RemotePower is the open-source, all-in-one, Swiss-army-knife control plane for your Linux, Windows and macOS fleet — monitoring with alerting, a CMDB, documentation with RAG search, CVE scanning, patching and remote management in one place, with AI woven through all of it (entirely optional). Self-hosted and MIT-licensed: no SaaS, no agents phoning home, no per-node pricing.
Demo login: demo / demo — read-only sandbox that resets periodically.
Most teams stitch together a monitor, a CMDB, a wiki, a vulnerability scanner, a patch tool and an SSH jump box. RemotePower is the Swiss-army-knife that does all of it — monitoring & alerting, CMDB, documentation with RAG, CVE scanning, patching and remote management — from a single host you control, with AI on tap throughout.
Check-ins every 60s with CPU / RAM / swap / load sparklines, a service matrix, and a fleet-events timeline. Trends charts plot memory, swap, disk and CPU-load history per host.
Per-disk SMART with failing / pre-fail alerts, kernel-reboot & livepatch awareness, a passive DIMM / temp / RAID inventory, and ZFS / mdadm / btrfs pool health with scrub-overdue and degraded-array alerts.
Projects per-mount disk-fill — "/ fills in ~18 days" — and flags hosts whose memory, swap or disk jumps far outside their own normal range.
Fleet-wide thermal roll-up (hottest hosts), UPS / GPU power draw with a per-group energy-cost chargeback, a predictive disk-failure ETA from SMART trends, and an SSH-key audit (fingerprints, weak & reused keys) across every host.
Tail any unit or file with regex alerting, and see exactly what's listening on every host with change detection.
Every listening socket classified world / LAN / local by its bind address — with an alert the moment a service first becomes world-reachable, and a host firewall-ruleset drift fingerprint.
OSV.dev-backed, severity-ranked findings per host with a per-CVE ignore list, now prioritized by real-world risk — a daily CISA KEV + EPSS join puts exploited-in-the-wild CVEs first. Plus CycloneDX / SPDX SBOM export per host or fleet.
A 0–100 fleet health score, scheduled posture reports, and PCI / HIPAA / SOC 2 controls — or a real OpenSCAP CIS / STIG scan — scored pass / fail with evidence.
Shutdown, reboot, Wake-on-LAN, arbitrary shell, multi-line scripts with a dry-run lint — single host or batched across many, now or on a schedule.
A real xterm.js terminal proxied through a hardened daemon — no client to install — with session recording.
Start / stop / snapshot VMs and containers across Proxmox, VMware vSphere / vCenter, VMware Cloud Director and OpenShift / KubeVirt — plus create VMs or LXC from a wizard and watch for stale backups. Server-to-API, admin-only, SSRF-guarded, audited.
Start / stop / restart Docker & Podman, deploy docker-compose stacks, watch for stale image updates with one-click pull-and-recreate, and see per-container restart counts to spot crash loops.
Staggered rolling patch waves, scheduled auto-patch, optional maker-checker approval for risky changes, and per-device Let's Encrypt issuance / renewal via DNS-01.
Browse & transfer files over SFTP, run restic / borg / rsync backups, manage host users, SSH keys and firewall ports, and enforce desired-state config on drift.
Run Ansible playbooks fleet-wide with the server as control node, write bash health checks that run every few minutes, and export your inventory as Terraform / Ansible / Pulumi / cloud-init.
Stay zero-dependency on flat JSON, step up to embedded SQLite, or run PostgreSQL with automatic failover and read replicas — pooled through PgBouncer, behind load-balanced app nodes, reaching segmented networks through relay satellites. The same push-based agents throughout. macOS joins the Linux & Windows agents.
bcrypt + TOTP 2FA with one-time recovery codes, passkeys (WebAuthn) for phishing-resistant passwordless sign-in, LDAP / Active Directory, OIDC and SAML 2.0 SSO (Okta, Entra, OneLogin, Ping, ADFS) with SCIM deprovisioning, per-role MFA enforcement, session caps, API-key expiry, and named API keys with custom scoped roles.
PBKDF2 / bcrypt passwords, session tokens hashed at rest, AES-GCM vault, brute-force lockout, IP allowlist, strict CSP with no inline code, anti-DNS-rebinding SSRF guards, sandboxed SCAP reports, OIDC claim checks, and opt-in signed agent updates. Every hop can run over TLS — including the agent→satellite relay. Externally scanned (Bandit, ZAP, Nikto, Nuclei, Wapiti) with no exploitable findings.
File-integrity monitoring and baseline checks — file-hash, directory, web-root code and egress tripwires that fire on a name you've never seen, apply by scope from a catalog, and stop when you disable them. Plus first-class OS security posture scored as Checks across Linux, macOS (FileVault, Gatekeeper, SIP) and Windows (Defender, BitLocker, tamper protection, Secure Boot, UAC).
Banned / required / min-version package rules over the existing inventory, new-source-IP login alerts, and a scheduled-job (systemd timer) failure lens — all edge-triggered, optionally tag-scoped.
Every privileged action is recorded — who, what, when — with optional forwarding to a SIEM or syslog collector, and one-click quarantine to freeze a suspect host server-side.
Asset metadata, an encrypted credentials vault with rotation reminders, Markdown docs per asset, a network topology map, and Sites / teams to scope who sees what.
Scan the fleet for exposed secrets and API keys, flag files holding PII, and plant canary tokens / honeyfiles that alert the instant they're read — data-protection tripwires alongside the posture and integrity checks.
Manage host firewalls and fail2ban, issue road-warrior WireGuard access, and drive a network DNS blocker — with a live exposure map of what's reachable from where. Blocklist changes are edge-triggered and audited.
The assistant retrieves facts from your own hosts, CVEs, CMDB and runbooks and cites them — so answers reference your infrastructure, not generic advice.
One click on a Needs-Attention item runs a diagnosis and proposes a fix — across ~20 kinds: disks, CVEs, drift, failed units, AV posture, hardware, and more. Agentic log diagnosis sweeps a host's logs and follows the evidence under hard token budgets, with secrets redacted and a visible evidence trail; opt-in auto-remediation re-verifies and backs off. Security-sensitive ones never propose a blind destructive command.
When an event fires, auto-run a saved script or notify a destination — e.g. restart a service the moment it goes down. Plus a plain-English cron builder and RAG-aware runbook drafts.
Connect an MCP client like Claude Desktop to ask about your fleet in plain language — 16 read tools over alerts, devices, journals, services, containers, CVEs, drift and more, plus 5 guarded write actions. Reads need only a viewer-role key; the writes are a fixed, pre-saved set and every one is audited with the AI host and the prompt that triggered it.
An alerts inbox with a routing matrix, on-call & escalation, Slack / Discord / Teams / ntfy / email / PagerDuty, inbound webhooks & syslog, SNMP, and Prometheus metrics.
A built-in ticket system — open from an alert, assign, comment, log hours and track SLA — with email intake, auto-heal linkage so a resolved alert can close its ticket, and full audit history. No second tool to run.
A few corners of the dashboard. Everything below is one self-hosted app — no tabs sprawling across a dozen tools.
Failures that named the wrong cause. A monitor said a host was down when a bot filter had turned the probe away. A TLS setting whose own comment called it a floor was lowering one. And the web terminal told you it had connected to your host without having checked that it had. Three different systems, one shape: the thing that told you what went wrong was confidently wrong about it.
A monitor aimed at a site behind a bot filter failed forever while the same URL loaded in a browser. The probe introduced itself as Python and put an older TLS version back on the wire, so the edge refused it before the request reached your origin. Probes send RemotePower/<version> now, and when an edge refuses one the error says so.
Of eleven places that pin a minimum TLS version, ten set it where they meant to raise it, so a host hardened to TLS 1.3 was handed a context that would still speak 1.2. Eight are fixed across the server, all three agents, the satellite, the scanner and the key server. The two left are appliances whose firmware negotiates nothing newer.
It sent your SSH password to a host whose key it had not verified, while the fingerprints to verify it had been collected with every heartbeat since v6.1.2. That is one of fourteen security fixes in this release, all caught before it shipped and all described in the public review.
The API reference returned 403 on every install. SAML metadata advertised an endpoint that does not exist. Thirty-one alerts computed their answer and hid it — ECC counts, days left on a certificate, who took a break-glass credential. Each one now shows what it measured.
The Data Explorer can ask about packages, listening ports, services, containers and alerts. The risk score reads Secure Boot, failed timers and your own custom checks. Compliance takes OpenSCAP, the sudo trail and DMARC as evidence. Prometheus exports ten more metric families and your custom metrics.
Windows and macOS hosts report firewall, disk encryption and automatic updates under their own names, and three views read only the Linux ones — so “which hosts have no firewall” skipped every Windows machine. They read all three now. Also new: noVNC 1.7.0 in the VNC console, and a Jellyfin connector that works with Jellyfin 10.12.
One script gets you nginx + a Python backend + an admin login. Add a host by running the agent installer and pasting a PIN. Stores everything in flat JSON by default — or grow into SQLite, then PostgreSQL with failover, read replicas and relay satellites when you reach thousands of hosts. No cloud account, your data stays yours.
RemotePower is self-hosted software you run yourself. The live demo is a read-only sandbox (log in with demo / demo).
RemotePower