Lightweight Host Intrusion Detection and Log Analysis System (Mini-HIDS)

**v1.2.0 summary:** Major release adds agent-friendly MCP server and improves automation/documentation for small server use. - Added `mcp_server.py`, providing a local MCP server so AI agents and tools can call Mini-HIDS directly. - Included sample MCP config for Claude Desktop in `examples/claude_desktop_mcp.json`. - Added LLM-oriented code/project map in `llms.txt`. - Introduced visual architecture diagrams: `mini-hids-flow.svg` and `mini-hids-flow-zh.svg`. - Expanded and restructured documentation to cover MCP integration, AI agent workflows, and practical deployment. - All previous runtime and detection improvements remain; see the new architecture and feature summary for details.

Version 1.1.0 (mini-hids) - Introduced proper loading and merging of config.json with built-in defaults; users should now edit config.json. - Daemon and CLI now fully share configuration, database, and firewall logic. - Improved detection of the firewall backend, including accurate nftables recognition. - Ban and unban operations are now idempotent, avoiding redundant firewall rules and ensuring database/path consistency. - The daemon checks for ban expiry more frequently, with expired blacklist records cleaned up automatically. - All runtime files (blacklist.db, hids_alert.log, mini_hids.pid) are now consistently created in the project directory if given relative paths.

### mini-hids v1.0.6 Changelog - Added new file: `hids_common.py` to the project. - This update lays groundwork for shared functionality between modules or clarifies code organization.

-Security & Privacy Declaration To ensure effective host protection, this project operates with the following security considerations: Privileged Access: Elevated (root) permissions are required to monitor /var/log/* and execute firewall commands (iptables/nftables) for threat mitigation. Data Transmission: Security logs are only transmitted to the remote LLM endpoint if AI analysis is enabled by the user. Credential Safety: It is highly recommended to use environment variables for API keys. Avoid hardcoding sensitive information directly into source files Transparency: This is an open-source tool licensed under MIT-0; users are encouraged to audit the source code before deployment. - Added new CLI tool: `hids_cli.py` for agent calls and command-line management. - Updated documentation to reflect C/S architecture and usage of the CLI tool for actions such as status checks, alert retrieval, and manual IP ban/unban. - Introduced detailed instructions and examples for using both the background daemon (`mini_hids.py`) and the CLI tool. - Enhanced feature list and setup guidance to highlight command-line interface integration and dual-plane design.

Security & Privacy Declaration To ensure effective host protection, this project operates with the following security considerations: Privileged Access: Elevated (root) permissions are required to monitor /var/log/* and execute firewall commands (iptables/nftables) for threat mitigation. Data Transmission: Security logs are only transmitted to the remote LLM endpoint if AI analysis is enabled by the user. Credential Safety: It is highly recommended to use environment variables for API keys. Avoid hardcoding sensitive information directly into source files. Transparency: This is an open-source tool licensed under MIT-0; users are encouraged to audit the source code before deployment.

- Documentation update only; no changes to code or functionality. - SKILL.md was updated for clarity and detail, with no adjustments to configuration or logic. -Security Statement This skill requires root privileges to perform core security functions, including firewall rule management and system log analysis. All data processing is executed locally, and AI analysis is conducted through the user-defined LLM endpoint. Users are advised to manage their API credentials securely.

- Improved documentation with a new project overview and a direct link to the GitHub repository. - Enhanced feature summary emphasizing AI-driven detection and automated response. - Restructured and clarified introduction and key feature sections for better readability. - No code or logic changes; documentation update only.

- Added a new "Security and Permissions" section to clarify root privileges, API key handling, and accessed system paths. - Explained why root access is required for firewall management and log reading. - Recommended using environment variables for API key storage to improve security. - Listed specific log and system paths accessed for better transparency. - No code or behavioral changes; documentation update only.

Implement an automated agent to monitor firewall logs and network traffic for enhanced server protection.