Quick start

Scan, understand, apply, recover. This walks the whole loop on the command line; the TUI and web dashboard drive the exact same engine if you prefer them.

1. Scan locally

Just run a scan — hostveil elevates itself with sudo automatically so the SSH and firewall checks can read root-owned files. You'll see the same sudo password prompt as sudo hostveil:

hostveil scan

You get a single 0–100 security score and a list of findings ordered by severity. Areas whose tooling is absent (no Docker, no Trivy) are skipped and the score is renormalized — a clean host shows Clean, not a hollow 100.

Tip

On an interactive terminal, running hostveil with no arguments opens the TUI instead. Piped or redirected, it prints a scan — handy in scripts.

2. Understand a finding

Add -v to see each finding's plain-language description and fix guidance inline:

hostveil scan -v

Or dig into one finding by its ID (for example ssh.rootlogin):

hostveil explain ssh.rootlogin

Want a second opinion in your own words? Add --ai for an advisory explanation from a local model — see AI explanations. Every finding ID and what it means is listed in What it checks.

3. Apply a fix

Fixing always shows the exact change first and backs up the original before touching anything. Preview and apply one finding:

hostveil fix ssh.rootlogin

Or apply every clearly-safe (Auto) fix at once — Review and Manual findings are left for you to decide:

hostveil fix --all

See Fixing & rollback for how Auto, Review, and Manual differ.

4. Roll back anytime

Every applied fix is a checkpoint. List them, then undo one by its ID:

hostveil history
hostveil rollback <checkpoint-id>

Rollback restores the backed-up file byte-for-byte. Because every interface goes through one shared engine, a fix applied in the TUI or web dashboard is reversible here too.