diff --git a/vps_opencode_bot/README.md b/vps_opencode_bot/README.md
index a612a06..5135a1f 100644
--- a/vps_opencode_bot/README.md
+++ b/vps_opencode_bot/README.md
@@ -48,3 +48,16 @@ como documentos adjuntos (se leen de `state.metadata.files` del historial).
 API comprobada contra opencode 1.17.15: POST /session, POST /session/:id/message
 (body `parts` + `model` con `providerID`/`modelID`), GET /session/:id/message,
 GET /config/providers, GET /global/health, GET /project.
+
+## Vigilancia de salud del VPS (05-09-2026)
+
+Tras un incidente de criptomineros en el VPS se instaló vigilancia automática:
+
+- `vps_miner_watch.sh` — cron `*/10 * * * *`: detecta y mata procesos "rojos"
+  (ejecutable en /tmp, memfd o deleted, CPU > 80 %). Log: `/root/vps_miner.log`.
+- `vps_check.sh` — cron `17 */4 * * *`: revisión completa (carga, memoria, disco,
+  top CPU, mineros, servicios opencode/docker). Log: `/root/vps_health.log`.
+
+Ambos viven en `/usr/local/bin/` del VPS. Desplegar de nuevo copiándolos ahí
+y (re)instalando las líneas de cron correspondientes.
+
diff --git a/vps_opencode_bot/vps_check.sh b/vps_opencode_bot/vps_check.sh
new file mode 100644
index 0000000..e7270eb
Binary files /dev/null and b/vps_opencode_bot/vps_check.sh differ
diff --git a/vps_opencode_bot/vps_miner_watch.sh b/vps_opencode_bot/vps_miner_watch.sh
new file mode 100644
index 0000000..f1d0398
Binary files /dev/null and b/vps_opencode_bot/vps_miner_watch.sh differ