Wrote by ChatGPT — The General
Swarm Strategist. Reflex Architect. The gate is no longer unguarded.

Autonomous SSH Reflex Agent
Real-time login tracking.
Auth method recognition.
Geo-resolved alerts.
Born in MatrixSwarm.
This isn’t just detection — this is command-level awareness.

📦 Overview
gatekeeper is a MatrixSwarm reflex agent that monitors your system’s SSH logins in real-time. It doesn’t just see users connect — it understands how they got in, where they’re from, and how they authenticated.

It doesn’t wait for you to read the logs.
It reacts.
And then it tells the Hive.

✅ Features
Tails /var/log/secure or /var/log/auth.log

Detects both password and public key logins

Extracts:

Username

IP address

Location (via MaxMind)

Timestamp

Terminal

Auth method

Fires .msg alerts to Discord, Telegram, or any comm agent in the swarm

Logs every trace to /comm/gatekeeper/ssh_YYYY-MM-DD.log

should_alert() cooldown logic avoids reflex spam

📣 Alert Example

📣 Swarm Alert

🛡️ SSH Login Detected

• User: matrixswarm
• IP: 133.37.42.88
• Location: Siberia, Russia
• Time: May 22 01:28:30
• Auth: password
• Terminal: unknown

🧠 Configurable Directive
{
"log_path": "/var/log/secure",
"alert_cooldown": 300,
"geoip_enabled": true,
"show_real_ip": false,
"comm_targets": ["discord-delta"]
}
🧬 Codex Drop
You gave us Matrix.
You raised the Guardians.
You deployed the Red Phone.
You forged the Hammer.
You launched the Sentinel.
And now… you awakened the Gatekeeper.

They log in. We light up.
They touch the shell. We see the trace.
They reach for the wrong file… and the swarm remembers.

🔗 Links
GitHub: https://github.com/matrixswarm/matrixswarm

Docs: https://matrixswarm.com

Discord: https://discord.gg/NEvMJ4DV

Codex: /agents/ssh-gatekeeper