git-driven CD orchestrator for LXC-as-service on Proxmox, MCP-driven, Vercel-like
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport streamable-http counts 12 tools · 0 res
· 0 prompts
permission surface via README inference
tools
-
bind_repo
Bind a GitHub repo for webhook auto-deploy (V2)
-
bind_service
Wire DNS + Caddy routes
-
deploy
Manual deploy: clone → build → health poll
-
destroy_service
Cascade destroy (requires confirm: true)
-
list_secret_keys
List key names for a service
-
list_services
Enumerate managed services
-
logs
Per-deployment log stream
-
provision_ct
Provision a new LXC for a service
-
rollback
Revert to a previous SHA
-
set_secret
Register a secret key=value (value → LXC env_file, never DB)
-
status
Current/previous SHA, health, deploy log tail
-
unbind_service
Remove Caddy + DNS routes (LXC stays)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 23
shell / exec 3
- shell (weak) zyx1121-keel-d89a57b/src/__tests__/contract.test.ts :178
// `^[a-z0-9][a-z0-9-]{0,62}$` regex and break downstream hostname/systemd - shell zyx1121-keel-d89a57b/src/deploy-engine.ts :91
const proc = Bun.spawn(["ssh", "-o", "BatchMode=yes", lxc, remoteCmd], { - shell zyx1121-keel-d89a57b/src/pve.ts :89
const proc = Bun.spawn(["ssh", "-o", "BatchMode=yes", this.alias, remoteCmd], {
network 4
- net zyx1121-keel-d89a57b/src/deploy-engine.ts :168
* WHY curl-in-LXC instead of fetch() from keel: - net zyx1121-keel-d89a57b/src/deployments.ts :50
const resp = await fetch(`https://api.github.com/repos/${repo}/deployments`, { - net zyx1121-keel-d89a57b/src/github-app.ts :130
const resp = await fetch( - net zyx1121-keel-d89a57b/src/server.ts :20
async fetch(req) {
secrets 6
- secrets (weak) zyx1121-keel-d89a57b/src/__tests__/auth.test.ts :10
if (!process.env["MCP_WRITE_TOKEN"]) { - secrets (weak) zyx1121-keel-d89a57b/src/__tests__/mcp-dispatch.test.ts :8
if (!process.env["MCP_WRITE_TOKEN"]) { - secrets (weak) zyx1121-keel-d89a57b/src/__tests__/mcp-tools.test.ts :11
if (!process.env["MCP_WRITE_TOKEN"]) { - secrets (weak) zyx1121-keel-d89a57b/src/__tests__/v2-webhook.test.ts :10
if (!process.env["MCP_WRITE_TOKEN"]) { - secrets zyx1121-keel-d89a57b/src/config.ts :19
const rawToken = process.env["MCP_WRITE_TOKEN"] ?? "" - secrets zyx1121-keel-d89a57b/src/webhook.ts :45
const secret = process.env["WEBHOOK_SECRET"] ?? config.webhookSecret
declared dependencies 3
- yaml@^2.9.0
- @types/bun@latest
- typescript@^5