Dozor — AI-First Server Monitoring

MCP server for AI agents to monitor any Linux server: Docker, systemd, remote hosts.

AI-native server monitoring agent. Unlike traditional monitoring tools (Prometheus, Datadog) built for humans with dashboards, Dozor outputs are optimized for LLM consumption via Model Context Protocol.

Why Dozor?

Features

• Auto-Triage — One-call full diagnosis: health check, error analysis, disk pressure
• System Overview — Memory, disk, load, top processes in one view
• Docker Monitoring — Auto-discovers compose services, status, CPU/memory
• Systemd Services — User and system service monitoring with memory/uptime
• Remote Servers — HTTP availability, SSL expiry, systemd via SSH
• Log Analysis — Pattern matching for common errors (DB, auth, OOM, timeouts)
• System Cleanup — Scan/clean docker, go, npm, pip, journals, caches with dry-run
• Security Audit — Exposed ports, dangerous mounts, bot scanner detection
• Background Deploy — Non-blocking deploys with status tracking
• Binary Updates — Check and install updates for ~60 popular CLI tools from GitHub releases
• Command Execution — Blocklist-validated shell commands
• Dev Mode — Runtime-toggleable observe-only watch with per-service triage exclusions
• Zero Config — Auto-detects compose path and services, works out of the box

Quick Start

Install from release (recommended):

curl -L https://github.com/anatolykoptev/dozor/releases/latest/download/dozor-linux-amd64 -o dozor
chmod +x dozor
mv dozor ~/.local/bin/

Build from source:

git clone https://github.com/anatolykoptev/dozor.git
cd dozor
make install        # builds and copies to ~/.local/bin/
cp .env.example .env  # optional — works without it

MCP Configuration

Option A: Stdio over SSH (recommended for remote servers)

{
  "mcpServers": {
    "dozor": {
      "command": "ssh",
      "args": ["your-server", "dozor serve --stdio"]
    }
  }
}

Option B: HTTP (for local or network access)

{
  "mcpServers": {
    "dozor": {
      "type": "streamable-http",
      "url": "http://localhost:8765/mcp"
    }
  }
}

MCP Tools

Inspection Modes

CLI Usage

dozor serve [--port 8765] [--stdio]    # MCP server
dozor check [--json] [--services s1,s2]  # One-shot diagnostics
dozor watch [--interval 4h] [--webhook URL]  # Periodic monitoring

Configuration

All settings are optional. Dozor auto-detects Docker Compose projects and services.

# Docker (auto-detected if not set)
DOZOR_COMPOSE_PATH=~/myproject
DOZOR_SERVICES=web,api,postgres

# Systemd services to monitor
DOZOR_SYSTEMD_SERVICES=nginx,myapp

# Remote server monitoring
[email protected]
DOZOR_REMOTE_URL=https://example.com
DOZOR_REMOTE_SERVICES=nginx,php-fpm

# Alert thresholds
DOZOR_CPU_THRESHOLD=90
DOZOR_MEMORY_THRESHOLD=90
DOZOR_ERROR_THRESHOLD=5
DOZOR_RESTART_THRESHOLD=1

See .env.example for all options.

Error Pattern Detection

Dozor detects common error patterns across any service:

Security

Defense-in-depth command validation:

• Blocklist — Blocks destructive commands, injection patterns, sensitive file access
• Input Sanitization — Service names, deploy IDs, durations validated via regex
• Shell Escaping — Single-quote wrapping for all interpolated values
• No Shell Injection — Process groups with proper signal handling

Architecture

dozor/
├── cmd/dozor/                  # Entry points: serve, gateway (Telegram), check, watch
├── internal/
│   ├── agent/                  # LLM agent loop + system prompt builder
│   ├── session/                # Interactive Claude Code session lifecycle (Manager, Session)
│   ├── a2a/                    # A2A protocol: agent card, /a2a JSON-RPC endpoint, executor
│   ├── bus/                    # In-process event bus for alert fan-out
│   ├── skills/                 # Skill loader (workspace + builtin, YAML front-matter)
│   ├── approvals/              # Telegram approval flow for exec_security=ask
│   ├── provider/               # LLM provider abstraction + withFallback chain
│   ├── mcpclient/              # MCP client manager, MemDB KB tools (memdb_search, memdb_save)
│   ├── toolreg/                # Unified tool registry (local + remote MCP tools)
│   ├── telegram/               # Telegram bot transport
│   ├── tools/                  # MCP tool handlers (dependency-injected)
│   │   ├── register.go         # RegisterAll(server, agent)
│   │   ├── inspect.go          # server_inspect (10 modes)
│   │   ├── triage.go           # server_triage
│   │   ├── exec.go             # server_exec
│   │   ├── restart.go          # server_restart
│   │   ├── deploy.go           # server_deploy
│   │   ├── prune.go            # server_prune
│   │   ├── cleanup.go          # server_cleanup
│   │   ├── services.go         # server_services
│   │   ├── updates.go          # server_updates
│   │   ├── remote.go           # server_remote
│   │   ├── remote_exec.go      # server_remote_exec
│   │   └── dev_mode.go         # server_dev_mode
│   └── engine/                 # Core monitoring engine
│       ├── config.go           # Environment config
│       ├── circuitbreaker.go   # Circuit breaker (Closed/Open/HalfOpen)
│       ├── transport.go        # Local/SSH execution + compose auto-detect
│       ├── docker.go           # Docker container operations
│       ├── status.go           # Docker status + auto-discovery
│       ├── systemd.go          # Systemd service operations
│       ├── overview.go         # System overview (memory, disk, load)
│       ├── resources.go        # CPU/memory/disk
│       ├── logs.go             # Log collection & parsing
│       ├── log_analyzer.go     # Error pattern analysis
│       ├── triage.go           # Auto-triage orchestration
│       ├── alerts.go           # Alert generation
│       ├── cleanup.go          # System cleanup orchestrator
│       ├── security.go         # Security audit
│       ├── remote.go           # Remote server monitoring
│       ├── watch.go            # Periodic monitoring + webhooks
│       ├── deploy.go           # Background deployments
│       ├── updates.go          # Binary update checking + install
│       └── validation.go       # Command validation
└── pkg/extensions/             # Optional extensions (claudecode, a2aclient, websearch)

Contributing

Contributions are welcome! Please open an issue first to discuss what you'd like to change.

See SECURITY.md for reporting vulnerabilities.

License

MIT