Developer shares six tests for self-hosted AI agent servers

On October 22, 2026, a developer published a post on DEV Community describing six tests for checking whether a self-hosted AI agent server is actually locked down. The author disclosed that the article was written with AI assistance and that every command and number was checked against his own test runs. The post focuses on personal AI agents running on a VPS, naming OpenClaw and Hermes as examples. Its central point is that such setups tend to be treated as "secured" on the basis of configuration files, even though the config may say one thing while the machine does another. The six tests therefore examine behavior rather than settings, and each takes only a few minutes.

The first test is an nmap scan launched from another machine, not from the server itself and not from localhost; according to the author, nothing beyond port 22 should be reachable. The next step is to confirm on the server that the agent listens only on the loopback address, with the dashboard reached through an SSH tunnel. The post also tells readers to replace AGENT_UNIT, YOUR_IP and USER with their own values.

The report covers only the author's stated method and the highlights of the first two tests; the remaining tests are not detailed in the available material, and no third party is cited evaluating or reproducing the approach. The matter currently rests at the stage of an individual developer's shared write-up.