// docs

Skills & Guardrails

Skills are the agent's hands. Approvals and scopes are the leash — you decide exactly what S.E.N.T.R.I can touch.

Built-in skills

Every skill below ships with ServerEngine. Each one is switched on or off individually in Settings, and nothing here is reachable by the agent until you enable it — see Approvals for gating the ones you do.

Skill	What it does
Admin	Run a command on a host and read its output back. A Windows host runs PowerShell over WinRM and a Linux host runs Bash over SSH — the host's own tag decides which, not the agent.
Automation	Read job status and job IDs from the dashboard; restart or cancel a job.
Plan Execution	Check the current time, and schedule a runbook for a given host, date and time.
Check Availability	Ping hosts, or check whether a specific port is open.
Check Events	Read recent Application, System or Security events from a host.
Check Logs	Pull the most recent ServerEngine log entries.
Active Directory	Search users and groups, read user info, and list group or department members.
Hypervisor ESXi	Manage virtual machines on VMware ESXi.
Hypervisor Proxmox	Manage virtual machines on Proxmox VE.
Coder	Read, write, edit and search files in the working folder you point it at. That folder is its boundary — absolute paths outside it are refused, and until you pick one every call fails.
GitHub	Create and clone repos, commit and push, open and merge pull requests, run workflows.
Cloudflare	Deploy Workers and Pages, manage DNS and zones, read analytics, and wire an app to a GitHub repo.
Google Search Console	Search traffic and top queries, sitemaps, and index status for a URL.
Stripe	Products and multi-currency prices, payment links, customers, subscriptions and discount codes.
Slack Message	Post messages to your configured Slack channels.
Jira Ticket Manager	Create and read tickets and subtasks, transition status, comment, and list your tickets.
Confluence Pages	Create, read and update Confluence pages.
Web Search	Search the web and fetch page content (Brave-powered — bring your own key).

GitHub, Cloudflare, Google Search Console and Stripe are connected per account in Settings before the agent can use them.

Custom skills from runbooks

Turn any runbook into a skill S.E.N.T.R.I can call. Give it a description and an optional parameter, and the agent can trigger the whole workflow from a natural-language request.

Approvals

Mark any skill as approval-required. When the agent wants to run it, ServerEngine pops a confirmation showing the exact skill and host and waits for you to Accept or Decline before anything executes. Decline, and the agent is told you refused and moves on.

Unattended runs move the approval earlier

A confirmation needs someone to answer it, and a scheduled prompt has nobody there. So an unattended run does not stop to ask — and it does not silently skip the skill either. The approval happens when you write the schedule: its Allowed skills picker decides exactly what that run may call, and nothing outside it is offered. Tick that list as deliberately as you would answer a prompt, and keep the scope tight.

Scopes

A scopeis an allow-list of hosts. Build it from your server groups to define exactly which machines S.E.N.T.R.I may act on. The agent is only ever shown the hosts in the current scope and is instructed to use nothing else — so it can't wander outside your boundary.

Layered control

Combine the three: disable skills you don't want available, require approval on the risky ones, and scope the agent to a safe set of hosts. You get autonomy where it helps and a hard stop where it matters.

Admin skill safeguards

The Admin skill grants full PowerShell access to a host. ServerEngine guards against overlapping sessions so two connect requests can't race, and every action still respects your approval and scope settings.