Root access, held accountable.
Giving an agent root on a real server only works if there's a hard line between "look around" and "change something irreversible." rootuno draws that line automatically, in the tool layer — not by asking the model to decide when to be careful.
Four rules, applied to every single action
Nothing here depends on how politely or carefully the request was phrased — the same command gets the same treatment whether the model proposed it on its own or you asked for it directly.
Destructive-command detection
Deletions, disk operations, reboots, firewall flushes, and service/package removal are pattern-matched and flagged automatically — before they run, not after.
Protected system paths
Writes to /etc, /boot, systemd units, SSH configuration, and other sensitive locations require explicit confirmation, regardless of how the change was requested.
Human-in-the-loop by default
Flagged actions stop and wait for an explicit yes/no. Decline, and rootuno explains what it wanted to do and why — it doesn't retry silently or route around the refusal.
Nothing hidden
Every action it takes is a real, visible bash, read_file, or write_file call — never an opaque API call into your infrastructure you can't audit afterward.
What runs immediately, and what waits for you
The distinction isn't about how the request was phrased — it's about whether the underlying action is reversible.
Runs immediately
- Reading logs, config, and system state
- Checking service status and process health
- Non-destructive diagnostics (
df,du,journalctl,ss, …) - Writing to ordinary, non-sensitive files
- Rotating logs, freeing cache, routine cleanup
Pauses for a yes/no
- Deletions, disk wipes, and
rm -rf-style commands - Reboots, shutdowns, and service/package removal
- Firewall flushes and network-rule changes
- Writes to
/etc,/boot, systemd units,/root/.ssh - Anything else pattern-matched as high-risk
The -yes flag exists — use it deliberately
Confirmation prompts can be skipped entirely for a run, for cases like scripted or cron-driven use where no one is watching the terminal.
-yes / -y disables every confirmation prompt for that run — including destructive commands and protected-path writes. It doesn't change what rootuno is willing to do, only whether it asks first. Reserve it for situations where you've already reviewed what rootuno is likely to do, or where a human genuinely isn't available to answer the prompt.
See it work on your own host
Activate a license from the dashboard and point rootuno at a real problem — it'll show you exactly what it's about to do before it does it.