shld records what is installed.
On each server: Debian and Alpine packages, plus Python, Node, Go and Rust lockfiles in a folder you choose.
What happens after you copy the prompt.
- Your agent installs or updates shldFrom the verified release, keeping existing configuration and evidence.
- You approve the serverOpen the link your agent gives you, sign in with your company account, enter the code.
- shld connects alertsAlerts go to your company’s email recipients.
Your agent checks monitoring and notification status. You confirm that the test email arrived.
View prompt
Fetch and follow https://shld.app/agent-setup/prompt.md. Install or update shld on my Linux server and connect administrator alerts. Ask for missing server access or the directory to monitor before making changes. Preserve existing configuration, credentials, and collected evidence. Use the guide’s verified release and upgrade procedure. Handle setup within this scope. Explain any required service interruption before the upgrade. Give me the approval URL and code when authorization is required. Reuse an existing valid connection. Verify authorization, monitoring, and notification status separately. Report alert recipients and any remaining setup blockers. Ask me to confirm receipt of the connection-check email.
Two ways shld flags a server.
A server can need a patch without a single file changing, so file monitoring alone is not enough. Both paths end the same way: a finding with its evidence, and an email alert.
Known vulnerabilities
- Installed software
- Advisory match
- Alert
shld rechecks the software list whenever the advisory feed changes.
Suspicious activity
- Observed behaviour
- Rule match
- Alert
shld watches programs, files, network connections and a decoy file you choose.
Technical example: both flows, step by step
A new advisory
A new advisory arrives.
An advisoryA public notice that some versions of a program have a security hole. says which versions of a program have a security hole. shld fetches a signed advisory feed you control, every 6 hours.
shld checks the same list again.
No file on web-01 changed, yet cross-spawn 7.0.3 falls inside the affected range. File monitoring alone would stay silent.
You get a finding, with the evidence.
The findingshld’s saved note that something matched, with the evidence behind it. names the server, package, version, advisory and severity. In the private trial you also get an email. shld never patches anything or stops a program.
Suspicious activity
It also watches what programs do.
The programs, files and network connections the agent can see, plus a decoy fileAn empty file you choose to watch. Normal work has little reason to open it. you choose.
Two signs on one program.
Process 4 holds the decoy open and has a network connection within 120 seconds. That matches the canary-egress rule. Process 2 has only a connection, so no finding.
A finding, and nothing is stopped.
shld records the rule and the events behind it. Process 4 keeps running. A finding is a warning sign: you read the evidence and decide.
Example finding.
- Server
web-01- Package
cross-spawn 7.0.3- Advisory
GHSA-3xgq-45jj-v275- Severity
- High
- Found in
/srv/app/package-lock.json
Example values.
58 seconds · 1.6 MB · English captions · the decoy-file example
What shld does not do.
- Patch software or stop programs. shld reports. You decide and act. Installing or updating shld itself does change the server.
- Prove an attack happened. A finding is a warning sign. Read the evidence before you respond.
- Catch everything. No match does not mean a package is clean, and distro backports can cause false alerts.
What stays on your server, and what shld sends.
Stays on your server
- The software list and every finding with its evidence, in a tamper-evident log.
- The local report: command-line JSON, a local API on loopback, and the system journal.
- File contents. shld does not collect them.
Sent to shld’s hosted service
- Alerts about findings: server, issue, severity and time, so the service can email your recipients.
- Heartbeats, so you hear when a server stops checking in.
- Your approval: you sign in at app.shld.app with your company account; the server connects to api.shld.app.
Status.
Works today
- Reads Debian and Alpine packages, plus Python, Node, Go and Rust lockfiles.
- Rechecks that list when a new advisory feed arrives, fetched every 6 hours from an endpoint you set.
- Flags selected program, network, persistence and decoy-file activity.
- Signed prerelease downloads for Linux amd64 and arm64.
- Hosted email alerts about findings and about servers that stop checking in, after you approve the server.
Not yet
- RPM, Composer and Gemfile, or PHP and Ruby runtime versions.
- Handling distro backports, which can cause false alerts.
- Fixed versions, reference links, and marking a fix verified on the next check.
- A maintained advisory feed.
- Measured results on production servers.
Set up shld on your Linux server.
Linux on amd64 or arm64 with systemd. Private trial: no billing, Apache-2.0. Read what stays on your server and what shld sends.