Every card below is the agent doing what it actually does: you type the ask, it works over SSH on the host you're connected to, and by default anything that changes state waits for your approval.
Paging you at 3am shouldn't mean 40 minutes of grep. The agent tails logs, correlates errors across the services on the box, and hands you a root cause with the fix queued for approval.
Pull the release, restart the service, hit the health endpoint — one ask. Every step that changes the box renders as the exact command, and waits for your click.
Edit nginx configs, env files, and unit files remotely in the built-in file browser — and have the agent run the config test before you approve the reload.
Fresh VM to production-ready: users, firewall, runtime, service units. The agent proposes each step; you approve the ones that matter.
Check kernel and package versions on the host you're connected to, stage the upgrades, and schedule the reboot — every step a command you read first, not a blind apt on prod.
CPU spike, memory leak, disk at 89% — the agent finds the culprit process or directory and proposes the cleanup for your approval. The genuinely destructive shapes are denylisted: they ask every time, even with auto-approve on.
Review sshd_config, authorized_keys, and sudoers on any host. The agent flags password auth, stale keys, and over-broad sudo — and drafts the hardening change.
Open ports, listening services, firewall rules, TLS versions — a full surface check in one conversation, with fixes queued behind the approval gate.
Check certificate expiry on a host before the browser warning does it for you — then leave a watcher re-running the check on a schedule while the app is open. Renewals are proposed, never auto-fired.
Slow queries, lock contention, replication lag — the agent runs the pg_stat and EXPLAIN queries, reads the output, and tells you what's blocking what. Terminating a backend is its own approval.
Backups that were never restored are hopes, not backups. Check the cron ran, the dumps exist, and the sizes look sane — on the host you're connected to, in one ask.
The copilot keeps persistent memory per server — services, quirks, past incidents — in a SQLite file on your Mac. Come back a month later and ask what it already knows about this host.
Download the app, add a host, and hand off the grunt work. 200 credits to start.