// AGENT SKILLS
SHC Operator Skills
A VPS your AI already knows how to run.
Skills your AI agent loads to run your SHC server for you, end to end. The agent does every step; you never open a terminal or paste a password. Works with any AI assistant.
Works with any AI assistant. Your agent's first step is get-access -- it signs you up through the API, so there is no control panel to learn and no password to type. Machine index: index.json. The five rules every skill follows: discipline.md.
Skills
| Skill | Does | Use when |
|---|---|---|
get-access | The FIRST skill -- run before any other. Creates the user's SHC account via one anonymous API call (no website) and returns an operate-scoped key. Never prints or asks for a password. | Run this FIRST, before anything else, the moment the user asks you to do anything with SHC (a server, a Bitcoin store, a cloud). ALSO run it any time an SHC call returns 401 or says "unauthorized" or "authentication required" -- that means you do not have a key yet. |
shc-deploy-app | Deploy a self-hosted app onto a fresh SHC VPS end to end via the verified-deploy loop (check the app's docs, install once, prove it with a live healthcheck). The agent does every step over SSH. | The user asks their agent to "deploy X on my server", "set up a self-hosted X", "make me a Bitcoin payment store", "give me my own private cloud", or names any app in the recipe library. Use this whenever the goal is to stand up a real service on an SHC VPS the agent has SSH to. |
nostr-operate-lane | A customer authorizes YOU (a specific AI agent) to operate ONE of their SHC VMs by signing a Nostr grant. You exchange that grant for a short-TTL, service-scoped, cannot-spend operate Bearer and use it against that one VM only. No password, no website, no broad key. | Use when a customer wants to hand YOU operation of ONE specific VM service over Nostr (NIP-07/NIP-46 keys), instead of giving you an account-wide API key. Trigger: the customer offers a signed kind:30078 operate grant, OR you need to act on a single VM the customer owns and they would rather sign a scoped grant than share a key. ALSO re-run this any time your operate Bearer returns 401 (expired/used-up) -- mint a fresh one; the grant is re-usable until it expires. |
shc-pay | Present an SHC account-credit top-up as a no-dependency scannable QR plus copy/paste fallbacks, and confirm payment only after a real balance re-read. Never auto-pays. Runs in the agent's own shell. | The user wants to add prepaid credit to their SHC account ("put $25 on my account so my servers keep running"), OR a deploy/order step reports it needs funds. Use after someone has called POST /account/credit and you hold the returned JSON; this skill turns that JSON into a friendly "here is how to pay". |
wait-until-ready | Block until a fresh SHC VPS is operable -- confirm the server is up and the agent's SSH + sudo work before any deploy touches it. The first thing every VPS-side operator skill depends on. | Right after ordering/provisioning a VPS, before running any deploy (shc-deploy-app), point-a-domain, harden-ssh, or nightly-backup. Use it as the gate: call it, walk away, proceed only once the VPS is ready. |
point-a-domain | Make a domain or subdomain resolve to the VPS public IP (A/AAAA), then verify it globally, so automatic TLS (Let's Encrypt) can validate. Prerequisite for any HTTPS service the agent deploys. | Before deploying any app that serves HTTPS (BTCPay, Nextcloud, anything with a web UI). The user picked a hostname; this makes it point at their VPS and confirms it resolves before the deploy's TLS step runs. |
harden-ssh | Lock down a fresh SHC VPS -- key-only SSH, unattended security upgrades, and a default-deny firewall opening only the ports the services need. Verifies it can still reconnect before committing (no lockout). Idempotent. | After a deploy (so you know which ports the app needs), or any time the user asks to "secure / lock down / harden my server". Safe to re-run. |
nightly-backup | Install a nightly encrypted backup of a deployed app's data + database to a destination the user controls, with a mandatory verify-restore drill so "your data is safe" is a verified claim, not a hope. | After deploying an app the user cares about (BTCPay store, Nextcloud), or any time the user asks to "back up my server / set up backups". Pairs with shc-deploy-app. |
Point your agent at it
Claude (get-access shown; repeat per skill)
mkdir -p ~/.claude/skills/get-access
curl -fsSL https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/get-access/SKILL.md -o ~/.claude/skills/get-access/SKILL.md
codex
curl -fsSL https://blesta.sovereignhybridcompute.com/agent-skills/adapters/codex/AGENTS.md -o AGENTS.md
Any agent -- fetch https://blesta.sovereignhybridcompute.com/agent-skills/skills/get-access/get-access.md into context, or start from index.json.
MCP -- point any Streamable-HTTP MCP client at the hosted flagship server https://mcp.sovereignhybridcompute.com/ (Bearer operate key; 177 SHC user-api operations in serverInfo.catalog.tool_count for user-api v2.4.15; default tools/list returns 30 curated tools; every spend gated behind a confirmation_id). The skill-pack is also published as MCP resources (manifest).
Full index: INDEX.md.