girste/mcp-cybersec-watchdog

Build

make build
# or
./build.sh

Run

# Single audit
sudo ./bin/chihuaudit audit

# JSON output
sudo ./bin/chihuaudit audit --json

# Continuous monitoring
sudo ./bin/chihuaudit monitor --interval=5m

# Generate config
./bin/chihuaudit init-config

Terminal Output

=== CHIHUAUDIT REPORT ===
Timestamp: 2026-02-05 12:38:27
Hostname: server.example.com
OS: Ubuntu 24.04.3 LTS

--- 1. SECURITY ---
Firewall: active (ufw) ✓
SSH: active
SSH Port: 2244
SSH Password Auth: disabled ✓
SSH Root Login: no ✓
External Ports: [443, 80, 2244]
Localhost-Only Ports: [5432, 6379]
SSL Certificates: 5 (all valid)

--- 2. SERVICES ---
Total Running: 31
Failed: 0 ✓
Web: caddy (active)
Database: postgresql (active)

[... 8 more categories ...]

Total Checks: 87

Chihuaudit supports webhook notifications for real-time monitoring alerts. While optimized for Discord, it works with any webhook-compatible service (Slack, Microsoft Teams, Mattermost, custom endpoints, etc.).

Color-coded alerts: 🟢 Green (healthy), 🟡 Yellow (warnings), 🔴 Red (critical)

Setup

# Generate default config
./bin/chihuaudit init-config

# Edit configuration
nano ~/.chihuaudit/config.json

Configuration

{
  "discord_webhook": "https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN",
  "notification_whitelist": {
    "cpu_threshold": 70,
    "memory_threshold": 70,
    "disk_threshold": 85,
    "ignore_changes": ["uptime", "active_connections"]
  }
}

Webhook Compatibility

Discord (native support):

• Rich embeds with color-coded alerts
• Custom avatar and username
• Timestamp and structured fields

Slack (works with minor format differences):

• Use discord_webhook field with your Slack webhook URL
• Embeds translate to Slack attachments
• Colors and formatting preserved

Other services:

• Any service accepting JSON POST with embeds field
• Microsoft Teams incoming webhooks
• Mattermost webhooks
• Custom webhook handlers

Alert Thresholds

CPU Load: Trigger when load average exceeds threshold
Memory Usage: Alert on RAM usage percentage
Disk Space: Warning when disk usage crosses limit
Ignore List: Skip notifications for frequently changing metrics

Monitoring Mode

# Monitor every 5 minutes with webhook alerts
sudo ./bin/chihuaudit monitor --interval=5m

Changes are detected and only significant events trigger notifications, reducing alert fatigue.

• Universal: Works on any Linux distro without configuration
• Portable: Single static binary, zero dependencies
• Safe: Read-only checks, no system modifications
• Fast: Parallel execution, ~1 second for full audit
• Simple: Minimal code, maximum clarity
• Automated: Perfect for CI/CD and monitoring

chihuaudit/
├── main.go           # CLI entry point
├── checks/           # 10 audit categories
│   ├── security.go   # Firewall, SSH, SSL, ports
│   ├── services.go   # Systemd, web, DB servers
│   ├── resources.go  # CPU, RAM, disk
│   └── ...
├── detect/           # OS/tool detection
├── notify/           # Discord webhooks
├── report/           # Text/JSON formatters
└── state/            # Change tracking