Superuser MCP server

Super

<!-- mcp-name: io.github.fitzyracing1/superuser -->

A permission-gated superuser agent exposed over the Model Context Protocol (MCP). It gives an AI agent real system-administration powers on this machine — running shell commands, checking system state, and acting on GitHub — while wrapping every action in guardrails: a dangerous-command denylist, a human-approval gate for risky operations, least-privilege GitHub access, an append-only audit log, and Cisco AI Defense runtime inspection of every tool call and response.

The design goal is the version of a "superuser agent" you can actually ship: powerful, but safe, auditable, and compatible with enterprise guardrails.

Landing site: https://fitzyracing1.github.io/super-landing/ (source: fitzyracing1/super-landing).

The previous Pages site in this repo is preserved at tag site-v1 / branch site-archive.

Why it's built this way

An agent that can do anything as root is a liability, not a product. Buyers (and marketplace security reviews) expect scoping, approvals, and an audit trail. So capabilities here always pass through a single choke point — the Guard — which enforces, in order:

MEDIUM) needs an explicit confirm=true from a human.

1. Cisco AI Defense inspects the tool call (can block).
2. Cisco Duo Agentic Identity authorizes the tool call per-policy (can block).
3. Approval gate — anything at or above approvalrequiredat (default

data leakage).

1. The operation runs.
2. Cisco AI Defense inspects the response before it is returned (catches

human owner -> agent -> tool -> action -> outcome.

1. Stripe meters the successful call (best-effort; never blocks).
2. The outcome is written to the audit log as

This mirrors the enterprise model: your app owns scoping + approvals + local audit; Cisco AI Defense provides runtime threat inspection at the MCP layer; Cisco Duo Agentic Identity provides per-tool-call authorization tied to an accountable human owner; and Stripe turns metered tool calls into revenue.

Cisco Duo Agentic Identity (authorization)

Duo follows a "Duo decides, the gateway enforces" model. This agent registers as a non-human identity, authenticates via the OAuth 2.1 client-credentials grant (with an RFC 8707 resource indicator), and authorizes every tool call either by matching the tool's required scope against what Duo granted, or by calling an explicit Duo decision endpoint. Set DUOENABLED=true plus DUOTOKENURL / DUOCLIENTID / DUOCLIENT_SECRET (see .env.example). When Duo is not configured, calls are allowed but flagged governed: false; in enforce mode authorization errors fail closed.

Stripe usage-based billing (monetization)

Each authorized, successful tool call emits a Stripe meter event (v2 billing meter events API), so the agent can be sold per-action. Configure a meter in Stripe, then set STRIPEENABLED=true, STRIPEAPIKEY, STRIPECUSTOMERID, and STRIPEMETEREVENTNAME. Per-tool weights let higher-risk actions cost more. Billing is best-effort: metering failures are logged and never block or fail the tool call (results are annotated billed: true|false).

Tools

Shortened. The full README is on GitHub.