AI coding agents are becoming a practical part of software development. Tools such as Claude Code, OpenAI Codex and OpenCode can inspect projects, write and modify code, run commands, troubleshoot errors and help developers complete tasks that previously required considerably more manual work.
Running these agents on a VPS can be particularly useful. A VPS provides a persistent Linux environment with the processing power, storage and control needed for development tools, test environments and longer-running tasks.
However, giving an AI agent access to a server also introduces risk. An agent that can run shell commands, modify files and interact with external services can potentially make damaging changes if it has more access than it needs.
The key is not to avoid AI coding agents, but to control what they are allowed to do.
Contents
- What is an AI coding agent?
- Why run an AI coding agent on a VPS?
- The main security risk: excessive permissions
- The safer approach: least privilege
- When elevated access is genuinely needed
- 7 rules for running AI coding agents safely
- A practical example with OpenCode
- MCP and controlled access to hosting tools
- Where managed VPS support fits
- Final thoughts
What is an AI coding agent?
An AI coding agent goes beyond generating snippets of code in a chat window.
Depending on the tool and permissions provided, an agent may be able to:
- inspect an existing codebase
- create and edit files
- run shell commands
- install dependencies
- execute tests
- diagnose application errors
- interact with Git repositories
- connect to external tools and APIs
- assist with deployment
This makes coding agents powerful development tools, but it also means they should be treated as software operators rather than ordinary chatbots. If an agent has permission to run a command, modify a file or access a credential, you should assume that capability could be used during a task.
Why run an AI coding agent on a VPS?
Many coding agents can run locally, but a VPS provides some useful advantages.
It gives developers a persistent remote environment that can remain available independently of their local computer. The server can also be configured with the same operating system, runtime, databases and supporting services used by the application.
This can make a VPS useful for:
- remote development environments
- staging websites and applications
- automated testing
- debugging server-side applications
- running longer AI-assisted development tasks
- experimenting with self-hosted development tools
- hosting MCP servers and other agent integrations
For business-critical applications, significant agent-generated changes should normally be tested in a development or staging environment before being applied to production.
For more information, read: VPS Hosting: A Beginner’s Guide to Virtual Private Servers.
The main security risk: excessive permissions
The biggest mistake is giving an AI coding agent unrestricted server access simply because it makes setup easier.
For example, running an agent continuously as the root user gives it permission to modify almost anything on the server. A mistaken command, compromised dependency or malicious instruction could therefore have consequences well beyond the application being worked on.
Think of it like hiring someone to carry out work in one office. You would give them access to the rooms they need, not every key in the building.
The same principle applies to AI agents.
The safer approach: least privilege
For normal website and application development, run the agent using a dedicated or site-level user with access limited to the files and commands required for the task.
This can restrict the potential impact of an error because the agent does not automatically have permission to change system-wide configuration or unrelated websites.
The exact level of isolation depends on how the VPS and hosting environment are configured, so user permissions should be checked rather than assumed.
Elevated access should only be provided when a specific task genuinely requires it.
When elevated access is genuinely needed
Some development tasks cross into server administration.
For example, an agent may identify that an application requires:
- a new system package
- changes to PHP or another runtime
- a Redis configuration change
- a service restart
- firewall changes
- access to protected system logs
These tasks may require sudo or root privileges.
That does not mean the coding agent needs to run permanently as root.
A safer approach is to review the requested change and elevate only the individual action that requires additional privileges. On a managed VPS, you can also ask your hosting provider to make or review infrastructure-level changes where they fall within the provider’s management scope.
7 rules for running AI coding agents safely
- Give the agent only the access it needs
Use a dedicated or restricted account rather than unrestricted root access. Limit filesystem permissions to the project the agent is working on wherever practical. - Protect credentials and secrets
Development environments often contain API keys, database passwords, SSH keys, deployment tokens and .env files. Do not assume an AI agent needs access to all of them. Restrict sensitive files and use separate credentials with the minimum permissions required. - Require approval for sensitive commands
Commands that delete data, install system packages, modify services, change firewall rules or deploy to production deserve additional scrutiny. Where your coding agent supports permission controls, configure sensitive operations to require approval rather than allowing every command automatically. - Use staging for significant changes
Allowing an agent to experiment directly on a live business website increases the potential impact of a mistake.Use a development or staging environment for substantial code changes, dependency upgrades and configuration changes, then review and test them before deployment. - Keep changes under version control
Where possible, let the agent work through Git.Commits, branches and pull requests provide a record of what changed and make human review easier before new code reaches production. - Maintain backups and a rollback path
Before significant changes, make sure you have a recent backup or snapshot and know how to restore it. AI can accelerate development, but it does not remove the need for recovery planning. - Treat external content and integrations as untrusted
Coding agents increasingly read documentation, repositories, webpages and information returned by external tools. Those sources can contain misleading or malicious instructions. This is one reason prompt injection has become an important security consideration for AI agents. The same caution applies to integrations. Connecting an agent to an MCP server, control panel, database or API increases what it can potentially access. Give each integration only the permissions necessary for its intended task.
A practical example with OpenCode
OpenCode is an open-source AI coding agent that can run directly in a terminal, making it suitable for experimenting with AI-assisted development on a VPS.
On a Linux VPS, OpenCode can be installed using the installation method provided in its documentation:
curl -fsSL https://opencode.ai/install | bashAfter installation, run:
opencodeOpenCode supports different AI model providers, including OpenRouter. Developers who want to experiment without immediately committing to paid model usage can investigate the free model options currently available through OpenRouter.
For real projects, however, installation should only be the start of the setup.
Before allowing the agent to work on an application, review its permissions. OpenCode can control whether particular operations are allowed automatically, require approval or are denied.
This is exactly the kind of control that should be used to prevent an agent from accessing sensitive files or executing potentially dangerous commands without review.
MCP and controlled access to hosting tools
The Model Context Protocol, or MCP, provides a standard way for AI applications to interact with external tools and services.
For hosting environments, this creates interesting possibilities.
Instead of giving an agent unrestricted access to an entire server, an MCP integration could expose specific approved functions that the agent is allowed to use.
However, MCP should not be treated as a security boundary by itself. Connecting an agent to additional tools increases its capabilities, so authentication, permissions and the actions exposed by each MCP server need to be considered carefully.
As AI agents become more capable, controlled integrations could become an increasingly useful way to combine automation with hosting management.
Where managed VPS support fits
AI coding agents are good at understanding code and helping developers troubleshoot applications. They do not replace experienced server administrators.
If an agent identifies that an application needs an infrastructure-level change, a managed VPS gives you access to people who understand the underlying hosting environment.
With eUKhost managed VPS hosting, our technical team can assist with supported server-level tasks that fall within the scope of the managed service. The distinction is important. Your coding agent can help you develop and troubleshoot your application, while the hosting team manages supported areas of the server infrastructure. Support for third-party AI tools and customer-written application code remains separate from the management of the underlying VPS. This can be particularly useful for businesses and developers that want the flexibility of modern AI development tools without taking responsibility for every aspect of server administration themselves.
Final thoughts
AI coding agents can make VPS-based development considerably faster, but their capabilities need to be matched with appropriate controls.
The safest approach is straightforward: give the agent the minimum access required, protect credentials, require approval for sensitive operations, test significant changes away from production, keep code under version control and maintain a reliable rollback path.
Root access should be an exception for specific administrative tasks, not the default environment in which an AI coding agent operates.
As coding agents, MCP integrations and remote development environments continue to evolve, VPS hosting is likely to become an increasingly useful platform for developers who want persistent, controllable infrastructure for AI-assisted development.
The important part is making sure the agent has enough access to help you, but not enough access to put the rest of your server at unnecessary risk.
