How to Run an AI SSH Server Admin Agent with OE Runtime

Run a full health check on any remote Linux server via SSH. OE Runtime connects with your private key, runs system commands, checks services and security, and delivers a structured HEALTHY / WARNING / CRITICAL report — no SSH client or manual commands needed.

The Agent YAML

Create a file called agent.yaml inside an ssh/ directory:

name: Server Admin Agent
description: Run a health check on a remote Linux server via SSH
instructions: |
  You are a server administrator. Use SSH to run commands on remote servers.
  Check system health, monitor resources, and report findings clearly.
  Always explain what each command is checking before running it.
  Complete all steps fully before writing your report.
steps:
  - name: Gather System Info
    content: |
      Run these SSH commands one at a time:
      1. uname -a  (kernel and OS info)
      2. uptime    (load average and uptime)
      3. df -h     (disk usage per mount point)
      4. free -m   (memory usage)
      5. top -bn1 | head -20  (CPU and top processes)
  - name: Check Services and Security
    content: |
      Run these SSH commands one at a time:
      1. ss -tlnp              (open ports and listening services)
      2. systemctl list-units --state=failed  (failed systemd services)
      3. last -n 10            (recent logins)
      4. journalctl -p err --since "24 hours ago" | tail -20  (recent errors)
  - name: Report
    content: |
      Produce a server health report:
      - OS and kernel version
      - Uptime and load average (flag if load > number of CPUs)
      - Disk usage (flag any mount > 80% full)
      - Memory usage (flag if used > 90%)
      - Open ports and services
      - Failed services (if any)
      - Recent logins
      - Recent error log entries
      - Overall status: HEALTHY / WARNING / CRITICAL
connectors:
  - connection_name: My Server
    connection_type: ssh

The Config File

Create oe-config.json in the same directory:

{
  "llm": {
    "provider": "openai",
    "model": "gpt-4o",
    "apiKey": "YOUR_OPENAI_API_KEY"
  },
  "server": {
    "enabled": false,
    "port": 3333,
    "apiKey": "your-secret-api-key"
  },
  "connectors": [
    {
      "connection_name": "My Server",
      "connection_type": "ssh",
      "host": "192.168.1.100",
      "port": 22,
      "username": "ubuntu",
      "privateKey": "/path/to/id_rsa"
    }
  ]
}

Replace the host with your server's IP or hostname and point privateKey to your SSH private key file path. The username is typically ubuntu for AWS EC2, root or admin for other providers. Ensure the public key is in the server's ~/.ssh/authorized_keys.

Download OE Runtime

Run the Agent

Windows

# Run the agent
oe-runtime-win.exe ssh/agent.yaml --config ssh/oe-config.json

macOS

# Make executable (first time only)
chmod +x oe-runtime-macos

# Run the agent
oe-runtime-macos ssh/agent.yaml --config ssh/oe-config.json

Linux

# Make executable (first time only)
chmod +x oe-runtime-linux

# Run the agent
oe-runtime-linux ssh/agent.yaml --config ssh/oe-config.json

Running as an API Server

Add --serve to start OE Runtime as an HTTP server on port 3333:

oe-runtime-win.exe --serve --config ssh/oe-config.json

Then send a request:

curl -X POST http://localhost:3333/run \
  -H "Content-Type: application/json" \
  -d '{"yaml": "ssh/agent.yaml", "params": {}}'

Or import the Postman collection (download above) to test all endpoints visually.

Use Cases

• Automated server health monitoring — Run the agent on a schedule to check CPU load, memory usage, disk space, and failed services across your Linux servers without logging in manually. The structured HEALTHY / WARNING / CRITICAL report gives your ops team an instant status overview and flags problems before they escalate.
• Incident investigation — During a production incident, run the agent to quickly gather system state — load average, top processes, recent error logs, and open connections — without needing to SSH into the server yourself. The consolidated report gives you the information needed to diagnose the problem in seconds rather than minutes.
• Disk space management — Regularly audit disk usage across your servers to identify mount points approaching their capacity limits before they cause service outages. The agent flags any mount above 80% full and can be triggered to alert your team before a disk-full event brings down a service.
• Security log review — Analyse recent login activity and system error logs to identify unexpected access attempts, failed authentication events, or unusual user activity. The agent surfaces the last 10 logins and recent error log entries so your security team can spot anomalies without manual log parsing.
• Post-deployment verification — After deploying new code or configuration changes to a server, run the agent to confirm that all expected services are running, no new errors have appeared in the logs, and system resources are within normal ranges. This provides automated post-deployment validation without writing custom health checks.
• Compliance evidence collection — Gather server configuration details, open port lists, and user login records as evidence for security audits or compliance reviews. The agent produces a structured, timestamped report that can be shared with auditors as documentation of the server's state at a specific point in time.
• Multi-server fleet auditing — Run the agent as an API server and call it from a wrapper script to health-check dozens of servers in sequence, collecting reports from each. This builds a fleet-wide health dashboard without requiring a dedicated monitoring platform.
• Capacity planning — Monitor memory, CPU, and disk usage trends over time by running the agent regularly and comparing reports. Consistent high load or steadily increasing disk usage are signals that a server needs to be scaled up or that workloads need to be redistributed before performance degrades.