add_host_key
ChatGPTExplicitly add one independently verified algorithm/fingerprint pair to a server trust set. This is idempotent for an exact match and refuses to replace a different fingerprint already trusted for that algorithm. Confirm the fingerprint through a trusted channel before adding it.
add_server
ChatGPTCreate a Linux or native Windows OpenSSH server and its managed public key. An optional network_connection_id attaches an already-authorized free Tailscale connection; connection lifecycle remains in the web app. A Tailscale address (100.64.0.0/10) needs a tailnet: with exactly one authorized Tailscale connection Gateway routes it there automatically and returns a warning; with several, pass the chosen one as network_connection_id; with none, the user must connect the tailnet in the web app under Connectivity. Do not retry the same request. Omit hostname to use the key-first flow. When setup needs the user, share the returned setupUrl so they can finish it in the Gateway web app. On Linux servers, sudo_setup chooses how sudo access is granted once they do: keep_in_gateway (Gateway grants it for this server), sudoers_rule (installs a sudoers rule for the login user), or none (the default). On Windows servers, the user finishes setup in the Gateway web app, which explains how to install the managed public key.
add_ssh_authorized_key
ChatGPTIdempotently add a fingerprint-bound SSH public key. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
allow_firewall_rule
ChatGPTEnsure one exact semantic allow rule exists. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
autoremove_packages
ChatGPTRemove only packages the package manager reports as unneeded. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
build_docker_compose
ChatGPTBuild selected services in one exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
build_docker_image
ChatGPTBuild tagged Docker images from one exact host context. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
cancel_job
ChatGPTIdempotently cancel queued work or request cancellation of a running SSH job. Running cancellation is cooperative until the executor confirms termination.
certificate_inspect
ChatGPTRead one exact non-symlink certificate path and return structured X.509 subject, issuer, validity, serial, and SHA-256 fingerprint facts.
change_file_mode
ChatGPTEnsure an exact path has the requested mode. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
change_file_owner
ChatGPTEnsure an exact path has the requested owner and group. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
check_filesystem
ChatGPTRun a non-modifying ext4 or XFS check on an exact unmounted block device. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
check_firewall_rule
ChatGPTCheck whether an exact semantic flow is allowed. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
config_docker_compose
ChatGPTRead the normalized configuration for one exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
connect_docker_network
ChatGPTEnsure one exact container is connected to one exact Docker network. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
copy_between_servers
ChatGPTCopy one file, or a directory tree with recursive=true, between two owned Gateway servers. Gateway coordinates and audits the operation; file contents never pass through Gateway executors or the application server. A single regular file between servers that do not connect through a Gateway overlay network moves directly host to host with short-lived transfer-scoped authorization, up to 250 GiB, and nothing is staged in R2. A directory tree, transport=staged, or an overlay endpoint instead has each host move its own bytes through private regional R2 staging, up to 5,363,466,240 bytes (4.995 GiB), deleted after the transfer; the result states when and why a transfer was staged. Destination entries are deleted only when delete_extraneous is explicitly true. Overwrite behavior is always explicit.
copy_file
ChatGPTCopy one exact local path to an exact destination. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
copy_from_docker_container
ChatGPTCopy one exact container path to an exact guarded host path. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
copy_to_docker_container
ChatGPTCopy one exact host path to an exact path in one exact container. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_archive
ChatGPTCreate an exact archive from explicit source paths. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_directory
ChatGPTEnsure one exact directory exists with requested metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_docker_compose
ChatGPTEnsure selected service containers are created without starting them. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_docker_container
ChatGPTCreate one exactly named Docker container from a local image and bounded configuration. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_docker_network
ChatGPTEnsure one exactly named Docker network exists with bounded IPAM configuration. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_docker_volume
ChatGPTEnsure one exactly named Docker volume exists. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_group
ChatGPTEnsure one exact local group exists. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_lvm_logical_volume
ChatGPTEnsure an exactly confirmed logical volume exists with the requested allocation. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_lvm_physical_volume
ChatGPTEnsure an exactly confirmed unused block device is an LVM physical volume. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_lvm_volume_group
ChatGPTEnsure an exactly confirmed LVM volume group contains the exact requested physical volumes. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_schedule
ChatGPTEnsure one exact validated schedule exists. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
create_swap_file
ChatGPTCreate a safely permissioned swap file at an exact path. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
create_user
ChatGPTEnsure one exact local account exists. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
daemon_reload_systemd
ChatGPTReload systemd manager configuration and unit files. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
delete_directory
ChatGPTDelete one exact directory with explicit recursion and guarded confirmation. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
delete_file
ChatGPTDelete one exact non-directory path with guarded confirmation. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
deny_firewall_rule
ChatGPTEnsure one exact semantic deny rule exists. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
disable_firewall_rule
ChatGPTEnsure one exact existing firewall rule is disabled without deleting it. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
disable_schedule
ChatGPTEnsure one exact managed schedule is disabled. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
disable_swap
ChatGPTEnsure an exact swap source is inactive. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
disable_systemd_unit
ChatGPTEnsure an exact systemd unit is disabled. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
disconnect_docker_network
ChatGPTEnsure one exact container is disconnected from one exact Docker network without force. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
discover_services
ChatGPTCorrelate bounded systemd, listener, process, Docker, and package service evidence. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
down_docker_compose
ChatGPTStop an exact Compose project without deleting volumes. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
download_path
ChatGPTCreate a durable transfer job for a regular remote file after reputation pre-clear. expected_sha256 must be the 64 lowercase hex characters of this file's current SHA-256 digest, without the sha256: prefix; Gateway rejects directories and any changed or mismatched file before artifact reservation. Successful jobs expose a revocable Gateway download link capped to the artifact's 24-hour lifetime.
enable_firewall_rule
ChatGPTEnsure one exact existing firewall rule is enabled. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
enable_schedule
ChatGPTEnsure one exact managed schedule is enabled. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
enable_swap
ChatGPTEnsure an exact swap source is active. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
enable_systemd_unit
ChatGPTEnsure an exact systemd unit is enabled. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
ensure_sudoers_rule
ChatGPTEnsure one narrowly structured rule in an exact Gateway-managed sudoers drop-in. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
exec_docker_container
ChatGPTExecute an exact argv vector in one exact running container. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
execute_argv
ChatGPTExecute a bounded argv vector without shell interpretation. Runs as the SSH identity or through root privilege; switching to another non-root user is unsupported. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Takes values the user stored in Gateway by name only (*_from fields). Linux servers only; a Windows server is refused before any job is created.
execute_command
ChatGPTRun a non-interactive command over SSH with optional ordinary stdin, stdin or environment variables taken from values the user stored in Gateway (stdin_from, env_from), and none/sudo/auto privilege. If sudo needs approval from the user, the result includes a Gateway setup link. Sensitive commands are durably replaced by a SHA-256 digest and placeholder. Direct exact-value echoes are redacted from output across chunk boundaries, but a malicious remote program can transform or encode a value to evade exact matching.
expire_artifact
ChatGPTImmediately expire an owned Gateway transfer artifact by canonical fil_ ID. Gateway removes the underlying regional object so previously issued download capabilities stop resolving, while retaining a non-secret audit tombstone. Repeating the request is safe.
extend_lvm_logical_volume
ChatGPTExtend an exactly confirmed logical volume by a bounded byte allocation without implicitly resizing its filesystem. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
find_files
ChatGPTFind bounded filesystem entries under one exact root without following links. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
format_filesystem
ChatGPTEnsure an exact unmounted block device has an ext4 or XFS filesystem. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_account_limits
ChatGPTReport this account's current usage and plan limits: servers, jobs running at once, the longest job, on-demand file scans today, and cloud storage. A limit of null means unlimited.
get_directory_usage
ChatGPTMeasure bounded usage beneath an exact directory. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_disk_smart_health
ChatGPTInspect non-intrusive SMART health for one exact device. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_compose_images
ChatGPTList bounded image state for selected Compose services. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_compose_logs
ChatGPTRead bounded logs from an exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_compose_processes
ChatGPTRead bounded process listings for selected Compose services. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_compose_status
ChatGPTInspect an exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_container_changes
ChatGPTRead bounded filesystem changes for one exact Docker container. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_container_stats
ChatGPTRead one bounded no-stream container resource snapshot. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_image_history
ChatGPTRead bounded build history for one exact Docker image. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_logs
ChatGPTRead bounded logs for an exact container. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_docker_volume_usage
ChatGPTRead bounded Docker volume disk-usage data. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_file_acl
ChatGPTInspect ACL state for one exact path. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_file_capabilities
ChatGPTInspect Linux file capabilities for one exact path. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_file_scan_status
ChatGPTRead the asynchronous scan and quarantine status for one exact owned Gateway artifact. Follow the transfer job of the scan until it exposes an artifact ID, then poll this tool while status is pending or scanning. no_detection means only that the configured scanner found no detection; it is not a permanent clean reputation.
get_file_scanning_preferences
ChatGPTReturn whether the account explicitly permits proactive server-file scanning, and how many on-demand server-file scans it has used today against its daily limit (on_demand_scan_daily_limit null = unlimited; the count resets at 00:00 UTC; automatic scanning of transferred files is never counted). Read this immediately before any proactive scan. A team server follows its team's setting.
get_file_xattr
ChatGPTRead one bounded non-secret xattr value. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_firewall_status
ChatGPTInspect active firewall backend and policy. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
get_fstab
ChatGPTInspect parsed persistent filesystem entries. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_hardware_summary
ChatGPTInspect bounded CPU, memory, virtualization, network, and block inventory. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_job
ChatGPTGet current job status plus ordered stdout/stderr/system chunks after a cursor. Save nextCursor and pass it as after_cursor to fetch only new output.
get_locale_status
ChatGPTInspect system locale configuration. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_network_dns_status
ChatGPTInspect resolver servers, search domains, and backend. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_network_interface_stats
ChatGPTInspect byte/error counters for bounded interfaces. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_network_route_to
ChatGPTInspect the kernel-selected route to an exact destination. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_nvme_health
ChatGPTInspect NVMe health for one exact controller or namespace. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_reboot_required
ChatGPTInspect whether the host requires a reboot. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
get_server_auth_status
ChatGPTGet customer-safe authentication recovery state for one owned server. Reports only this account's public password-attempt budget, Gateway-key verification history, and the verified managed public-key fingerprint; it never exposes private key material, target-wide, or cross-account signals. Password state is unsupported for servers whose setup is key-only.
get_services_restart_required
ChatGPTInspect services using replaced or deleted libraries. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_sshd_effective_config
ChatGPTInspect bounded effective SSH server configuration. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_sshd_status
ChatGPTInspect the active SSH service and listener state. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_storage_usage
ChatGPTInspect bytes and inode usage for filesystems. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_sysctl
ChatGPTRead one exact sysctl key. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_system_hostname
ChatGPTInspect current and static hostname state. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_systemd_dependencies
ChatGPTRead bounded forward or reverse dependencies for an exact systemd unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_systemd_logs
ChatGPTRead bounded journal records for an exact unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_systemd_properties
ChatGPTRead an allowlisted set of non-secret properties for an exact systemd unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_systemd_status
ChatGPTInspect an exact systemd unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_time_status
ChatGPTInspect wall-clock, timezone, NTP, and clock-source state. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_time_sync_status
ChatGPTInspect NTP synchronization evidence. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
get_update_status
ChatGPTInspect repository, update, security, held, and broken-package state. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
hardware_inspect
ChatGPTReturn kernel, CPU, memory, and optionally bounded block-device facts with partial-result warnings.
hash_file
ChatGPTHash one exact regular file. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
hold_package
ChatGPTEnsure exact installed packages are held at their current versions. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_certificate_file
ChatGPTInspect a PEM or DER certificate file without exposing private-key material. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_docker_container
ChatGPTInspect exact container configuration, state, mounts, networks, and health. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_docker_image
ChatGPTInspect an exact container image. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_docker_network
ChatGPTInspect one exact Docker network. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_docker_volume
ChatGPTInspect one exact Docker volume. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_firewall_rule
ChatGPTInspect one exact firewall rule, including whether it is enabled. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
inspect_group
ChatGPTInspect one exact local group. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_kernel_module
ChatGPTInspect one exact kernel module. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_package
ChatGPTInspect exact package state using the detected backend. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
inspect_process_detailed
ChatGPTInspect rich bounded metadata for one exact PID. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_region
ChatGPTInspect a shared region or a private region assigned to this account or one of its teams. Private output includes customer-safe network-site policy and aggregate capacity, never executor inventory or bootstrap credentials.
inspect_schedule
ChatGPTInspect one exact managed schedule. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
inspect_sudo_policy
ChatGPTInspect bounded sudoers file metadata, syntax validity, and Gateway sudo access. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_tls_from_host
ChatGPTInspect a bounded verified TLS handshake from the registered host. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Linux servers only; a Windows server is refused before any job is created.
inspect_user
ChatGPTInspect one exact local account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
inspect_windows_service
ChatGPTWindows only. Inspect one exact Windows service: state, start mode, process ID, account, and dependencies. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history.
install_artifact
ChatGPTVerify and atomically install one owned Gateway artifact at an exact host path, with guarded restart, health verification, and rollback. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Also accepts a Windows server: the Windows host downloads the artifact itself over HTTPS, verifies its SHA-256, and publishes it with an atomic replace or move. owner, group, mode, restartUnit, healthCheck, and sudo are Linux-only; a new Windows file inherits the destination directory's ACL and a replaced file keeps its DACL.
install_package
ChatGPTEnsure explicitly named packages are installed. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
install_sudoers_dropin
ChatGPTTransactionally install structured rules as an exact Gateway-managed sudoers drop-in. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
is_known_malicious
ChatGPTReturn only whether this lowercase SHA-256 is currently in Gateway global malicious-file reputation. false means unknown, never clean or safe.
is_up
ChatGPTRun a bounded TCP, HTTP, or HTTPS probe against a registered server endpoint. The result distinguishes DNS/policy failure, refusal, timeout, TLS failure, unexpected HTTP status, and success; HTTP redirects are returned rather than followed.
kill_systemd_unit
ChatGPTSend one allowlisted signal to selected processes of an exact systemd unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_archive
ChatGPTList bounded archive entries without extraction. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_available_shells
ChatGPTList supported command processors. Linux inspects the account's executable shells; Windows returns the guaranteed powershell processor ID. The optional pwsh ID may still be selected explicitly when PowerShell 7 is installed.
list_block_devices
ChatGPTInspect bounded block-device metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_directory
ChatGPTList bounded entries under one exact directory. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
list_docker_containers
ChatGPTList bounded container state. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_docker_images
ChatGPTList bounded Docker image state with exact filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_docker_networks
ChatGPTList bounded Docker network state with exact filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_docker_volumes
ChatGPTList bounded Docker volume state with exact filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_failed_systemd_units
ChatGPTDiscover bounded failed systemd units. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_file_xattrs
ChatGPTList xattr names without exposing values. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_files
ChatGPTList ready, unexpired customer artifacts owned by the authenticated account and by teams the user belongs to; a team artifact includes its team slug. Internal host-to-host staging objects are ephemeral transport state and are never exposed. When account actions are allowed, every item includes a fresh revocable Gateway download link limited to the artifact lifetime.
list_filesystems
ChatGPTInspect recognized filesystems. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_firewall_rules
ChatGPTList bounded canonical firewall rules. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
list_groups
ChatGPTList bounded local group metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_jobs
ChatGPTList recent jobs from MCP, the web app, and system provisioning. Optionally filter by server, team, kind, or status. Without server or team, lists jobs from the personal space and every team the user belongs to; a team job includes its team slug.
list_kernel_modules
ChatGPTList bounded loaded kernel modules. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_lvm_logical_volumes
ChatGPTInspect bounded LVM logical-volume paths, sizes, attributes, pools, and origins. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_lvm_physical_volumes
ChatGPTInspect bounded LVM physical-volume state and volume-group relationships. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_lvm_volume_groups
ChatGPTInspect bounded LVM volume-group sizes, free extents, and relationships. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_mounts
ChatGPTInspect current mount metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_network_connections
ChatGPTList bounded established and pending connections. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_network_dhcp_leases
ChatGPTInspect best-effort DHCP lease metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_network_interfaces
ChatGPTList bounded network interfaces and addresses. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_network_listeners
ChatGPTList bounded listening sockets. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_network_neighbours
ChatGPTList bounded neighbour-cache state. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_network_routes
ChatGPTList bounded kernel routes. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_packages
ChatGPTList bounded installed package state using the detected backend. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
list_pci_devices
ChatGPTList bounded PCI device metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_process_connections
ChatGPTList bounded network connections for one exact PID. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_process_open_files
ChatGPTList bounded open-file metadata for one exact PID. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_processes
ChatGPTList bounded process metadata without environment values. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
list_regions
ChatGPTList shared Gateway regions and private regions assigned to this account or its teams, including safe health and network-site summaries. A team private region includes its team slug. Use a returned canonical region and network-site ID when adding a server.
list_schedules
ChatGPTList bounded systemd-timer and cron schedules. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
list_servers
ChatGPTList servers the authenticated user can access: their own servers and the servers of teams they belong to. A team server includes team and selector (team-slug/server-name). Use the canonical ID or selector returned here in later calls.
list_ssh_authorized_keys
ChatGPTList SSH public-key fingerprints for one exact account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_sshd_host_keys
ChatGPTInspect SSH host-key algorithms and fingerprints without private material. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_stored_values
ChatGPTList the names of values the user has stored in Gateway for *_from fields, with their metadata. It never returns a value itself. Each entry has name, purpose (stdin for stdin_from, environment for env_from, registry for registry_credential_from, file for content_from), retention (saved stays until deleted or its expiry; one_time is used up by the first job that starts with it), expiresAt, lastUsedAt, createdAt, and scope (personal, or team with the team slug; a team's values are used only on that team's servers). Use it to find the exact name before referring to a value, or when a call reports a stored value missing.
list_sudo_rules
ChatGPTList bounded sudo policy rules and directives from canonical sudoers targets. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_swap
ChatGPTInspect configured and active swap. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_sysctls
ChatGPTList bounded sysctl keys under an optional prefix. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_systemd_unit_files
ChatGPTDiscover bounded systemd unit files with exact type and state filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_systemd_units
ChatGPTDiscover bounded systemd units with exact state and type filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_usb_devices
ChatGPTList bounded USB device metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
list_users
ChatGPTList bounded local account metadata. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
load_kernel_module
ChatGPTEnsure one exact kernel module is loaded. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
lock_user
ChatGPTEnsure one exact local account is locked. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
mask_systemd_unit
ChatGPTEnsure an exact systemd unit is persistently masked. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
modify_group
ChatGPTConverge allowlisted properties of one exact local group. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
modify_user
ChatGPTConverge allowlisted properties of one exact local account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
mount_filesystem
ChatGPTEnsure an exact source is mounted at an exact target. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
move_file
ChatGPTMove one exact local path to an exact destination. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
network_inspect
ChatGPTReturn bounded interface/address facts and optionally routes and listening TCP/UDP sockets without collecting process environments.
package_health
ChatGPTIdentify the supported package manager, count available upgrades where possible, and report the conventional reboot-required marker without changing packages.
patch_file_atomic
ChatGPTAtomically apply a bounded unified patch under a content precondition. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
pause_docker_container
ChatGPTEnsure one exact running Docker container is paused. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
ping_from_host
ChatGPTRun bounded ICMP echo probes from the registered host. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Linux servers only; a Windows server is refused before any job is created.
probe_tcp_from_host
ChatGPTRun a bounded TCP connect from the registered host. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Linux servers only; a Windows server is refused before any job is created.
process_inspect
ChatGPTReturn bounded structured process facts by PID, command-name substring, or top CPU order. Environment variables and full command arguments are not collected.
prune_docker_images
ChatGPTPrune Docker images only within an explicitly confirmed scope. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
pull_docker_compose
ChatGPTPull images for an exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Takes values the user stored in Gateway by name only (*_from fields). Linux servers only; a Windows server is refused before any job is created.
pull_docker_image
ChatGPTPull an exact container image reference. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Takes values the user stored in Gateway by name only (*_from fields). Linux servers only; a Windows server is refused before any job is created.
push_docker_image
ChatGPTPush an exact local image reference. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Takes values the user stored in Gateway by name only (*_from fields). Linux servers only; a Windows server is refused before any job is created.
query_journal
ChatGPTQuery bounded journal records using semantic filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
query_windows_event_log
ChatGPTWindows only. Query bounded Windows Event Log records, newest first, by log, provider, level, event ID, and time. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history.
read_file
ChatGPTRead bounded content and metadata from one exact non-symlink file. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
read_hardware_sensors
ChatGPTRead bounded temperature, fan, voltage, and power sensor facts. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
read_kernel_messages
ChatGPTRead bounded kernel messages with semantic filters. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
reboot_system_guarded
ChatGPTReboot with down/up, SSH trust, boot identity, and post-health verification. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
refresh_package_updates
ChatGPTRefresh package metadata without installing updates. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
reload_sshd
ChatGPTValidate then reload SSH while checking Gateway-access compatibility. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
reload_systemd_unit
ChatGPTReload an exact active systemd unit without restarting it. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_docker_container
ChatGPTRemove one exactly confirmed Docker container without deleting volumes. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_docker_image
ChatGPTRemove an exact image reference without pruning unrelated data. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_docker_network
ChatGPTRemove one exactly confirmed non-built-in Docker network. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_docker_volume
ChatGPTRemove one exactly confirmed Docker volume without force. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_file_capabilities
ChatGPTEnsure Linux file capabilities are absent from an exact path. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_file_xattr
ChatGPTEnsure one exact xattr is absent. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_firewall_rule
ChatGPTRemove one exact canonical firewall rule identifier. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
remove_fstab_entry
ChatGPTAtomically remove one exact persistent filesystem entry. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_group
ChatGPTRemove one exact local group. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_lvm_logical_volume
ChatGPTRemove one exactly confirmed unmounted logical volume that is not active swap. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_lvm_physical_volume
ChatGPTRemove LVM metadata from one exactly confirmed unused physical volume outside any volume group. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_lvm_volume_group
ChatGPTRemove one exactly confirmed empty LVM volume group. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_package
ChatGPTEnsure explicitly named packages are absent without autoremove. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
remove_schedule
ChatGPTRemove one exact managed schedule and owned unit files. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
remove_server
ChatGPTPermanently remove a Gateway server definition and revoke its Gateway SSH identity. Use the canonical server ID so retries are idempotent; an exact-name selector cannot safely identify an already-removed server because names may be reused. Before revoking, Gateway runs a short job that deletes its own public key line from authorized_keys on the host; keyRemoval reports the outcome, and when it is manual_required the warning names the key fingerprints to remove from the host by hand. The server is disabled and active jobs are cancelled first; if a running cancellation is still pending, poll it and retry removal. The exact current server name is required as confirmation.
remove_ssh_authorized_key
ChatGPTRemove one exact SSH public-key fingerprint while protecting Gateway access. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_sudoers_dropin
ChatGPTTransactionally remove an exact Gateway-managed sudoers drop-in. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_sudoers_rule
ChatGPTRemove one named rule from an exact Gateway-managed sudoers drop-in. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
remove_user
ChatGPTRemove one exact account without deleting its home directory. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
rename_docker_container
ChatGPTRename one exact Docker container to one unoccupied exact name. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
repair_filesystem
ChatGPTRun an explicitly acknowledged ext4 or XFS repair on an exact unmounted block device. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
repair_package_state
ChatGPTRepair interrupted apt/dpkg configuration without removing packages. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
replace_file_text_atomic
ChatGPTAtomically replace exact bounded text under a content precondition. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
request_http_from_host
ChatGPTRun a bounded non-redirecting HTTP or HTTPS request from the registered host. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Linux servers only; a Windows server is refused before any job is created.
request_stored_value
ChatGPTSends the user a Gateway link to store a value that a later job needs, or follows up a result that asks for one. This tool takes only a name and never accepts or returns the value itself: the user enters it in the Gateway web app, and Gateway delivers it only to the job on the server, so it never passes through the conversation or tool results. Returns exists, setupUrl, and notice. If exists is false, share setupUrl; once the user confirms, refer to it by name in stdin_from, env_from, registry_credential_from, or content_from. It does not handle sudo.
request_sudo_access
ChatGPTUse when a privileged call (privilege sudo or auto, or a tool that runs with sudo) returns nextAction request_sudo_access, or before privileged work on a server. For a non-root Linux login it first runs one short check job on the server (sudo -n). Returns state (already_passwordless when sudo already works without a password, already_root, action_required, or unsupported for Windows servers), sudoAccessSaved, setupUrl, and notice. already_passwordless and already_root need no user action. For action_required, share setupUrl so the user can choose in the Gateway web app how to grant sudo (just this once, for a while, or always), then retry the original call once they confirm. When sudoAccessSaved is true Gateway already grants sudo on this server; share setupUrl only if a privileged call still fails.
rescan_host_keys
ChatGPTThrough an already trusted SSH session, read the machine public host-key files and compare their OpenSSH SHA256 fingerprints with Gateway trust. This never trusts or replaces a key automatically; changed and newly available algorithms are returned distinctly.
reset_failed_systemd_unit
ChatGPTClear the failed state and restart-rate counters for an exact systemd unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
resize_filesystem
ChatGPTGrow an ext4 or XFS filesystem to fill its exact backing block device; shrinking is unavailable. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
resolve_network_name
ChatGPTResolve one exact hostname using host resolver policy. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Linux servers only; a Windows server is refused before any job is created.
restart_docker_compose
ChatGPTRestart selected services in an exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
restart_docker_container
ChatGPTRestart an exact container. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
restart_systemd_unit
ChatGPTRestart an exact systemd unit. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
restart_windows_service
ChatGPTWindows only. Restart one exact Windows service without restarting dependent services. Refuses SSH, Tailscale, and core OS services. Requires an Administrator SSH account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run.
retry_provisioning
ChatGPTCreate a new durable provisioning job for an existing pending server, reusing the setup details the user provided in Gateway. If Gateway has none (or they were rejected), share the server setupUrl from the result so the user can finish setup in the Gateway web app. The server ID, Gateway SSH identity, host-key pin, region, and history are preserved.
run_schedule_now
ChatGPTRun one exact managed schedule immediately. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
scan_server_file
ChatGPTCreate a durable, opt-in proactive scan of one exact regular file already present on a registered server. Gateway denies this tool unless proactive server-file scanning is enabled, requires the current SHA-256 of the file, pre-clears malicious reputation, independently verifies transferred bytes, and then uses the normal asynchronous internal artifact scanner. This path never submits the sample to an external provider.
search_file_contents
ChatGPTSearch bounded UTF-8 regular-file content under one exact root. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
search_log_file
ChatGPTSearch one bounded cursor page of an exact UTF-8 log file. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
secret_file_remove
ChatGPTIdempotently remove a normalized secret-file path with fail-closed no-follow handling and none/sudo/auto privilege. Symlinks and directory targets are refused. If sudo needs approval from the user, the result includes a Gateway setup link.
server_capabilities
ChatGPTReturn structured OS, init-system, package-manager, privilege, container-runtime, and diagnostic command capabilities. A successful result is reused for five minutes unless refresh is true.
set_file_acl
ChatGPTEnsure an exact ACL state with explicit recursion. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_file_capabilities
ChatGPTEnsure one exact Linux file-capability set. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_file_xattr
ChatGPTEnsure one bounded xattr has an exact value. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_fstab_entry
ChatGPTAtomically ensure one validated persistent filesystem entry. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_server_endpoint
ChatGPTAssign or correct the endpoint of an endpoint-later server without replacing its canonical server ID, managed SSH identity, region, audit history, or host-key trust. Gateway immediately starts the existing SSH-key verification path by default. A ready server endpoint cannot be replaced through this initial-assignment operation. A Tailscale address (100.64.0.0/10) on a direct server is moved onto the account's only authorized Tailscale connection with a warning; if there are none or several, do not retry: connect or choose the tailnet in the web app under Connectivity.
set_server_region
ChatGPTMove future work for an existing server to an explicit destination region without replacing its server ID, SSH identity, host-key trust, history, or metadata. Gateway verifies the existing endpoint, trusted host key, and managed identity from the destination before committing. Existing jobs are not cancelled; wait_for_active_jobs requests a strict drain before cutover. A server on auto runs each job from the shared region with the most available capacity; an explicit region keeps its jobs in that region. wait_seconds only bounds this MCP call and never cancels the durable verification job.
set_sysctl
ChatGPTEnsure one exact runtime and optionally persistent sysctl value. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_system_hostname
ChatGPTEnsure the persistent hostname has an exact value. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_system_locale
ChatGPTEnsure explicitly supplied locale variables persist. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_system_timezone
ChatGPTEnsure the persistent timezone has an exact IANA value. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
set_windows_service_start_mode
ChatGPTWindows only. Set the start mode of one exact Windows service. SSH, Tailscale, and core OS services cannot be set to manual or disabled. Requires an Administrator SSH account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run.
signal_process
ChatGPTSend one allowlisted non-termination signal to an exact PID. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
ssh_inspect
ChatGPTReturn bounded SSH client/version facts and a safe allowlist of effective sshd settings when available.
start_docker_compose
ChatGPTStart selected services in an exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
start_docker_container
ChatGPTEnsure an exact container is running. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
start_systemd_unit
ChatGPTEnsure an exact systemd unit is active. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
start_windows_service
ChatGPTWindows only. Ensure one exact Windows service is running. Requires an Administrator SSH account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run.
stat_file
ChatGPTInspect one exact filesystem path without following a final symlink. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
stop_docker_compose
ChatGPTStop selected services in an exact Compose project. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
stop_docker_container
ChatGPTEnsure an exact container is stopped. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
stop_systemd_unit
ChatGPTEnsure an exact systemd unit is inactive. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
stop_windows_service
ChatGPTWindows only. Ensure one exact Windows service is stopped without stopping dependent services. Refuses SSH, Tailscale, and core OS services. Requires an Administrator SSH account. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run.
system_health
ChatGPTReturn a compact structured health snapshot. Extended detail adds bounded top-process evidence; missing optional collectors become warnings rather than failing the whole snapshot.
tag_docker_image
ChatGPTEnsure an exact image tag points at a source image. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
tail_file
ChatGPTTail bounded UTF-8 content from one exact log file with an append cursor. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
terminate_process
ChatGPTTerminate an exact PID with explicit force and grace policy. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
test_sudo_access
ChatGPTQuery sudo authorization for one account without executing arbitrary requested commands. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
tracepath_from_host
ChatGPTRun a bounded numeric tracepath from the registered host. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Linux servers only; a Windows server is refused before any job is created.
try_reload_systemd_unit
ChatGPTReload an exact systemd unit only when it is active and reloadable; never restart it. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unhold_package
ChatGPTEnsure exact installed packages are not held from upgrades. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unlink_symbolic_link
ChatGPTUnlink one exact final-component symbolic link without following its target. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unload_kernel_module
ChatGPTEnsure one exact kernel module is unloaded. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unlock_user
ChatGPTEnsure one exact local account is unlocked. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unmask_systemd_unit
ChatGPTEnsure an exact systemd unit is not masked. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unmount_filesystem
ChatGPTEnsure an exact mount target is unmounted. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
unpause_docker_container
ChatGPTEnsure one exact paused Docker container is running. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
up_docker_compose
ChatGPTConverge an exact Compose project to running. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Takes values the user stored in Gateway by name only (*_from fields). Linux servers only; a Windows server is refused before any job is created.
update_schedule
ChatGPTAtomically update one exact managed schedule. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
update_system_packages
ChatGPTConverge all installed packages to available updates without rebooting. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
upgrade_package
ChatGPTConverge an exact package to the requested or newest version. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Runs on Linux and Windows servers.
upload_file
ChatGPTUpload one base64-encoded file to Gateway regional transfer storage. The decoded payload may be at most 16 MiB. Gateway computes the authoritative SHA-256, stores the artifact for 24 hours, and returns a revocable Gateway GET link suitable for curl or wget on a remote host. Upload each file whole, in one call: every file is checked before it can be used, and a file split into parts cannot be checked, so its parts stay unavailable. If a call fails or times out, retry the whole file rather than splitting it. This tool does not upload to a server directly and never persists the base64 payload or bearer token.
validate_docker_compose
ChatGPTValidate an exact Compose file. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
validate_sshd_config
ChatGPTValidate SSH server configuration without reloading. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
validate_sudoers
ChatGPTValidate the canonical sudo policy or one exact canonical drop-in with visudo. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
verify_archive
ChatGPTVerify archive structure and optional digest without extraction. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
verify_certificate_chain
ChatGPTVerify an exact certificate and optional chain against a selected trust store. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
verify_ssh_key
ChatGPTFor a pending server where the Gateway public key was installed manually, create a durable key-authentication check. A successful check verifies host-key trust, activates the pending identity, and promotes the server to ready without using a password.
wait_docker_compose
ChatGPTWait a bounded time for selected Compose services to stop. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
wait_docker_container
ChatGPTWait a bounded time for one exact Docker container condition. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Linux servers only; a Windows server is refused before any job is created.
wait_for_job
ChatGPTWait up to 180 seconds for a durable job to become terminal, then return its latest status, progress, artifact, and ordered output. Reaching the wait timeout never cancels the underlying job.
wait_until_down
ChatGPTWait for a registered server endpoint to become down using bounded structured probes. A wait timeout returns a successful structured result with reached=false, the last observation, and a WAIT_TIMEOUT warning; it never cancels unrelated work.
wait_until_up
ChatGPTWait for a registered server endpoint to become up using bounded structured probes. A wait timeout returns a successful structured result with reached=false, the last observation, and a WAIT_TIMEOUT warning; it never cancels unrelated work.
write_file_atomic
ChatGPTAtomically write exact content with explicit creation and concurrency policy. Runs as a durable typed operation with exact targets, structured results, and normal job/audit history. Supports dry-run. Runs with sudo. If sudo needs approval from the user, the result includes a Gateway setup link. Also accepts a Windows server: the content is written to a temporary file in the destination directory, verified, and published with an atomic replace or move. mode, preserveOwner, preserveGroup, preserveMode, and sudo are Linux-only; a new Windows file inherits the destination directory's ACL and a replaced file keeps its DACL.
write_secret_file
ChatGPTAtomically write a value the user stored in Gateway (content_from) to a normalized Linux path using fail-closed no-follow handling, optional owner/group/mode, and none/sudo/auto privilege. The value never appears in the job, queue, MCP result, command argv, or logs. If sudo needs approval from the user, the result includes a Gateway setup link.
