G27 · Spec 007 · Class: read-only
Host firewall diagnostics and port reachability: detects active firewall backends
(firewalld, nftables, iptables, ufw), inspects rules matching specified
ports, checks default chain and zone policies, and tests TCP reachability to target
endpoints via nc or bash /dev/tcp.
The script never loads, flushes, or modifies any rule set. All checks are strictly
Diagnostics for corporate HTTP/HTTPS proxy configuration and TLS CA trust chains.
Inspects proxy environment variables, verifies NO_PROXY bypass rules against targets
(supporting exact match, domain suffix, CIDR prefix, and wildcard *), checks system and
per-tool CA trust bundles, detects TLS interception by comparing direct vs proxy certificate
chains, and probes HTTP CONNECT tunnel status.
Includes a do-nothing dry-run mode (--dry-run) that prints every command and
waits for the operator, so the script can be walked through safely without executing network calls.
First-look triage for a host that feels slow or is killing processes: load average, memory and swap, pressure stall information (PSI), OOM kills, file descriptors, disk and inode usage, optional per-PID or per-service details, top CPU and memory consumers, failed systemd units and, optionally, Kubernetes node pressure and OOMKilled pods. It does not fix anything.
Includes a do-nothing dry-run mode (--dry-run) that prints every command and
waits for the operator, so the script can be walked through without touching a system.
G24 · Spec 007 · Class: read-only
Network path diagnostics: interfaces, routes, default gateway, resolver configuration, per-phase request timing (DNS, connect, TLS, first byte), SNI-specific TLS certificate check, path-MTU probe, local listeners, conntrack headroom, proxy variables, and optional traceroute.
The script never modifies routes, firewall rules, or any system configuration.
Checks whether a host's clock is healthy: which sync daemon is in use, its state, offset,
stratum, last sync and reference source, optional skew against an HTTPS Date header, and
the effect of skew on a certificate's validity window. Reach for it when TLS, Vault, token
or Raft errors smell like clock drift. It does not fix anything.
Includes a do-nothing dry-run mode (--dry-run) that prints every command and
waits for the operator, so the script can be walked through without touching a system.
Scrubs secret-like values from a file, a directory tree or stdin and writes redacted
copies. Originals are never modified. Reach for it before you attach logs, YAML,
describe output or config to a ticket, a chat or an archive. It also works as a gate:
--check writes nothing and exits 1 when any rule matches.
Redaction is best-effort. Pattern matching cannot find every secret, and it can miss values in formats it does not know. Review the redacted output before you share it. Do not treat a clean run as proof that nothing sensitive is left.
SELinux denial triage for RHEL-family hosts. Reports the SELinux mode, groups recent AVC denials by source and target type, checks file labels, service domains and port labels, lists related booleans, and suggests the least invasive fix first: relabel, then boolean, then port label, then a custom module.
Supports automated mode (read-only checks, a findings summary, then a fix
menu where every change is confirmed), --dry-run do-nothing mode (prints
Cloud instance metadata retrieval for delivery sessions. Auto-detects whether you are on AWS, GCP or Azure by probing the link-local metadata service, then prints the facts you usually need first: identity, location, size, image, networking, and any pending maintenance or preemption events.
Supports automated mode (query and summarise) and --dry-run
do-nothing mode (prints every command and waits for manual execution).
Logical Volume Manager (LVM) inspection and mount management for delivery
sessions. Reports Physical Volumes (PVs), Volume Groups (VGs), and Logical
Volumes (LVs); audits mount status and /etc/fstab consistency; flags disk
usage thresholds; and provides guided actions to extend, create, mount, and
unmount volumes — all with confirmation gates before any write operation.
Supports automated mode (full status report + interactive action menu) and
--dry-run do-nothing mode (prints every LVM and mount command and waits
cloud-init and user_data debugger for delivery sessions. Auto-detects the cloud
provider (AWS, GCP, Azure, VMware, or local/physical) and runs the appropriate
log collection, status checks, metadata queries, and re-run instructions. Covers
both cloud-init and provider-specific user_data runners (e.g. GCP
google_metadata_script_runner).
Supports automated mode (full collection and archive) and --dry-run
do-nothing mode (prints every command and waits for manual execution).
