Low Severity
Published: Nov 9, 2026
Agentless, read-only security audit of Linux servers over SSH. Ranks what to patch first: CVEs with KEV and EPSS, SSH access, exposed ports, host health, with rollback-ready fixes. Terminal UI (TUI), web UI and an MCP server in one Go binary. No telemetry.
<h1><picture><source media="(prefers-color-scheme: dark)" srcset="docs/brand/banner-en.webp"><img alt="Kanareika: security audit of your servers over SSH" src="docs/brand/banner-en-light.webp"></picture></h1>
[](https://github.com/mikekosulin/kanareika/actions/workflows/ci.yml) [](https://github.com/mikekosulin/kanareika/actions/workflows/coverage.yml) [](https://github.com/mikekosulin/kanareika/releases/latest) [](LICENSE) [](https://github.com/mikekosulin/kanareika)
**English** · [Español](docs/readme/README.es.md) · [Français](docs/readme/README.fr.md) · [Português](docs/readme/README.pt.md) · [Русский](docs/readme/README.ru.md) · [中文](docs/readme/README.zh.md) · [日本語](docs/readme/README.ja.md) · [한국어](docs/readme/README.ko.md)
Agentless, read-only security audit of Linux servers over SSH. It ranks what to patch first: CVEs with KEV and EPSS, SSH access, exposed ports, host health, each with fix steps that can be rolled back. It works the same in a terminal UI, a web UI and through an MCP server for AI agents. One Go binary, one YAML per organization, no telemetry; the data stays on your machine.
- **Homelab**: pick your hosts from `~/.ssh/config` or paste `user@host`.
- **Freelancer**: one organization per client; add servers to it later.
- **Company fleet**: paste a host list, CSV or Ansible inventory; failed logins are grouped by cause, with the fix.
### Terminal interface
Run `kanareika`. It opens on ToDo: what to fix first, most urgent at the top.
<picture><source media="(prefers-color-scheme: dark)" srcset="docs/screenshots/tui-en.w