One incident, not twelve alerts.

A lightweight shell agent. 100% read-only by default. No command without human approval.

Lightweight shell agent

One sh script started by a timer, with no daemon and no open port. Standard tools are enough: curl, openssl and sha256sum.

100% read-only by default

Installed without --enable-actions, it has no way to run anything. Fixes are turned on only at install time, never through an update.

No command without human approval

Every fix waits for your click in the dashboard. Outside the list of fixes, the agent runs nothing.

• 14 days free on Starter or Plus, no card
• one key per host, revocable

Documentation and install guides

What happens when something goes wrong

No need to keep an eye on the dashboard. Here is how it plays out in one example: a backdoor planted on a client’s site at night.

It notices

The agent, a script installed with one command, reports every 5 minutes by default. Sites where you cannot install anything are checked from outside.

It tells you once

Repeats of the same problem stay one incident. One message by email or push, plus Slack or Discord on paid plans.

It explains why

One click and the AI incident analysis reads the evidence and explains the likely cause in plain words.

You decide

When a fix can run from the dashboard, it waits for your approval. Nothing reaches the server before that.

Example incident on bakery.example, a client’s site on shared hosting. At 02:05 the agent report finds a file with an injection pattern. Seconds later one alert goes out by email and push. On your click, the AI incident analysis explains it is likely a backdoor. You pick the file, and its quarantine waits for your approval: nothing has run on the server yet.

An illustrative example: a client’s site on shared hosting, with remediation switched on. How soon you approve is up to you.

Afterwards: the incident stays in the host’s problem log; every outage keeps its cause in the uptime history.

Four host types, one dashboard

Not every host can be seen equally deep. Pick a type and see what we measure there and what alerts you.

VPS with agent

A server with root access, running the full agent. The report arrives signed, every 5 minutes by default (anywhere from 1 to 60, your choice). From outside we check the host address (on an IP: blocklists and ports; on a domain: the site, DNS, certificate) and every site hosted on the server.

• SSH logins, accepted and failed (every 5 min)
• SSH keys, accounts and sudo (every 5 min)
• Suspicious processes, by behavior (every 5 min)
• Backdoor patterns and fingerprints in the webroot (every 5 min)
• Disk and inodes, on every filesystem (every 5 min)

Shared hosting

A hosting account (usually cPanel), without root. The agent runs inside the account, as its own user, while the site is checked from outside in parallel. Two angles, because neither one is enough alone.

• sha256 fingerprints of the webroot files (every 5 min)
• Injection patterns inside the files (every 5 min)
• The account access logs (every 5 min)
• One-click cleanup, with your approval (on request)
• HTTP availability (every 1 min)

External site

Nothing gets installed. You add the domain and the site is checked from outside the network, like any visitor would, from a server unrelated to yours. It is the only host type included in the Free plan too.

• HTTP code and response time (every 1 min)
• DNS records, alerting on change (every 15 min)
• TLS certificate, days left (every hour)
• Exposed sensitive files: .git, .env, backups (every 12 h)
• Ports exposed to the internet (every 12 h)

cPanel/WHM reseller

Not a server, an index. We query WHM with the token you save in the dashboard and add one host per account we find, including the ones that appeared without you knowing. Every account whose domain is delegated gets the outside checks of a shared hosting host.

• API tokens and the 2FA policy (every 6 h)
• Web traffic of the accounts without an agent (every 5 min)
• Accounts added, removed or suspended (every 30 min)
• Shell, plan, IP and mail hold (every 30 min)
• Domain answering from elsewhere, or re-registered (every hour)

Every check, by host type

Nothing runs without you

The agent reads. Remediation ships disabled, and you approve every command.

Read-only by default

A shell script with no dependencies to install. It reports; it executes nothing until you switch remediation on.

Two switches for remediation

One when you install the agent on the server, one in the dashboard. Without both, even a correctly signed command is refused.

One key per host

Revocable and rotatable. A wrongly signed command opens a critical incident by itself.

Only four kinds of command

On a VPS: block an IP with an expiry, stop a process, quarantine a file, restart the web server after testing its configuration. On shared hosting, only quarantine. Nothing else.

From one site to your clients’ fleet

Starter and Plus start with 14 days for free, no card needed. Then you pick a plan by how many hosts you watch.

• Free · 0 EUR/month: One site or server, watched from outside.
• Starter · 4.9 EUR/month: One server, with the agent and remediation.
• Plus · 19 EUR/month: A few servers, one screen.
• Pro · 49 EUR/month: For agencies and hosting companies.
• Ultra · 129 EUR/month: Large fleets, the tightest cadence.

See all plans

Ask your infrastructure

Ask in plain language about your servers and incidents.

Exposed does not mean exploitable

An assessment started on demand, with a report and remediation steps.

from 99 EUR

What people ask before installing the agent

Do you need root on my servers?

It depends on what you want to see. On a VPS the full agent runs as root, because it reads the authentication log, the firewall and every user’s processes. On a hosting account root is not needed: run without it, the installer switches by itself to shared hosting mode, which sees the site files, the account cron and the access logs. In both modes the agent is read-only by default; remediation is switched on separately and runs only with your approval.

What happens if the agent stops?

After three missed reports, the host shows a silent agent and a critical incident opens, with an alert. A silent server is itself a signal, not an absence.

Where does the data from my server go?

The agent sends numbers, names, fingerprints and summaries, not whole files, .env, databases or private keys. On a critical incident it attaches short evidence: the process command line, the last 60 lines of the authentication log when an account or key changes, the first 256 bytes of a new executable, and for a suspicious web file the matched fragment and its line. The data is stored in our database, isolated to your account. The language model only gets data on request: the evidence of the chosen incident for an analysis, or the account data the AI assistant reads when you ask it something.

Does it work on shared hosting, without root?

Yes. The agent has a mode for hosting accounts: it runs from the account crontab, without root, and watches the webroot file fingerprints, malware patterns, the cron and the account access logs. The site gets ten outside checks in parallel.

Can I try it before paying?

Yes. Starter and Plus start with 14 days for free, with no card: the agent on your servers, cPanel accounts, remediation on your approval. At the end you pick a plan; if you do not, the account moves to Free, which is permanent: one host checked from outside, with email and push alerts. Nothing is deleted.

Want to see it on your own infrastructure?

Start free with an external site, or try Starter or Plus for 14 days with the agent on your servers. No card.