# SHC Operator Skills **A VPS your AI already knows how to run.** Skills your AI agent loads to run your SHC server for you, end to end. The agent does every step; you never open a terminal or paste a password. Works with any AI assistant. Works with any AI assistant -- Claude, codex, a GPT-based assistant, or a custom one. Pick your system below and point your agent at these skills; it does the rest. ## Start here: get-access Your agent's FIRST step is the **get-access** skill: it sets up your SHC account through the API in one step -- you just give your email, name, and country, and agree to the Terms. No website, no password to type. Every other skill needs this first. ## The operator discipline (every skill follows it) Five rules your agent holds to: [discipline.md](discipline.md) -- verify before claiming, never spend OR destroy (reinstall/delete/cancel/restore) without your explicit yes, check upstream sources before running a recipe, hold the smallest key, fail loudly. ## Skills | Skill | Does | Use when | Read | |---|---|---|---| | **get-access** | The FIRST skill -- run before any other. Creates the user's SHC account via one anonymous API call (no website) and returns an operate-scoped key. Never prints or asks for a password. | Run this FIRST, before anything else, the moment the user asks you to do anything with SHC (a server, a Bitcoin store, a cloud). ALSO run it any time an SHC call returns 401 or says "unauthorized" or "authentication required" -- that means you do not have a key yet. | [md](skills/get-access/get-access.md) | | **shc-deploy-app** | Deploy a self-hosted app onto a fresh SHC VPS end to end via the verified-deploy loop (check the app's docs, install once, prove it with a live healthcheck). The agent does every step over SSH. | The user asks their agent to "deploy X on my server", "set up a self-hosted X", "make me a Bitcoin payment store", "give me my own private cloud", or names any app in the recipe library. Use this whenever the goal is to stand up a real service on an SHC VPS the agent has SSH to. | [md](skills/shc-deploy-app/shc-deploy-app.md) | | **nostr-operate-lane** | A customer authorizes YOU (a specific AI agent) to operate ONE of their SHC VMs by signing a Nostr grant. You exchange that grant for a short-TTL, service-scoped, cannot-spend operate Bearer and use it against that one VM only. No password, no website, no broad key. | Use when a customer wants to hand YOU operation of ONE specific VM service over Nostr (NIP-07/NIP-46 keys), instead of giving you an account-wide API key. Trigger: the customer offers a signed kind:30078 operate grant, OR you need to act on a single VM the customer owns and they would rather sign a scoped grant than share a key. ALSO re-run this any time your operate Bearer returns 401 (expired/used-up) -- mint a fresh one; the grant is re-usable until it expires. | [md](skills/nostr-operate-lane/nostr-operate-lane.md) | | **shc-pay** | Present an SHC account-credit top-up as a no-dependency scannable QR plus copy/paste fallbacks, and confirm payment only after a real balance re-read. Never auto-pays. Runs in the agent's own shell. | The user wants to add prepaid credit to their SHC account ("put $25 on my account so my servers keep running"), OR a deploy/order step reports it needs funds. Use after someone has called POST /account/credit and you hold the returned JSON; this skill turns that JSON into a friendly "here is how to pay". | [md](skills/shc-pay/shc-pay.md) | | **wait-until-ready** | Block until a fresh SHC VPS is operable -- confirm the server is up and the agent's SSH + sudo work before any deploy touches it. The first thing every VPS-side operator skill depends on. | Right after ordering/provisioning a VPS, before running any deploy (shc-deploy-app), point-a-domain, harden-ssh, or nightly-backup. Use it as the gate: call it, walk away, proceed only once the VPS is ready. | [md](skills/wait-until-ready/wait-until-ready.md) | | **point-a-domain** | Make a domain or subdomain resolve to the VPS public IP (A/AAAA), then verify it globally, so automatic TLS (Let's Encrypt) can validate. Prerequisite for any HTTPS service the agent deploys. | Before deploying any app that serves HTTPS (BTCPay, Nextcloud, anything with a web UI). The user picked a hostname; this makes it point at their VPS and confirms it resolves before the deploy's TLS step runs. | [md](skills/point-a-domain/point-a-domain.md) | | **harden-ssh** | Lock down a fresh SHC VPS -- key-only SSH, unattended security upgrades, and a default-deny firewall opening only the ports the services need. Verifies it can still reconnect before committing (no lockout). Idempotent. | After a deploy (so you know which ports the app needs), or any time the user asks to "secure / lock down / harden my server". Safe to re-run. | [md](skills/harden-ssh/harden-ssh.md) | | **nightly-backup** | Install a nightly encrypted backup of a deployed app's data + database to a destination the user controls, with a mandatory verify-restore drill so "your data is safe" is a verified claim, not a hope. | After deploying an app the user cares about (BTCPay store, Nextcloud), or any time the user asks to "back up my server / set up backups". Pairs with shc-deploy-app. | [md](skills/nightly-backup/nightly-backup.md) | ## Load it into your agent (pick your system) **Keep the lean router resident; fetch a skill's full text only when you run it.** The whole pack is small that way -- the router plus the discipline plus one skill body stays well inside an 8k window. ### Any LLM agent (the lean default) Load the compact router (start_here + each skill's trigger + fetch URL), then fetch the one skill whose trigger matches: ```bash curl -fsSL https://blesta.sovereignhybridcompute.com/agent-skills/router.json # the routing table; run get-access first curl -fsSL https://blesta.sovereignhybridcompute.com/agent-skills/skills/get-access/get-access.md # fetch a skill only when it triggers ``` ### Claude / Claude Code Drop the lean skill STUBS into your skills directory (each is ~a couple lines; Claude routes by `description` and fetches the full skill when triggered): ```bash mkdir -p ~/.claude/skills/get-access curl -fsSL https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/get-access/SKILL.md -o ~/.claude/skills/get-access/SKILL.md ``` Repeat for the others (shc-deploy-app, nostr-operate-lane, shc-pay, wait-until-ready, point-a-domain, harden-ssh, nightly-backup). Large-context agents may load the full bodies from `https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude-full//SKILL.md` instead. ### codex Add the AGENTS.md (discipline once + a compact skill table): ```bash curl -fsSL https://blesta.sovereignhybridcompute.com/agent-skills/adapters/codex/AGENTS.md -o AGENTS.md ``` ### MCP (Model Context Protocol) Point any Streamable-HTTP MCP client at the hosted **flagship MCP server** `https://mcp.sovereignhybridcompute.com/` -- a Bearer operate key, 177 SHC user-api operations in serverInfo.catalog.tool_count for user-api v2.4.15, default tools/list returns 30 curated tools, every spend gated behind a confirmation_id; nothing to install. The skill-pack itself is also available as MCP resources: list + read `shc-skill://pack/router` first (the lean routing table), then read `shc-skill://skill/` for the one you run. ## Apps you can deploy `shc-deploy-app` can deploy any app in this library. Each app entry tells the agent the app's official install docs to check before it runs (so it never runs a stale recipe): | App | Status | Official source the agent checks | What you get | |---|---|---|---| | btcpay | ready | github.com/btcpayserver/btcpayserver-docker | a Bitcoin payment store | | nextcloud | spec | github.com/nextcloud/all-in-one | a private cloud |