ArticleExploring
Letting an AI assistant manage your server, with guardrails
An AI assistant can already run a server over SSH, with no backup and no undo. Here is how WauHost could let it help through the same safe buttons you use, with your approval.
You can already ask an AI assistant to look after a server. Give it SSH access and it will install things, update WordPress and read the logs. It works surprisingly well.
That is the problem. A shell gives the assistant every power the server has, and none of the safety nets.
What goes wrong with a raw shell
- It usually runs as an administrator, so one wrong command can take every website down
- Nothing is backed up before it changes something
- There’s no undo, and no clear record of what it did or why
- Passwords, customer data and backups are all within reach
The idea: give the assistant the same buttons you have
WauHost already has a short list of safe actions. “Update” backs up first and checks the homepage afterwards. Firewall changes undo themselves unless you confirm. Every action is logged.
MCP (the Model Context Protocol) is the open standard that AI assistants such as Claude use to call tools. WauHost could offer its safe actions as MCP tools, so an assistant helps through the panel instead of around it.
- The assistant asks“update the shop’s plugins”
- WauHost checksis this key allowed to?
- You approvein the panel or on your phone
- It runs, safelybackup first, logged, shown on the map
What an assistant could see and do
| Kind | Tools | Your approval |
|---|---|---|
| Look | List websites, their health and visitors, nightly scan results, server health, the activity log | Not needed |
| Fix | Update a website (backup first, homepage compared after), restore a backup, lock or unlock a website | Needed |
| Change | Firewall rules (undo themselves after 60 seconds unless confirmed), add a website, add an add-on | Needed |
| Never | A command line, reading files or databases, seeing passwords, deleting backups | Not offered at all |
The “never” row matters most. The assistant can only press buttons that already exist, and each button already knows how to fail safely.
How it would work, for your tech person
Connection
The panel would serve an MCP endpoint over Streamable HTTP. It would be reachable the same way the panel is: behind Cloudflare Access or Tailscale, never open to the internet. For an assistant running on the server itself, a local stdio mode (wau mcp) would skip the network entirely. The endpoint checks the Origin header on every request, as the spec requires.
Keys and permissions
Each assistant gets its own key through the OAuth flow the MCP spec defines. WauHost acts as the authorization server, and tokens are bound to that one server. Keys carry scopes (read, update, restore, firewall, sites). They are read-only unless you tick more, and you can revoke one key, or all of them, with one switch.
Approvals
A tool that changes something doesn’t run straight away. It replies that it needs input, which MCP supports, and the request waits in the panel until a WauHost user signs in with 2FA and approves it. A long job, such as updating ten websites, would run as an MCP task that the assistant can check on.
What holds the line
MCP lets tools describe themselves as read-only or destructive, and WauHost would set those honestly. The spec itself says not to rely on them. The real boundary is WauHost’s own design: the web panel never runs as administrator, and a small helper only runs a fixed list of actions. An assistant gets that same list, minus the riskiest parts.
Records
Every call is logged with the key’s name, the tool, its inputs and the result. Changes made through an assistant carry an “AI” marker on the map and in the activity log, so you always know who did what.
Open questions
- Should very small actions, like updating one plugin on a test website, ever skip approval?
- Should the command line ever be a tool? We lean towards no.
- Who is responsible when an assistant asks and a person approves? Our terms would say the person who approved.
- Is a local-only mode, with no network endpoint, enough for most people?
Where this stands
This is an idea we are exploring. It isn’t in WauHost yet. If you would use it, tell us what you’d want an assistant to do. It helps us decide.
- Model Context Protocol specification, revision 2026-07-28: changelog, transports, authorization, tools, elicitation
- MCP security best practices · Tasks extension