agent-linux

Ghostpsy — Linux agent

Open-source Go agent for Ghostpsy: it collects an allowlisted snapshot of a Linux host (OS, listeners, packages, SSH posture, time skew hints, and more), shows a full JSON preview, then posts to your Ghostpsy API with a one-time ingest token.

You can audit every collector under internal/collect/ before you run the binary.

Run the latest release (recommended)

This downloads the correct static binary for your CPU (amd64, arm64, or 386), checks it against SHA256SUMS from the same GitHub Release, then starts an interactive scan.

1. Ingest token — In the Ghostpsy web app, sign in and use New ingest token in the header. Copy the value when it appears; each token works for one successful upload only.

2. Run (needs bash, curl, and sha256sum or shasum; run with bash, not plain sh):

The script prompts for the token on /dev/tty, so curl … | bash still works from a real terminal. For automation, set GHOSTPSY_INGEST_TOKEN before curl (see below).

curl -fsSL https://raw.githubusercontent.com/ghostpsy/agent-linux/main/run-agent.sh | bash

Or clone the repo and run ./run-agent.sh.

run-agent.sh always sets the API base URL to https://api.ghostpsy.com (not overridable). It asks for the ingest token when GHOSTPSY_INGEST_TOKEN is unset:

Example without token prompt:

export GHOSTPSY_INGEST_TOKEN="your-one-time-token"
curl -fsSL https://raw.githubusercontent.com/ghostpsy/agent-linux/main/run-agent.sh | bash

If there is no Release yet (or the API call fails), the script prints a link to the Build workflow: open the latest successful run → Artifacts → download ghostpsy-linux-<arch> and SHA256SUMS, verify with sha256sum -c SHA256SUMS, then run the binary with the same env vars and ghostpsy scan.

Prebuilt binaries and Releases

• Releases — Versioned binaries and SHA256SUMS are attached to GitHub Releases when a maintainer pushes a version tag such as v0.1.0 (see release workflow).
• CI artifacts — Every push to main and each pull request also produces per-arch artifacts in the Build Linux agent workflow runs (ghostpsy-linux-amd64, ghostpsy-linux-arm64, ghostpsy-linux-386, plus SHA256SUMS).

Binaries are built with CGO_ENABLED=0 (static; no glibc version lock-in to the build machine).

Why open source

• Trust: Security and ops teams can read what runs on the server.
• Reproducible builds: CI builds linux/amd64, linux/arm64, and linux/386 with published checksums.
• Clear scope: Collectors target the ingest v1 contract (JSON shape aligned with the Ghostpsy product).

What it does (and does not do)

Requirements

• OS: Linux only (GOOS=linux in release builds).
• API: A Ghostpsy deployment with POST /v1/ingest and dashboard- or CLI-minted ingest tokens.
• Permissions: Some collectors need elevated access; root is typical for server audits.

Build from source

git clone https://github.com/ghostpsy/agent-linux.git
cd agent-linux
make test
make build
./bin/ghostpsy help
./bin/ghostpsy scan -dry-run

Module path

Go module: github.com/ghostpsy/agent-linux

License

Apache License 2.0 — see LICENSE.