A portable, single-binary system auditing tool for Linux. Like Lynis but faster and smarter. No configuration needed. No dependencies. Just run. - 🔒 Security: Firewall, SSH hardening, SSL/TLS, fail2ban, SUID binaries, open ports - 🚀 Services: Systemd services, web servers, databases, Docker - 💻 Resources: CPU, RAM, disk usage, top processes - 💾 Storage: SMART health, inode usage, filesystem er
Add this skill
npx mdskills install girste/mcp-cybersec-watchdogComprehensive Linux system auditing tool with 87 checks across 10 categories, zero dependencies, and webhook monitoring
1<div align="center">2345[](https://github.com/girste/CHIHUAUDIT/actions/workflows/ci.yml)6[](https://github.com/girste/CHIHUAUDIT/actions/workflows/lint.yml)7[](https://github.com/girste/CHIHUAUDIT/actions/workflows/codeql.yml)8[](https://github.com/girste/CHIHUAUDIT/actions/workflows/trivy.yml)9[](https://github.com/girste/CHIHUAUDIT/actions/workflows/snyk.yml)1011[](https://scorecard.dev/viewer/?uri=github.com/girste/CHIHUAUDIT)12[](https://www.bestpractices.dev/projects/11858)13[](https://slsa.dev)14[](https://goreportcard.com/report/github.com/girste/CHIHUAUDIT)1516</div>1718---1920## 🎯 What is Chihuaudit?2122A portable, single-binary system auditing tool for Linux. Like [Lynis](https://cisofy.com/lynis/) but faster and smarter.2324**No configuration needed. No dependencies. Just run.**2526```bash27sudo ./chihuaudit audit28```2930## ✨ Features3132- **🔒 Security**: Firewall, SSH hardening, SSL/TLS, fail2ban, SUID binaries, open ports33- **🚀 Services**: Systemd services, web servers, databases, Docker34- **💻 Resources**: CPU, RAM, disk usage, top processes35- **💾 Storage**: SMART health, inode usage, filesystem errors36- **🗄️ Databases**: PostgreSQL, MySQL, Redis health checks37- **🐳 Docker**: Container status, resource usage, volumes38- **🌐 Network**: DNS resolution, latency, interfaces, connections39- **📦 Backups**: Backup detection and freshness checks40- **📝 Logs**: Error analysis, SSH attempts, service restarts41- **⏰ Monitoring**: Continuous mode with Discord webhook notifications4243## 🤖 Claude Skill Alternative44454647**Don't want to install anything?** Use the **Claude Skill** version instead!4849Execute the same comprehensive system audit directly through Claude (Sonnet, Opus, or Haiku) using native shell commands - no binary installation required.5051**Key Benefits**:52- 🚀 **Zero Installation** - Works immediately with sudo access53- 🔄 **Consistent Results** - 1+ year of production use with extremely reliable output54- 📊 **Same Coverage** - All 87 checks, 10 categories, identical methodology55- ⚡ **Fast** - 30-90 second execution time5657**Requirements**: Linux with systemd, sudo NOPASSWD configured, Claude with shell access5859**Documentation**: [docs/skill/chihuaudit-skill.md](docs/skill/chihuaudit-skill.md)6061---6263<details>64<summary><h2>🚀 Quick Start</h2></summary>6566### Build6768```bash69make build70# or71./build.sh72```7374### Run7576```bash77# Single audit78sudo ./bin/chihuaudit audit7980# JSON output81sudo ./bin/chihuaudit audit --json8283# Continuous monitoring84sudo ./bin/chihuaudit monitor --interval=5m8586# Generate config87./bin/chihuaudit init-config88```8990</details>9192<details>93<summary><h2>📊 Example Output</h2></summary>9495### Terminal Output9697```98=== CHIHUAUDIT REPORT ===99Timestamp: 2026-02-05 12:38:27100Hostname: server.example.com101OS: Ubuntu 24.04.3 LTS102103--- 1. SECURITY ---104Firewall: active (ufw) ✓105SSH: active106SSH Port: 2244107SSH Password Auth: disabled ✓108SSH Root Login: no ✓109External Ports: [443, 80, 2244]110Localhost-Only Ports: [5432, 6379]111SSL Certificates: 5 (all valid)112113--- 2. SERVICES ---114Total Running: 31115Failed: 0 ✓116Web: caddy (active)117Database: postgresql (active)118119[... 8 more categories ...]120121Total Checks: 87122```123124</details>125126<details>127<summary><h2>🔧 Webhook Notifications</h2></summary>128129Chihuaudit supports **webhook notifications** for real-time monitoring alerts. While optimized for Discord, it works with **any webhook-compatible service** (Slack, Microsoft Teams, Mattermost, custom endpoints, etc.).130131<img src="docs/test-screen.png" width="500" alt="Discord Webhook Examples">132133*Color-coded alerts: 🟢 Green (healthy), 🟡 Yellow (warnings), 🔴 Red (critical)*134135### Setup136137```bash138# Generate default config139./bin/chihuaudit init-config140141# Edit configuration142nano ~/.chihuaudit/config.json143```144145### Configuration146147```json148{149 "discord_webhook": "https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN",150 "notification_whitelist": {151 "cpu_threshold": 70,152 "memory_threshold": 70,153 "disk_threshold": 85,154 "ignore_changes": ["uptime", "active_connections"]155 }156}157```158159### Webhook Compatibility160161**Discord** (native support):162- Rich embeds with color-coded alerts163- Custom avatar and username164- Timestamp and structured fields165166**Slack** (works with minor format differences):167- Use `discord_webhook` field with your Slack webhook URL168- Embeds translate to Slack attachments169- Colors and formatting preserved170171**Other services**:172- Any service accepting JSON POST with `embeds` field173- Microsoft Teams incoming webhooks174- Mattermost webhooks175- Custom webhook handlers176177### Alert Thresholds178179**CPU Load**: Trigger when load average exceeds threshold180**Memory Usage**: Alert on RAM usage percentage181**Disk Space**: Warning when disk usage crosses limit182**Ignore List**: Skip notifications for frequently changing metrics183184### Monitoring Mode185186```bash187# Monitor every 5 minutes with webhook alerts188sudo ./bin/chihuaudit monitor --interval=5m189```190191Changes are detected and only significant events trigger notifications, reducing alert fatigue.192193</details>194195<details>196<summary><h2>🎯 Design Philosophy</h2></summary>197198- **Universal**: Works on any Linux distro without configuration199- **Portable**: Single static binary, zero dependencies200- **Safe**: Read-only checks, no system modifications201- **Fast**: Parallel execution, ~1 second for full audit202- **Simple**: Minimal code, maximum clarity203- **Automated**: Perfect for CI/CD and monitoring204205</details>206207## 📖 Documentation208209- [Installation Guide](docs/INSTALLATION.md)210- [Development Log](docs/DEVELOPMENT.md)211- [Contributing Guidelines](CONTRIBUTING.md)212213<details>214<summary><h2>🏗️ Architecture</h2></summary>215216```217chihuaudit/218├── main.go # CLI entry point219├── checks/ # 10 audit categories220│ ├── security.go # Firewall, SSH, SSL, ports221│ ├── services.go # Systemd, web, DB servers222│ ├── resources.go # CPU, RAM, disk223│ └── ...224├── detect/ # OS/tool detection225├── notify/ # Discord webhooks226├── report/ # Text/JSON formatters227└── state/ # Change tracking228```229230</details>231232## 🤝 Contributing233234Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.235236Keep code:237- **Simple**: Minimal, readable, maintainable238- **Portable**: Detection-based, no hardcoded paths239- **Safe**: No shell injection, no user input in commands240- **Consistent**: Follow existing patterns241242## 📜 License243244MIT License - see [LICENSE](LICENSE) for details245246---247248<div align="center">249250**Made with ❤️ for sysadmins everywhere**251252[](https://opensource.org/licenses/MIT)253254</div>255
Full transparency — inspect the skill content before installing.