RemotePower is the open-source, all-in-one, Swiss-army-knife control plane for your Linux, Windows and macOS fleet — monitoring with alerting, a CMDB, documentation with RAG search, CVE scanning, patching and remote management in one place, with AI woven through all of it (entirely optional). Self-hosted and MIT-licensed: no SaaS, no agents phoning home, no per-node pricing.
Demo login: demo / demo — read-only sandbox that resets periodically.
Most teams stitch together a monitor, a CMDB, a wiki, a vulnerability scanner, a patch tool and an SSH jump box. RemotePower is the Swiss-army-knife that does all of it — monitoring & alerting, CMDB, documentation with RAG, CVE scanning, patching and remote management — from a single host you control, with AI on tap throughout.
Check-ins every 60s with CPU / RAM / swap / load sparklines, a service matrix, and a fleet-events timeline. Trends charts plot memory, swap, disk and CPU-load history per host.
Per-disk SMART with failing / pre-fail alerts, kernel-reboot & livepatch awareness, a passive DIMM / temp / RAID inventory, and ZFS / mdadm / btrfs pool health with scrub-overdue and degraded-array alerts.
Projects per-mount disk-fill — "/ fills in ~18 days" — and flags hosts whose memory, swap or disk jumps far outside their own normal range.
Fleet-wide thermal roll-up (hottest hosts), UPS / GPU power draw with a per-group energy-cost chargeback, a predictive disk-failure ETA from SMART trends, and an SSH-key audit (fingerprints, weak & reused keys) across every host.
Tail any unit or file with regex alerting, and see exactly what's listening on every host with change detection.
Every listening socket classified world / LAN / local by its bind address — with an alert the moment a service first becomes world-reachable, and a host firewall-ruleset drift fingerprint.
OSV.dev-backed, severity-ranked findings per host with a per-CVE ignore list, now prioritized by real-world risk — a daily CISA KEV + EPSS join puts exploited-in-the-wild CVEs first. Plus CycloneDX / SPDX SBOM export per host or fleet.
A 0–100 fleet health score, scheduled posture reports, and PCI / HIPAA / SOC 2 controls — or a real OpenSCAP CIS / STIG scan — scored pass / fail with evidence.
Shutdown, reboot, Wake-on-LAN, arbitrary shell, multi-line scripts with a dry-run lint — single host or batched across many, now or on a schedule.
A real xterm.js terminal proxied through a hardened daemon — no client to install — with session recording.
Start / stop / snapshot VMs and containers across Proxmox, VMware vSphere / vCenter, VMware Cloud Director and OpenShift / KubeVirt — plus create VMs or LXC from a wizard and watch for stale backups. Server-to-API, admin-only, SSRF-guarded, audited.
Start / stop / restart Docker & Podman, deploy docker-compose stacks, watch for stale image updates with one-click pull-and-recreate, and see per-container restart counts to spot crash loops.
Staggered rolling patch waves, scheduled auto-patch, optional maker-checker approval for risky changes, and per-device Let's Encrypt issuance / renewal via DNS-01.
Browse & transfer files over SFTP, run restic / borg / rsync backups, manage host users, SSH keys and firewall ports, and enforce desired-state config on drift.
Run Ansible playbooks fleet-wide with the server as control node, write bash health checks that run every few minutes, and export your inventory as Terraform / Ansible / Pulumi / cloud-init.
Stay zero-dependency on flat JSON, step up to embedded SQLite, or run PostgreSQL with automatic failover and read replicas — pooled through PgBouncer, behind load-balanced app nodes, reaching segmented networks through relay satellites. The same push-based agents throughout. macOS joins the Linux & Windows agents.
bcrypt + TOTP 2FA with one-time recovery codes, passkeys (WebAuthn) for phishing-resistant passwordless sign-in, LDAP / Active Directory, OIDC and SAML 2.0 SSO (Okta, Entra, OneLogin, Ping, ADFS) with SCIM deprovisioning, per-role MFA enforcement, session caps, API-key expiry, and named API keys with custom scoped roles.
PBKDF2 / bcrypt passwords, session tokens hashed at rest, AES-GCM vault, brute-force lockout, IP allowlist, strict CSP with no inline code, anti-DNS-rebinding SSRF guards, sandboxed SCAP reports, OIDC claim checks, and opt-in signed agent updates. Every hop can run over TLS — including the agent→satellite relay. Externally scanned (Bandit, ZAP, Nikto, Nuclei, Wapiti) with no exploitable findings.
File-integrity monitoring and baseline checks — file-hash, directory, web-root code and egress tripwires that fire on a name you've never seen, apply by scope from a catalog, and genuinely stop when you disable them. Plus first-class OS security posture scored as Checks across Linux, macOS (FileVault, Gatekeeper, SIP) and Windows (Defender, BitLocker, tamper protection, Secure Boot, UAC).
Banned / required / min-version package rules over the existing inventory, new-source-IP login alerts, and a scheduled-job (systemd timer) failure lens — all edge-triggered, optionally tag-scoped.
Every privileged action is recorded — who, what, when — with optional forwarding to a SIEM or syslog collector, and one-click quarantine to freeze a suspect host server-side.
Asset metadata, an encrypted credentials vault with rotation reminders, Markdown docs per asset, a network topology map, and Sites / teams to scope who sees what.
Scan the fleet for exposed secrets and API keys, flag files holding PII, and plant canary tokens / honeyfiles that alert the instant they're read — data-protection tripwires alongside the posture and integrity checks.
Manage host firewalls and fail2ban, issue road-warrior WireGuard access, and drive a network DNS blocker — with a live exposure map of what's reachable from where. Blocklist changes are edge-triggered and audited.
The assistant retrieves facts from your own hosts, CVEs, CMDB and runbooks and cites them — so answers reference your infrastructure, not generic advice.
One click on a Needs-Attention item runs a diagnosis and proposes a fix — across ~20 kinds: disks, CVEs, drift, failed units, AV posture, hardware, and more. Agentic log diagnosis sweeps a host's logs and follows the evidence under hard token budgets, with secrets redacted and a visible evidence trail; opt-in auto-remediation re-verifies and backs off. Security-sensitive ones never propose a blind destructive command.
When an event fires, auto-run a saved script or notify a destination — e.g. restart a service the moment it goes down. Plus a plain-English cron builder and RAG-aware runbook drafts.
Connect an MCP client like Claude Desktop to ask about your fleet in plain language — 12 read tools over devices, journals, services, containers, CVEs, drift and more. Deliberately read-only: it can inspect, never change anything.
An alerts inbox with a routing matrix, on-call & escalation, Slack / Discord / Teams / ntfy / email / PagerDuty, inbound webhooks & syslog, SNMP, and Prometheus metrics.
A built-in ticket system — open from an alert, assign, comment, log hours and track SLA — with email intake, auto-heal linkage so a resolved alert can close its ticket, and full audit history. No second tool to run.
A few corners of the dashboard. Everything below is one self-hosted app — no tabs sprawling across a dozen tools.
Key custody. RemotePower can now hold the encryption keys for the storage that depends on it — a built-in KMIP key server, off by default, so a NAS or hypervisor stops keeping its keys on the same box that holds the encrypted data. Plus full signal parity for Windows and macOS agents, and a sweep that found several features which looked wired but never fired.
Synology DSM, TrueNAS and VMware vSphere all speak KMIP natively, but there was no small, self-hostable key manager to point them at. Now there is: a separate sandboxed sidecar on tcp/5696, mutual TLS only, with a three-step wizard that issues the client certificate and waits for the appliance’s first connection to confirm it worked — and an encrypted recovery bundle, because key custody without a way back is a liability. Release notes →
Watched services, file-path log rules, disk-usage scans, custom checks, canary files and live view all report from every agent now — and laptops report like laptops, so a closed lid on a MacBook or a Windows notebook stops paging like a dead server. Several of these were configured and silently doing nothing before; a file-path log rule turned out never to have matched on any platform, Linux included.
A sweep for the worst kind of bug — the one where the interface says a thing is on and nothing is happening. A notification filter that passed everything regardless of the setting, four security-advisory inputs written against data nothing produced, CPU and board temperatures collected but never drawn. All found, all fixed, all now covered by tests that fail if they regress.
One body text size and one icon size across every page, table action buttons that sit in a row instead of stacking, and panels that scroll instead of growing without limit. The public security review lists what was examined and what was found — including the low-severity items most write-ups leave out.
One script gets you nginx + a Python backend + an admin login. Add a host by running the agent installer and pasting a PIN. Stores everything in flat JSON by default — or grow into SQLite, then PostgreSQL with failover, read replicas and relay satellites when you reach thousands of hosts. No cloud account, your data stays yours.
RemotePower is self-hosted software you run yourself. The live demo is a read-only sandbox (log in with demo / demo).
RemotePower