacron_list, at_list, at_create*, at_delete*, tmpfiles_list, tmpfiles_create, tmpfiles_clean, sysusers_list, sysusers_create*, binfmt_list, binfmt_register*, modules_load_list, modules_load_add*, sysctl_d_list, sysctl_d_apply, boot_analyze, boot_chart

* = requires force: true or feature gate enabled in .env

---

Installation

Method 1: One-click shell install

curl -sSL https://raw.githubusercontent.com/foursecondfivefour/aether-linux-mcp-server/main/install.sh | bash

The script:

1. Downloads the latest binary
2. Creates .env with safe defaults
3. Registers in Cursor, Claude Desktop, Windsurf, VS Code

Method 2: Build from source

git clone https://github.com/foursecondfivefour/aether-linux-mcp-server
cd aether-linux-mcp-server
cp .env.example .env
cargo build --release
./install.sh target/release/aether-mcp-server

Manual configuration

Cursor — ~/.cursor/mcp.json:

{
  "mcpServers": {
    "aether-02": {
      "command": "/path/to/aether-mcp-server",
      "env": { "RUST_LOG": "info" }
    }
  }
}

---

Feature Gates

Gate	Env Var	Description
Kexec	AETHER_KEXEC_LOAD=0	Load new kernel via kexec
Module Load	AETHER_MODULE_LOAD=0	Load/unload kernel modules
BPF Load	AETHER_BPF_LOAD=0	Load BPF programs
Ptrace	AETHER_PTRACE_ATTACH=0	ptrace attach to non-child
Namespace Create	AETHER_NAMESPACE_CREATE=0	Creating new namespaces
Offline Mount	AETHER_OFFLINE_MOUNT=0	Mount from raw block devices
Partition Edit	AETHER_PARTITION_EDIT=0	Create/delete/resize partitions
Token Manipulation	AETHER_TOKEN_MANIPULATION=0	Capability setuid/setgid changes

---

Security

AETHER_02 follows the same security model as AETHER_01:

• stdio-only — no network, no HTTP, no TCP
• No shell injection — direct syscalls via nix/libc, CLI args as Vec<String>
• force: true — destructive operations require explicit confirmation
• Feature gates — 8 dangerous capabilities disabled by default
• Audit log to stderr — every invocation logged
• Path canonicalization
• Compiler hardening: PIE, Full RELRO, NX stack, stack protector, CET/BTI

---

Performance

• opt-level = 3 (all LLVM optimizations)
• lto = true (fat LTO)
• codegen-units = 1 (full DCE)
• panic = "abort" (no unwind)
• strip = "symbols" (minimal binary)
• target-cpu = native (AVX2, BMI2, FMA, POPCNT)

---

Project Structure

src/
├── main.rs              # tokio::main, stdio transport
├── lib.rs               # Module declarations
├── server.rs            # AetherServer + 12 tool router
├── config.rs            # FeatureGates from .env
├── error.rs             # AetherError + POSIX errno mapping
├── audit.rs             # Structured audit logging
└── tools/
    ├── process.rs       # Tool 1 — process_control
    ├── filesystem.rs    # Tool 2 — file_system
    ├── packages.rs      # Tool 3 — package_manager
    ├── sysconfig.rs     # Tool 4 — system_config
    ├── service.rs       # Tool 5 — service_manager
    ├── gui.rs           # Tool 6 — gui_automation
    ├── sysinfo.rs       # Tool 7 — system_info
    ├── network.rs       # Tool 8 — network_manager
    ├── user.rs          # Tool 9 — user_management
    ├── security.rs      # Tool 10 — security_audit
    ├── hardware.rs      # Tool 11 — hardware_control
    └── automation.rs    # Tool 12 — system_automation

---

License

MIT — see LICENSE