Is your server ready for SecAI?
Run one command on your Linux server. It reads how the server is set up, checks it against what SecAI needs, and answers in one word, green, amber or red, with a score out of 100 under published rules. It changes nothing. About thirty short facts leave the server, such as whether password login is allowed or how full the disk is, and never file contents, passwords or keys.
The server passes the required checks. You can subscribe and install SecAI straight away.
Some configuration needs attention first. Contact SecAI or your MSSP partner for a short review before continuous protection is switched on.
Important issues were found. Book a security review before SecAI is activated, because a server in this state may already be compromised.
The point is a decision, not a wall of output. Green means go. Amber means a few foundations should be fixed first, and we or your MSSP partner can do that quickly. Red means it is worth a proper look before switching anything on. Whatever the result, the command never changes your server.
What the command does, exactly
You are about to run something with sudo on a production server, so here is all of it. The command is a short shell script you can read first; it downloads one small program, runs it once, and deletes it.
What it checks
- SSH: whether it is present, its port, whether password login and root login are allowed.
- Firewall: whether one is active, which tool, and whether brute-force protection (fail2ban, CrowdSec, CSF) is in place.
- Updates: pending security updates, automatic updates, clock synchronisation.
- Accounts: accounts with an empty password, extra accounts with uid 0.
- Exposure: database ports reachable from outside.
- Signs of compromise: an ld.so.preload entry, immutable system files, setuid files in user directories, suspicious cron lines, cron jobs running every minute, processes running from temp directories, web-shell markers in web roots.
- Housekeeping: disk usage, backups, a control panel (cPanel, Plesk, DirectAdmin), the distribution and version.
What it reads
/etc/os-release, /etc/passwd and /etc/shadow (to count empty passwords, never to copy a hash), cron directories, /etc/ld.so.preload, /proc and the output of ps and ss, the SSH daemon’s settings, firewall tool state, control panel version files and backup directories, and PHP files under the usual web roots. It reads; it does not copy. No file contents, passwords, keys or log lines leave the server.
What it sends
About thirty derived facts, each a yes/no, a count or a name, such as “password login: yes”, “firewall: ufw”, “disk: 71%”, together with your one-time token. SecAI scores them and returns GREEN, AMBER or RED with the reasons. SecAI records the verdict, the findings, the distribution and the address the request came from, against the email you asked with, and emails your result to that address with a link that opens it for 30 days. The scoring rules stay on SecAI’s side.
What it changes
Nothing. It writes one temporary file, the program itself, into a directory the server lets it run from, and removes it when it finishes, including when it fails. It installs nothing, opens no port, edits no configuration and leaves no service behind.
Read it before you run it
The command in your email pipes a script to bash. Fetch the same URL with curl and no pipe, read the script, then run it. It needs root because account, firewall and process checks do; it supports x86_64 and ARM64 Linux; your token works for about an hour and a handful of requests, and is tied to your email and address. The program is compiled, not obfuscated: strings and strace will show you what it probes.
Why start here
If the verdict is RED, the right next step is to clean or harden the server, not to install monitoring on it: a baseline captured on a compromised machine is a baseline of the compromise. Starting with the assessment means continuous protection begins from a state you chose.
The agent you would install afterwards is documented the same way in the Trust Center and the install documentation.
Questions
The command is sent to your inbox rather than shown on this page, so it only ever reaches a working address. It is issued to you personally and works once, for about an hour, which keeps the tool from being scraped and rehosted. Your result comes back to the same address, with a link that keeps it for 30 days.
Give it a minute or two and check your spam folder. If it still is not there the address may be rejecting our mail: try another, or tell us through the Contact page (secai.techsteps.ae/contact) and we will send it by hand.
Yes. It is read-only: it changes nothing on the server and installs nothing permanent. It downloads a small signed program, runs the checks, reports back, and removes itself.
About thirty short facts about how the server is set up, each a yes/no, a count or a name, such as whether SSH allows passwords, which firewall is active or how full the disk is. It never sends file contents, passwords, keys, or the addresses of people who log in. SecAI records the verdict, the findings, the distribution and the address the request came from, against the email you asked with.
The checklist asks you about your practices, in your browser, with no signup. This command checks the server itself and returns GREEN, AMBER or RED based on what it actually finds.