Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bvisible/mcp-ssh-manager --skill ssh-incidentgit clone --depth 1 https://github.com/bvisible/mcp-ssh-managerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bvisible/mcp-ssh-manager/ssh-incident)<a href="https://agentmods.dev/skills/bvisible/mcp-ssh-manager/ssh-incident"><img src="https://agentmods.dev/badge/skills/bvisible/mcp-ssh-manager/ssh-incident/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bvisible/mcp-ssh-manager/ssh-incident"><img src="https://agentmods.dev/badge/skills/bvisible/mcp-ssh-manager/ssh-incident.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.00593 |
| Opus 5.5 | $0.00018 | $0.00237 |
| Sonnet 5.5 | $0.00009 | $0.00119 |
| Haiku 4.5 | $0.00005 | $0.00059 |
Grade A, and why
ssh-incident scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Diagnosing before touching
The instinct under pressure is to restart something. Resist it for four calls: a restart that fixes the symptom destroys the evidence, and you will be back tomorrow.
The order, and why it is this order
1. ssh_health_check — one call, and it answers most incidents outright.
A full disk, memory exhaustion and a load spike all look like "the site is down"
from outside. Start here every time.
2. ssh_service_status on the services that matter — the web server, the
database, the app. "Active" with a recent start time means something restarted
it; that is a clue, not a resolution.
3. ssh_tail on the relevant log, with follow: false so you get the last
lines back rather than a stream. The error is usually in there, in plain text,
and reading it takes ten seconds. Guessing takes an hour.
4. ssh_process_manager to list processes when the health check pointed at
CPU or memory. Find what is eating the machine before deciding what to do about
it.
Only now consider changing something.
Things that are true more often than they should be
- A full disk presents as everything being broken. Logs cannot be written,
databases refuse writes, uploads fail. Check
diskin the health output first, and look at/var/logbefore blaming the application. - "It worked yesterday" usually means something rotated, filled, or expired. A log that stopped rotating, a certificate, a token, a disk crossing 100%.
- A service that is running is not a service that is working.
active (running)and a port nobody answers on are entirely compatible. - Check whether it is only you. A network path, a DNS entry or a firewall rule can make one machine look dead from where you are and fine from elsewhere.
What not to do
- Do not restart a service before reading its logs. You lose the reason.
- Do not clear a log file to free disk space without looking at it first; move it aside if you must, and let the service reopen its handle.
- Do not run a fix on every server in a group because it worked on one. Confirm the same symptom is there first.
- Do not report "fixed" when you restarted something and the symptom went away. Say what you found and what you did — if you did not find a cause, say that too.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 56 lines · 46 tokens per session scan A 4b424bfc38eb
ssh-incident is a skill published in the GitHub repository bvisible/mcp-ssh-manager (519 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 593 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
Other skills, from other repositories
k8s-cilium
Cilium and Hubble network observability for Kubernetes. Use when managing network policies, observing traffic flows, or troubleshooting connectivity with eBPF-based networking.
k8s-incident
Respond to Kubernetes incidents with runbooks and diagnostics. Use for outages, pod failures, node issues, network problems, and emergency response.
ln-71-operations-investigator
Diagnoses incidents from operational evidence and proposes recovery; does not change live systems.
forge-diagnose
Diagnose runtime infrastructure issues — cold starts, timeouts, scaling problems, network failures. Use when asked about "infra is slow", "cold starts", "network issues", "why is this timing out", "scaling problem", "latency spikes", or "service is down".
app-platform-troubleshooting
Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes. Use when apps fail to deploy, crash at runtime, have connectivity issues, or need performance diagnosis.
piggyback-hosting
Hosting-Muster, um eine lokal gebaute Anwendung (eigene Datenbank, eigener API-Key, In-Process-State) sicher hostbar zu machen, ohne Nutzerverwaltung zu bauen. Kernzug — der Host speichert nichts, der Browser des Besuchers speichert alles — sodass Pro-Besucher-Accounts, Zugriffsprüfungen und Löschfristen…