Low Severity
Published: Nov 8, 2026
A terminal UI (TUI) for agentless, read-only security audit of Linux servers over SSH: CVEs (Trivy, KEV, EPSS), SSH access, exposed ports, host health, ranked by what to patch first, with rollback-ready fixes. One Go binary; also a web dashboard and an MCP server for AI agents.
<h1><img src="docs/brand/banner-en.png" alt="Kanareika: security audit of your servers over SSH"></h1>
[](https://github.com/mikekosulin/kanareika/actions/workflows/ci.yml) [](https://github.com/mikekosulin/kanareika/actions/workflows/coverage.yml) [](https://github.com/mikekosulin/kanareika/releases/latest) [](LICENSE) [](https://github.com/mikekosulin/kanareika)
**English** · [Español](docs/readme/README.es.md) · [Français](docs/readme/README.fr.md) · [Português](docs/readme/README.pt.md) · [Русский](docs/readme/README.ru.md) · [中文](docs/readme/README.zh.md) · [日本語](docs/readme/README.ja.md) · [한국어](docs/readme/README.ko.md)
Agentless, read-only security audit of your servers over SSH: what to patch first, who can get in, what is exposed, whether the hosts are healthy — with fix steps that can be rolled back. One binary, one YAML per organization; the data stays on your machine.
### Terminal interface
Run `kanareika`. It opens on ToDo: what to fix first, most urgent at the top.
### Web interface
Run `kanareika web` for the same data in a browser, with the trend of the last 30 runs.
<sub>Demo data, made up.</sub>
```bash
brew install mikekosulin/tap/kanareika # macOS, Linux; or a binary from the release (Windows too)
kanareika init # orgs/, secrets/, reports/ here (or --home DIR)
kanareika org new myorg # hosts, jump hosts and consent: orgs/myorg.yml
kanareika validate myorg
kanareika db update
```