Six behavioral tests to verify a self-hosted AI agent server is actually locked down

Config files alone can be misleading, so the author recommends checking what the machine actually does for a self-hosted AI agent on a VPS. The suggested checks cover open ports from an outside host, whether the agent listens only on loopback, and whether SSH password login is truly disabled, including drop-in config files. They also test whether fail2ban bans attacking IPs and whether the agent service restarts automatically and sends alerts through the user's own bot. Finally, the piece advises setting a hard spend cap on the API key, since the agent tools lack one, and rehearsing backup and rollback before updates.