Gumpbox 1.12.0: Introducing Security

Gumpbox 1.12.0 introduces Security — a continuous security posture system for every Linux server you manage, built into the app on Mac and iOS. This post covers why it's necessary, what you can do with it, and what your AI agent can do on your behalf.

Why it's necessary

If you operate Linux servers on the public internet, they are being probed right now. Automated bots scan around the clock for password-based SSH, exposed databases and caches, missing patches, and weak firewall rules — on every address you own.

Most teams know this. Few can answer the basic question: what is our actual exposure, server by server, today? A one-time audit is stale the week after it ships. A pile of scanner output nobody reads is worse than nothing. Security turns exposure into a continuous, measurable quantity instead of an annual event.

What you can do

See your exposure in one number

Every connected server gets a 0–100 security posture score, computed on two axes:

• External — what the internet can reach: password-based SSH, root sign-in, firewall state, exposed database and cache ports, fail2ban coverage, brute-force pressure, flood indicators.
• Internal — what is already inside: accounts with root-level power, blank passwords, authorized SSH keys, SUID binaries, cron jobs, running processes missing their files, pending patches.

The lower of the two is your score, because an attacker only needs the weaker side. Every point lost maps to one visible check with the exact evidence that triggered it — a score of 45 means something concrete.

Rely on scans you can trust

Gumpbox scans each connected server every 30 minutes (immediately on connect, or on demand) through a single hardened probe: 19 checks covering sign-in configuration, firewall rules, attack-blocking state, failed sign-in attempts, account audit, key baselines, and package updates.

Three rules keep the results honest:

• A failed probe is not a finding. If a tool is missing on the host, the check reports "unknown" and costs no points — the scanner never guesses.
• Change detection starts on the second scan. The first run records a baseline, so a new SSH key or scheduled task is only flagged when it is actually new.
• Critical findings cap the score. Anything critical holds the score below 80; evidence of a possible active compromise — blank passwords, new privileged programs, tampered sign-in history — holds it below 50. A server under attack cannot display "Secure".

Each scan is stored as a report with a stable scan_id, so you can compare posture over time instead of trusting a single snapshot.

Go from finding to fix in one tap

The Actions tab splits its list the way decisions actually happen: one-tap fixes — enable the firewall, install fail2ban, block the top attacking address — and setup recommendations that need your judgment, such as password sign-in policy or root login.

Fixes run through the same previewed, audited command path as every other Gumpbox operation. Each one is logged with its complete output, and a post-fix re-scan shows the score move.

What your agent can do

The full surface is available over MCP: security.perform_scan, security.get_reports, and security.get_report_details. A built-in Security Audit skill stages the procedure — baseline scan, host recon, dependency risk, application-level vulnerability checks — and records every finding as durable memory tied to its scan_id.

The agent is read-only by default. Hardening changes always require your explicit consent.

Availability

Security ships free in Gumpbox 1.12.0 on every tier, on Mac and iOS. The fleet score, full reports, and one-tap fixes all work from your phone.

Download Gumpbox on the App Store