Run a command on a server, with a human in the loop
What you get: the power of SSH without handing an agent the keys. Every call is checked against policy, risky ones are held for a human, and each one leaves a record.
1. See what you can run
Section titled “1. See what you can run”quox fleet toolsName Descriptionssh_exec Execute a shell command on a remote host via SSH bastion....docker_status List Docker containers on a host. Shows container names, ...docker_extended Get detailed Docker information: container logs, stats (C...system_admin System administration tasks: check uptime, list services,...quoxagent_logs Retrieve recent logs from a QuoxAgent agent 158 items2. Run one
Section titled “2. Run one”Name the tool, the host and the input. Always give a reason: it is shown to whoever approves the call.
# a read: list the containers on one hostquox fleet exec --tool docker_status --host web-01 --input '{"all":true}' \ --reason "checking what is running before the release"# a command on the host: this is the kind policy holds for a humanquox fleet exec --tool ssh_exec --host web-01 --input '{"command":"systemctl restart nginx"}' \ --reason "nginx is serving stale config after the deploy"If policy holds the call, it does not run. An approval card appears for a human, with your reason, the host and the exact command on it. --session-label puts a name on the card so the approver knows which session asked.
3. Get the answer
Section titled “3. Get the answer”Once someone approves, the call runs. Read what it returned:
quox approvals result <approval-id>What just happened
Section titled “What just happened”Your call went through Bastion, not straight to the machine. Policy decided whether it could run now or needed a person, and the call and its outcome were written to the witness chain. The command ran under QuoxAgent on the host, never with keys handed to an agent.
Check it yourself
Section titled “Check it yourself”Every held call is in the approvals queue: quox inbox list --awaiting-human. For routine commands you trust, an org admin can pre-approve a narrow pattern on one host: see Pre-approve a narrow lane.
A held call that nobody approves never runs. A call that ran cannot be un-run, so read the card before you approve.