# ManageLM — Full Product Information

> AI-powered Linux and Windows server management platform, assisted and agentic, secure by design. It covers day-to-day system administration alongside security, compliance, monitoring, PKI, backups, credential rotation and a PKCS#11 keystore.

## How to Read This Document

The lists below describe what ManageLM **ships with by default**, not the limit of what it can do. ManageLM is a general-purpose server management platform: the built-in skills, frameworks, monitors and connectors are starting points, and every one of them is extensible — see **Extensibility** near the end of this document. Named tools inside a skill are examples of that skill's coverage, not an exhaustive list. If a task can be done on a Linux or Windows server from a shell or PowerShell, ManageLM can be configured to do it, under an allowlist you control.

## What is ManageLM?

ManageLM is a server management platform that enables teams to manage Linux and Windows servers through natural language. Users talk to Claude (via Anthropic's MCP protocol), and ManageLM agents execute tasks locally on servers using a local LLM — with hard-enforced security at every layer. Anything a server administrator does by hand is in scope; the platform's job is to make it safe, auditable and repeatable rather than to restrict it to a fixed catalog of actions.

ManageLM covers both halves of the work, and most products cover only one. **AI-assisted administration**: open a real shell on any managed host straight from the browser — no SSH key, no VPN, no open port 22 — and the assistant works with you, explaining what failed and proposing the next command, with nothing reaching the shell until you press Run or Insert. **Agentic administration**: describe the outcome and autonomous agents pick the right skills, plan the steps and run them across the whole fleet, inside the same allowlist, kernel sandbox and audit trail.

## How It Works

1. **Talk to Claude**: Users describe what they need in natural language through the Claude app or any supported plugin (ChatGPT, VS Code, Cursor, LM Studio, Goose, Slack, OpenClaw, n8n). Examples: "Run a security audit on all production servers and fix critical findings", "Check disk usage across all production servers", "Deploy the latest release to staging and run health checks". The same tasks can be run from the portal UI, from the agent's own terminal tools, or from a browser-based console on the server itself.

2. **Portal Authenticates & Routes**: The ManageLM cloud portal verifies identity via OAuth 2.0, checks permissions (RBAC), validates the request against assigned skills, and dispatches the task over a secure WebSocket channel to the target agent.

3. **Agent Executes Locally**: A lightweight agent on the server uses Ollama (or any compatible LLM) to interpret the task, generate commands, validate each command against the skill's allowlist, and execute. Run that model on your own hardware and nothing the server prints leaves your network; a hosted model is available for teams that do not want to run one.

## Security Architecture

ManageLM uses a three-layer security enforcement model:

### Layer 1: Skill Scope
Skills define what categories of operations an agent can perform. Each agent is assigned specific skills with explicit boundaries.

### Layer 2: Command Allowlisting
Every AI-generated command is validated against an explicit allowlist defined in code — not prompts. Any command outside the allowlist is blocked. This is hard-enforced, not advisory. On Windows, skills grant whole PowerShell modules and each agent resolves them against its own host, so the allowed commands always match that server's Windows version and installed roles.

### Layer 3: Execution Sandbox
Each task execution is constrained: max 10 LLM turns, a 120-second timeout per command, an 8,000-character cap on the output handed back to the model, and a 10-minute wall-clock deadline for the whole task. File operations use structured `<edit>` and `<write>` tags handled in Python (no shell escaping). Kernel-level Landlock and seccomp sandboxing, plus an optional privilege drop that runs a skill as an unprivileged system user. Every operation is logged in a full audit trail.

### Additional Security Features
- **Local LLM**: Task interpretation runs locally via Ollama or any supported provider. Passwords, configs, logs — nothing leaves the machine.
- **View-Only AI Access**: A per-server and per-group switch. With it on, the AI may inspect and report on that host but cannot change it — enforced on the host by the kernel (Landlock/seccomp on Linux, a low-integrity process on Windows) and by the portal, which refuses file uploads to a view-only target. Independently of it, a skill with no allowed_commands starts out read-only: write access is granted, never assumed.
- **Zero Inbound Ports**: Agents connect outward via WebSocket. Servers never expose a port. Nothing to scan, nothing to brute-force, and no SSH or VPN service to keep patched. The web console and credential rotation travel over that same outbound connection.
- **Secrets Hidden from AI**: Secrets are environment variables. The LLM only sees $VAR_NAME — actual values are injected at execution time.
- **LLM is Untrusted by Design**: The AI generates commands, but every command is validated in code before execution. A prompt injection or a hallucination cannot reach the shell.
- **Policy Rulesets**: Short markdown policy snippets attached to agents or groups and injected into every task's system prompt as unconditional rules ("Never restart services between 09:00 and 18:00 UTC"). Cross-skill organizational policy on top of — never instead of — the hard allowlist and kernel sandbox.
- **Panic Button**: One screen that cuts off access everywhere at once during a suspected compromise — sign every user out of the portal, disable accounts, drop every MCP and API-key connection, end interactive sessions on the servers, run backups, rotate credentials and reissue certificates. Scoped to chosen servers, confirmed by typing EXECUTE, with per-action pass/fail reported live. Owners and admins only, and most actions are reversible.

## Built-in Skills (33 shipped skills, 396 operations, 1,025 distinct allowed commands)

Skills are the unit of permission, not the unit of capability. Each skill defines an explicit allowlist of commands its agent may run — across the shipped catalog that is **1,025 distinct allowed commands: 726 Linux commands and 326 Windows commands and cmdlets, plus 54 whole PowerShell modules** — grouped into 396 named operations and delivered as 55 platform bundles (30 Linux + 25 Windows). The tools named below are **representative examples of each skill's allowlist, not its full contents**. Every catalog skill can be edited, extended with your own commands, or reset back to the shipped definition — and you can create unlimited custom skills for anything the catalog does not cover.

- **Containers & Kubernetes**: Docker, Compose, Podman, Buildah, Skopeo, containerd/crictl, nerdctl, kubectl, kubeadm, Helm, k3s, k3d, minikube, MicroK8s
- **Developer Tools & Scripting** (Linux): Scripts, compiling, builds, tests, linters, Git
- **Email Server Management**: Postfix, Exim, Dovecot, Cyrus (Linux); Exchange Server (Windows)
- **File & Directory Management**: File operations, permissions, compression
- **File Sharing & FTP**: NFS, Samba (Linux); SMB, DFS-N/DFS-R, NFS, FTP (Windows)
- **SQL Database Management**: MySQL, MariaDB, PostgreSQL (Linux); SQL Server (Windows)
- **NoSQL Database Management** (Linux): MongoDB, Redis, Elasticsearch, OpenSearch, Memcached
- **Web Server Management**: nginx, Apache, Tomcat, Caddy, lighttpd, HAProxy, certbot (Linux); IIS (Windows)
- **Web Application Management** (Linux): Node.js/pm2/npm/yarn/pnpm/bun, Python/gunicorn/uvicorn/uWSGI, PHP/php-fpm/Composer, Ruby/Puma/Unicorn, Java/Maven/Gradle
- **Services & Process Management**: systemd (Linux), Windows Services
- **Packages & Updates**: apt/dnf/yum (Linux), winget/choco/Windows Update (Windows)
- **Users & Access Management**: Local users, groups, ACLs
- **Security & Hardening**: fail2ban, SELinux, AppArmor, auditd, OpenSSL, certbot (Linux); Defender, BitLocker, AppLocker, TPM, Secure Boot, WDAC, process mitigations (Windows)
- **Firewall Management**: UFW/iptables/nftables (Linux), Windows Firewall
- **Network Configuration**: IP, DNS, routing, NIC teaming
- **DNS Server Management**: BIND/dnsmasq (Linux), Windows DNS Server
- **VPN & Tunnel Management**: WireGuard, OpenVPN, OpenConnect/ocserv, strongSwan/IPsec, Tailscale, ZeroTier (Linux); RRAS, VPN client, NPS, DirectAccess (Windows)
- **Certificates & PKI**: OpenSSL/Let's Encrypt (Linux), Certificate Store (Windows)
- **Backup & Restore**: tar, rsync, restic, BorgBackup, duplicity, rclone, dd (Linux); Windows Server Backup
- **Storage & Disk Management**: fdisk/parted/gdisk, mkfs (ext4/xfs/btrfs), LVM, mount/blkid (Linux); diskpart, volumes, dedup (Windows)
- **System Configuration**: hostname, timezone, features, environment
- **Log Analysis**: journalctl, lnav, multitail, logrotate, logwatch, GoAccess (Linux); Event Log (Windows)
- **Virtualization**: libvirt/KVM, virt-install, libguestfs, qemu-img, Proxmox (qm/pct/pvesh/pvecm), VirtualBox, Vagrant (Linux); Hyper-V, Failover Clustering (Windows)
- **Automation**: Ansible (+ Galaxy/Vault), Terraform, OpenTofu, Packer, cloud-init (Linux); Task Scheduler, scheduled jobs (Windows)
- **Active Directory** (Windows): AD users, groups, computers, OUs, GPO, trusts, managed service accounts, replication, password policy
- **Remote Desktop Services** (Windows): RDP sessions, NLA, RDS collections
- **Registry Management** (Windows): Browse, edit, export registry keys
- **Directory Services & LDAP** (Linux): OpenLDAP, FreeIPA, Kerberos, SSSD, authselect
- **Message Queue Management** (Linux): RabbitMQ, Kafka, NATS, ActiveMQ, Mosquitto/MQTT, kcat
- **Monitoring & Alerting** (Linux): sar/sysstat, mpstat, pidstat, iotop, iftop, nethogs, dstat, atop, htop, glances, collectl, tcpdump
- **Proxy & Cache** (Linux): Squid, Varnish, HAProxy, keepalived, Traefik, Envoy
- **LLM Server Management** (Linux): Ollama, LM Studio, llama.cpp, vLLM, LocalAI, TGI, Hugging Face CLI, GPU tooling (nvidia-smi, rocm-smi)
- **Base Utilities**: Core read-only operations available to all agents
- **Custom Skills**: Unlimited user-defined skills — your own operations, your own command allowlist, your own system prompt, optionally grounded in your own uploaded documentation (RAG). This is how anything outside the catalog gets covered, and it carries the same allowlist and sandbox enforcement as a shipped skill.

## Built-in Agent Capabilities (no skill required)

- **Security Audits**: 28 deterministic Linux checks and 23 Windows checks with LLM-powered analysis, CVE vulnerability scanning, automated remediation, PDF export and scheduled runs.
- **Threat Detection** (Linux): Agents watch hosts in real time for compromise indicators — shells spawned by web servers or databases, credential reads, reverse-shell patterns, persistence installs, suspicious outbound connections — and surface each as an LLM-narrated alert with a severity rating. Container activity is excluded so only host-level events alert. A second mode, Session Threat Detection, analyses admin SSH/sudo sessions against each user's Role Description and flags activity that doesn't fit the role, judging whole sessions rather than isolated events. Every alert is emailed with one-click Kill Service / Kill Session / Discard actions and lands in the Threat Alerts tab of the audit log.
- **System Inventory**: 14 Linux and 13 Windows checks covering services, packages, containers, listening ports and more — including applications installed outside the package manager and services not started through systemd.
- **SSH & Sudo Access**: Discovers all authorized_keys and sudoers rules across servers, maps SSH key fingerprints to team member profiles for identity resolution. Fleet-wide PDF access reports.
- **SSH Key & Sudo Sync**: Push per-user SSH keys and sudo grants from the portal into a managed block in the matching local account's authorized_keys, on Linux and Windows. Matching is by admin-set System Username, so LDAP / SSSD / NIS accounts work; lines outside the managed block are never touched.
- **Activity Audit**: Collects login activity, failed authentication, sudo/elevated commands, and file changes from standard Linux logs (no auditd required) and the Windows Event Viewer. Search across the fleet without dispatching new commands.
- **Certificate Discovery**: A scan that inventories the x509/TLS certificates already installed on your servers (system stores, web-server config, Let's Encrypt live dirs) and flags any expiring, expired, weak or self-signed; certificates ManageLM issued are marked as managed. Metadata only — private keys are never read. Scheduled runs, fleet-wide PDF report and natural-language search.
- **Dependency Scanning**: Listening ports and config file parsing for service discovery
- **Compliance & Frameworks**: Automatically evaluate the fleet against 13 shipped frameworks — CIS Linux Level 1, CIS Windows Server Level 1, CIS Docker, CIS Controls v8 IG1, SOC 2, PCI DSS, ISO 27001, NIS2, NIST CSF 2.0, NIST SP 800-53 Rev. 5, DORA, GDPR Art. 32 and the HIPAA Security Rule. Frameworks can be enabled or disabled per site so scores reflect what is actually in scope. Drift detection alerts when previously passing rules start failing, a per-agent events timeline traces past security events, and per-framework auditor-ready evidence PDFs can be exported. Custom frameworks are added as JSON and are treated exactly like the shipped ones.
- **File Transfers**: Upload/download files up to 25MB with change tracking
- **Change Tracking**: 30-day retention of all file modifications via git-based tracking, covering /etc, /usr/local/etc, /boot/grub and /var/spool/cron
- **Structured File Operations**: `<edit>` (find-and-replace) and `<write>` (create/overwrite) tags for deterministic file I/O — no shell escaping issues
- **Service Monitors**: 49 shipped monitor types — 44 network and service probes (TCP with optional TLS and STARTTLS, HTTP, DNS and UDP) plus CPU, memory, filesystem and process checks and a custom command/script monitor that runs any script you write — with email, webhook and in-app alerts. Response time history and hourly rollups for trend analysis. Monitors can be copied or deleted across several agents and sites at once.
- **Certificate Management (PKI)**: Internal CA + Let's Encrypt ACME (http-01 and dns-01). Agent-side keypair generation (CSR flow — private keys never leave the server). Automatic hourly renewal, CRL generation, public CA/CRL endpoints for trust chain installation, and a service restart after install so the new certificate is actually picked up.
- **System Backups**: End-to-end encrypted filesystem backups to your own S3 storage (OVH, AWS, Cloudflare R2, Backblaze B2, Wasabi, Scaleway, MinIO). Per-backup AES-256-CBC + HMAC-SHA256 keys, agent-side encryption so ManageLM never sees backup content. Multi-GB sources via streaming S3 multipart upload. Configurable schedules (hourly, 6h, daily, weekly, monthly), FIFO retention, restore-to-any-agent, optional service quiesce (stop/restart databases for consistent snapshots), streaming decrypt downloads, detach-on-agent-delete with Reassign workflow.
- **Credential Rotation**: Rotate the passwords and keys your infrastructure runs on, on a schedule you choose — local Linux and Windows accounts, domain accounts, machine-to-machine SSH keypairs, LDAP and Active Directory accounts, PostgreSQL, MySQL/MariaDB, MS SQL Server, Oracle, MongoDB, Redis/Valkey and Couchbase logins, and Microsoft Entra application secrets and user passwords. No value is ever shown, exported or stored: it exists only for the length of one rotation. Each new value is delivered everywhere it is used before the rotation counts as finished — a file on your servers (with owner, group and mode, and the services to restart afterwards), one value inside a config file a service already reads, a Windows registry value, a row in an application's own database, the same local account on other hosts, a script of your own that receives the value, or a secret store: HashiCorp Vault, OpenBao, AWS Secrets Manager, AWS SSM Parameter Store, Azure Key Vault, Google Cloud Secret Manager, CyberArk Conjur, Delinea Secret Server, Doppler, Infisical, Akeyless, 1Password Connect, Kubernetes Secrets and GitLab CI/CD variables. Every rotation is recorded — when it ran, scheduled or manual, which targets took the value, what failed. A rotation will not start while a host it needs is unreachable, and a failed one is retried with a fresh value rather than rolled back. Off by default; enabled under Settings → Optional Features with its own permission.
- **PKCS#11 Keystore**: Private keys held in the portal and used by applications on your servers through a standard PKCS#11 module, without the key ever reaching the host. RSA 2048/3072/4096, EC P-256/P-384/P-521, post-quantum ML-DSA-44/65/87 (FIPS 204), AES 128/256 and HMAC SHA-256/384/512. The agent installs the module itself the first time a key is granted on a host and removes it when the last grant is withdrawn, so there is nothing to deploy or version-track — an application needs only the module path, the token name, the key handle and its PIN. Works with Java SunPKCS11, OpenSSL 3 via pkcs11-provider, p11-kit and the code-signing tools, on Linux and Windows. SHA-1 and MD5 signing remain available for systems that cannot accept anything newer; both are obsolete, and every use is recorded so you can see what still depends on them. Keys can be generated in the portal or imported (PEM, DER, PKCS#12, or raw AES/HMAC secrets) — an imported key stays marked as imported, and importing never makes a key exportable. Each key holds its certificate chain, served over PKCS#11 as a real certificate object, with CSR generation and one-click replacement. Authorisation is per application on a host, not per host: its own credential (stored only as a hash) plus, on Linux, an optional allowlist of Unix accounts the agent reads from the kernel. No route can export a private key. Suspending a grant, disabling a key or an application, or rotating a credential takes effect on the very next operation. Usage is counted per key, per application, per mechanism, per day — successes and refusals, with the reason for the most recent refusal, which the calling application is never told. Not an HSM: keys are software-held and encrypted at rest, so this is central custody and governance rather than a hardware boundary, and it suits signing and decryption rather than TLS termination.
- **Terminal Console**: Open an interactive terminal on any server straight from the portal — no VPN, no SSH keys, no inbound port. The session travels over the connection the agent already holds. Linux and Windows, opens in its own window, fullscreen capable. Granted per server (or per group) rather than account-wide, with no role carrying it — an account owner has no shell anywhere until somebody grants one — and confirming a passkey is required every time. The screen locks after ten minutes idle (the shell keeps running behind it), sessions end with the window or after an hour idle, revoking access closes an open console within the minute, and every session is recorded in the audit log.
- **Graphical Desktop**: A full Windows desktop in the browser, on the same terms as the terminal — no RDP port exposed, no VPN, no jump host. The portal drives the RDP session and the agent is the only thing that touches the host's own loopback RDP port, so the server still listens on nothing; the browser receives drawing instructions, never the RDP stream and never the credentials. Windows will not surrender an existing account's password, so the agent owns a dedicated account and mints it a fresh random password per session, disabling it again on every teardown. Same per-server grant and same passkey as the terminal — no separate permission.
- **Session Recording**: One switch per server or group records every privileged session and makes it replayable in the browser. It covers all three ways in, including the one that does not go through the portal: both browser consoles are recorded by the portal, and the same switch asks the agent to record direct SSH logins on the host itself, attributed by the fingerprint of the key that authenticated (which is what works where many people's keys share root's authorized_keys). SSH capture is output only, never keystrokes, so a password typed at a sudo prompt is never in the file. Recordings are compressed and encrypted with a per-recording key into the account's own S3 storage, retention is an account setting, replaying is itself audited, and recording can be made mandatory so a session that cannot be recorded is refused rather than opened unrecorded.
- **Console Assistant**: An assistant under the terminal that answers questions about what is on screen — why a command failed, what a log line means, what to check next — using the same model the agent already uses, so nothing extra to set up. It runs nothing on the server: it answers in words and may offer a single command, which Run types and executes or Insert places on the prompt for you to read and edit first. Only displayed output is sent (never keystrokes, so a typed password is never included), printed secrets are masked in the browser before anything leaves it, and the conversation disappears with the session. Acting on a suggestion is written to the audit log.
- **Hosting Connectors**: Inventory sync from AWS, Azure, GCP, OpenStack, Proxmox and VMware. Search instances, networks, volumes and security groups across providers alongside on-prem agents, and optionally act on them — start, stop, reboot and snapshot VMs from the portal or by asking Claude, gated per connector by a separate Hosting permission with a full action history. On the hosted platform, a Proxmox or VMware endpoint on a private network can be reached through one of your agents, so the hypervisor API never has to be published.
- **SIEM Connectors**: Forward audit events, alerts, and task activity to Elastic, Splunk, or any HMAC-signed Webhook endpoint.
- **Notification & Ticketing Connectors**: Route platform events to Slack, ServiceNow or Jira with per-category routing and ticket creation toggles.
- **Pentests** (Pro/Enterprise): Authorized external scans of agents built on Nmap, Nuclei, testssl.sh, dig, ffuf and subfinder. Eight targeted tests — full port scan, vulnerability scan, SSL/TLS deep audit, DNS & email security, web application scan, HTTP security headers, directory & file discovery, subdomain enumeration — alongside a basic scan. Findings are tagged with framework references (CIS, PCI DSS, SOC 2, ISO 27001, NIS2, NIST CSF, HIPAA) and rolled into severity-scored reports.

## Portal Meta Tools (32 tools)

These 32 tools come with the MCP server, alongside one tool per skill in the account. A few only appear when they apply: the monitor, certificate, backup, credential and keystore searches follow the optional features enabled on the account, the hosting tools appear once a hosting connector exists (cloud_action once one allows write actions), and the skill-related tools are hidden when the account runs with No LLM. Search tools filter by group, site and free text; search_security, search_activity and get_task_history also accept `since` / `until` (ISO-8601) for a time window. Scans and skill tools take a target: a hostname, display name, group name, site name or "all". Every tool has a REST API equivalent for integrations that use an API key.

- search_agents, get_agent_info — Agent discovery and health monitoring
- get_agent_skills, list_available_skills — Skill management
- list_team_members — Team members with roles, permissions, and registered SSH public keys
- get_account_info — Account plan and usage information, plus the account's groups and sites
- run_security_audit, search_security — Security audit execution and search; search_security returns one merged list across audit findings, pentest findings and threat alerts, tagged by source
- run_inventory_scan, search_inventory — System inventory scanning and search
- run_access_scan, search_ssh_keys, search_sudo_rules — SSH & sudo access scanning, key search with identity mapping, sudo privilege search
- run_activity_scan, search_activity — Activity scan execution and search across logins, failed auth, sudo, and file changes
- run_certificate_scan, search_certificates — Certificate discovery on the servers: every x509/TLS certificate found on disk whatever issued it, with expiry, key strength and self-signed / unmanaged flags
- search_pki — The certificates ManageLM itself issues and renews (Internal CA + Let's Encrypt), by status, source, agent or site
- search_credentials — Rotated credentials: what rotated when, what is due, what failed. Metadata only — credential values are never stored and cannot be retrieved
- search_keystore — The PKCS#11 Keystore: keys and their certificates, the applications granted them, and per-day counts of what each key was used for and what was refused. Metadata only — key material and client credentials cannot be retrieved by any tool
- list_connectors, search_cloud, get_cloud_info, cloud_action — Hosting connector discovery and search across AWS, Azure, GCP, OpenStack, Proxmox and VMware, plus power and snapshot actions on permitted resources (disruptive actions require explicit confirmation)
- search_monitors — Service and resource monitor discovery and filtering
- search_backups — System backup discovery with agent, status, and schedule
- get_task_status, get_task_history, get_task_changes, answer_task, revert_task — Task monitoring, change tracking, and rollback

## Connecting an MCP Client

ManageLM is itself an MCP server, so any MCP-capable client can drive the fleet — the named plugins below are convenience wrappers, not a requirement.

- **Hosted endpoint**: `https://app.managelm.com/mcp` — streamable HTTP transport.
- **Self-hosted endpoint**: `https://<your-portal-host>/mcp`. Private deployments can publish only the OAuth and MCP endpoints on a separate hostname via `PUBLIC_URL` and keep the portal itself unreachable.
- **Authorization**: OAuth 2.0 with PKCE. Discovery lives at `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource`; dynamic client registration and a consent screen are supported and configurable per account. Scoped API keys are the alternative for non-interactive clients.
- **Registry**: listed in the official MCP Registry as `com.managelm/managelm`.
- **Access control**: what a client can do is the intersection of the signed-in user's role and permissions, the servers assigned to them, and the skills assigned to each agent. Per-user IP whitelisting can restrict MCP access further.

## Plugins & Integrations

- **Claude** (MCP Extension): Native integration via Anthropic's MCP protocol. Natural language tasks, multi-server targeting, file transfers, security audits, task history and revert.
- **ChatGPT** (OpenAI GPT): OAuth per-user authentication. Natural language tasks, scans, fleet search and hosting actions in 29 operations covering the MCP tools. Works with SaaS and self-hosted.
- **VS Code** (Copilot Extension): @managelm participant in Copilot Chat with 33 tools modelled on the MCP tools: tasks, scans, fleet search, hosting actions, task history and revert.
- **Cursor**: One-click MCP server install — manage servers without leaving the editor.
- **LM Studio**: One-click MCP server install, so local models can drive the fleet.
- **Goose**: One-click MCP extension install for Block's open-source AI agent.
- **Slack** (Slack App): Real-time alerts for every webhook event, /managelm commands (status, tasks, answers, scans, fleet search), channel routing, HMAC verification.
- **OpenClaw**: 33 tools modelled on the MCP tools (tasks, scans, fleet search, hosting actions) and a signed webhook receiver. Works with any LLM model.
- **n8n** (Community Node): Workflow automation with tasks, scans, fleet search and hosting actions, plus a trigger node for signed webhook events.

Plugin pages: [Claude](https://www.managelm.com/plugins/claude.html), [ChatGPT](https://www.managelm.com/plugins/chatgpt.html), [Cursor](https://www.managelm.com/plugins/cursor.html), [LM Studio](https://www.managelm.com/plugins/lmstudio.html), [Goose](https://www.managelm.com/plugins/goose.html), [VS Code](https://www.managelm.com/plugins/vscode.html), [Slack](https://www.managelm.com/plugins/slack.html), [OpenCLAW](https://www.managelm.com/plugins/openclaw.html), [n8n](https://www.managelm.com/plugins/n8n.html).

Settings → MCP & API exposes ready-to-click install deeplinks with the portal URL and credentials baked in.

## Supported LLM Providers

Agents run on the model you choose. Local runtimes: Ollama, LM Studio, vLLM, LocalAI, llama.cpp, Jan, or any OpenAI-compatible endpoint. Cloud providers: Anthropic (Claude), OpenAI, Google Gemini, xAI (Grok), Groq, Mistral, DeepSeek, OpenRouter, Together AI, Fireworks AI and Perplexity. The LLM is resolved through a hierarchy of agent, group, site and account settings, so a datacenter can point at its own local model. A fourth mode, **No LLM**, runs the platform with no model at all: it is account-wide, no per-site or per-agent override can opt a host back in, and agents on such an account are never sent a provider credential. Tasks and chat, the console assistant, threat detection and skills switch off with it; every deterministic feature — the scans, compliance, monitoring, backups, PKI, credential rotation, the keystore, the consoles with session recording, SSH and sudo sync — is unaffected, and the MCP search and scan tools keep working. Nothing is deleted, so a model can be configured later and everything resumes.

## Platform Features

- **Multi-Tenant Teams**: Owner, admin, member roles with granular per-feature permissions (agents, skills, reports, monitors, certificates, backups, credentials, keystore, connectors, hosting, groups, pentests, audit logs). Invite teammates, scope access per server or group, and restrict individual users to a subset of skills.
- **Server Groups**: Organize agents into groups. Run operations across entire groups with a single request.
- **Sites & Datacenters**: Group agents by location or environment, with per-site LLM resolution, per-site compliance framework scope, and a global site filter across the portal.
- **Site Admin Grants**: Grant a member admin powers on specific sites in addition to their global permissions — a member with no global admin rights can still administer one site.
- **Policy Rulesets**: Markdown policy snippets attached per agent or per group and enforced in every task prompt, accumulating across attachments and pushed to agents instantly.
- **Scheduled Tasks**: Cron-based schedules for backups, log rotation, health checks, audits, inventories and scans — all automated.
- **Webhooks & API Keys**: Real-time notifications on events. A REST API for plugins and automation covering the same features as the MCP server. Every user can create keys; a key acts as its owner, limited to the authorizations chosen for it, and can be switched off without deleting it.
- **Disabling a User**: A member can be disabled instead of removed — they cannot sign in and everything they hold stops working immediately (browser sessions, their API keys, their MCP connections), while their account, group access and keys are kept for a one-click re-enable.
- **Full Audit Trail**: Every action logged with timestamps, IPs, and full context, across four tabs — Agent Activity (with per-operation AI reports, changes-only filter and PDF export), Threat Alerts, Admin Actions and Geolocation — sharing one date-range filter.
- **Passkeys & MFA**: WebAuthn/FIDO2 passwordless login. Registering a passkey is your MFA; account owners can require MFA for everyone, with emailed single-use sign-in codes so nobody is locked out before registering. SSH key as MFA fallback, recovery codes, and IP whitelisting for MCP.
- **OAuth Consent Screen**: Third-party MCP clients requesting authorization show who is asking and where the redirect goes, with a self-identified warning. Configurable (on / off / dynamic-registration-only).
- **Account Migration**: Owners can export an entire account (agents, sites, groups, skills, connectors, monitors, certificates and team) to one passphrase-encrypted file and import it into a fresh account on another deployment — hosted to self-hosted or back — with each agent only needing its server URL repointed.
- **Own SMTP**: Hosted accounts can send alerts, reports, invitations and sign-in messages through their own SMTP server, so email never passes through ManageLM's infrastructure. A test message must be delivered before the option can be switched on.
- **Skill Documents (RAG)**: Attach your own documentation to a skill; relevant chunks are retrieved at task time so the agent works from your runbooks. Unlimited by default on self-hosted.
- **Optional Features**: Monitors, certificates, backups, pentests, credentials and the keystore can each be switched off per account, hiding the feature entirely.

## Extensibility

Nothing in this document is a hard ceiling. Every built-in catalog is a default that you can extend or replace:

- **Any task, any tool**: Skills are allowlists you author. If a command runs on your server, a custom skill can be built around it — with the same enforcement, sandboxing and audit trail as a shipped skill. The catalog covers common administration; it is not the boundary of what an agent can be permitted to do.
- **Custom compliance frameworks**: Add your own framework as JSON — your controls, your mappings — and it scores, drifts and exports evidence PDFs alongside the 13 shipped ones.
- **Custom monitors**: Beyond the 49 shipped monitor types, a command/script monitor runs any script you write and maps it onto the standard monitor envelope using Nagios-compatible exit codes (0 OK / 1 warning / 2 critical) and Nagios-style perfdata, so existing Nagios and Zabbix check scripts work as-is and their metric is charted and alerted like any built-in monitor.
- **Custom event destinations**: Any HMAC-signed webhook endpoint can receive audit events, alerts and task activity, in addition to the named SIEM and ticketing integrations.
- **Any LLM**: Beyond the named providers, any OpenAI-compatible endpoint works — self-hosted, on-prem, or an internal gateway. The model is resolved per agent, group, site or account.
- **Any client**: The MCP server works with any MCP-capable client, not only the listed plugins. A REST API with scoped API keys offers the same features to integrations that do not speak MCP, and webhooks push events out.
- **Your own policy**: Policy Rulesets inject your organizational rules into every task prompt; skill documents (RAG) ground agents in your runbooks; management hints add per-skill context about your environment.
- **Self-hosted without limits**: On self-hosted installs, monitors, certificates, backups, credentials, keystore keys and skill documents are uncapped.

## Comparison with Alternatives

| Capability | ManageLM | SSH + Scripts | Ansible / Puppet | Generic AI |
|---|---|---|---|---|
| Natural language interface | Yes | No | No | Yes |
| AI-assisted browser console | Yes, no SSH key or inbound port | No (SSH client) | No | No |
| Agentic server management (autonomous) | Yes, fleet-wide | No | Limited (playbooks) | No (chat only) |
| Command allowlisting (hard-enforced) | Yes, in code | No | Limited | No |
| Local LLM (data on-server) | Yes | N/A | N/A | No, cloud only |
| Zero inbound ports | Yes | No (Port 22) | No (SSH) | Varies |
| No learning curve | Yes, just talk | No (Bash) | No (YAML) | Yes |
| Skill-scoped security | Yes | No (full access) | Limited (roles) | No |
| Kernel sandbox (Landlock/seccomp) | Yes | No | No | No |
| Full audit trail | Yes | Manual | Yes | No |
| Multi-tenant RBAC | Yes | No | Limited | No |
| Built-in security audits | Yes, with remediation | No | No | No |
| Real-time threat detection | Yes, LLM-narrated | No | No | No |
| Compliance frameworks & evidence PDFs | Yes, 13 frameworks | No | No | No |
| Automated credential rotation | Yes, with vault delivery | No | Limited | No |
| PKCS#11 keystore for signing keys | Yes, keys never reach the host | No | No | No |
| Hosting infrastructure connectors | Yes | No | No | No |

## Pricing

### Free (Free Forever)
- $0/month — no credit card, no feature gates
- 10 managed servers, 1,000 MCP requests/day
- 20 service monitors, 20 system backups, 10 SSL certificates, 10 rotated credentials, 10 keystore keys
- All 33 built-in skills, 396 operations
- Multi-tenant teams & RBAC, server groups, sites, scheduled tasks
- Webhooks & API keys, full audit trail, passkeys & MFA
- Trial LLM included, plus local and cloud LLM support
- Security audits, threat detection, inventory scans, access reports, activity audits, certificate discovery
- Hosting, SIEM, notification and vault connectors
- Service monitors, certificate management, encrypted backups, credential rotation, web console
- Compliance frameworks and evidence PDFs
- All plugins included, self-hosted edition included
- Community support

### Pro — from €99/month
- 25 managed servers, 5,000 MCP requests/day
- 100 service monitors, 100 system backups, 50 SSL certificates, 50 rotated credentials, 25 keystore keys
- Everything in Free, plus enterprise-grade pentests and 100 bundled pentest credits
- Priority support

### Business — from €199/month
- 50 managed servers, 10,000 MCP requests/day
- 200 service monitors, 200 system backups, 100 SSL certificates, 100 rotated credentials, 50 keystore keys
- Everything in Pro, with a larger bundled credit allowance

### Enterprise
- 50 servers and up, with banded volume per-agent pricing
- Custom onboarding, priority support
- See https://lic.managelm.com/ for current plans and pricing

Self-hosted installs are not capped on monitors, certificates, backups, credentials or keystore keys. Plans are managed self-service: a "Manage License" button emails a magic link to a dashboard where you can change plan, cancel or reactivate, rotate the key and edit billing details.

## Deployment Options

### ManageLM Cloud (SaaS)
- Managed infrastructure, start in minutes
- Free for up to 10 agents
- Automatic updates
- Trial LLM included
- Sign up: https://app.managelm.com/register

### ManageLM Self-Hosted (Docker)
- Full data sovereignty
- Docker Compose deployment
- Proxied LLM with centralized API keys
- Multi-arch support (amd64 + arm64)
- No external dependencies
- Guide: https://app.managelm.com/doc/docker.html

### ManageLM Self-Hosted (Package Installer)
- Self-extracting installer for x64 and arm64
- Installs to /opt/managelm-server/
- Guide: https://app.managelm.com/doc/package.html

### Self-Hosted Networking
- **Native TLS**: point TLS_CERT_FILE and TLS_KEY_FILE at your certificate and the portal serves HTTPS directly, agent connections included — no reverse proxy required.
- **Behind a proxy**: TRUSTED_PROXIES tells the portal which front-ends it sits behind, so audit logs, rate limits, GeoIP and per-user IP whitelists see the real client IP.
- **Private deployments**: PUBLIC_URL exposes only the curated public surface (OAuth discovery, token and MCP endpoints) on a dedicated public hostname, so Claude.ai's Custom Connector works while the portal itself stays private. Agents outside the network can enroll through that hostname, including for proxied LLM access.

## Technology Stack

Built on: Anthropic MCP, Claude, Ollama, PostgreSQL, Redis/Valkey, WebAuthn/FIDO2, Ed25519, OAuth 2.0 PKCE, WebSocket, Fastify, TypeScript, Python.

## Company

**RCDevs S.A.**
1 Boulevard du Jazz, 4370 Esch-sur-Alzette, Luxembourg
Email: info@managelm.com
Website: https://www.managelm.com/

## Links

- [Website](https://www.managelm.com/): product overview, feature pages and blog.
- [Portal](https://app.managelm.com/): sign-in to the hosted SaaS console.
- [Documentation](https://app.managelm.com/doc/): install, configure and operate ManageLM.
- [Quick Start Tutorial](https://app.managelm.com/doc/#quick-start): create an account, install an agent, run a first task.
- [Self-Hosted Docker](https://app.managelm.com/doc/docker.html): run the portal yourself from the published Docker image.
- [Self-Hosted Installer](https://app.managelm.com/doc/package.html): self-extracting installer for x86_64 and arm64 Linux.
- [Plugins](https://www.managelm.com/plugins.html): Claude, ChatGPT, Cursor, LM Studio, Goose, VS Code, Slack, n8n and OpenCLAW integrations.
- [MCP Endpoint](https://app.managelm.com/mcp): the hosted MCP server itself, over streamable HTTP with OAuth 2.0.
- [Blog](https://www.managelm.com/blog.html): product announcements and release notes.
- [Pricing](https://lic.managelm.com/): plans, quotas and license management.
- [Legal Agreements](https://www.managelm.com/terms.html): hub linking every legal document below.
- [License Agreement](https://www.managelm.com/legal/license.html): the terms the software is licensed under.
- [Privacy Policy](https://www.managelm.com/legal/privacy.html): how customer data is handled.
- [Data Processing Agreement](https://www.managelm.com/legal/dpa.html): GDPR processor terms for hosted accounts.
- [Maintenance Agreement](https://www.managelm.com/legal/maintenance.html): support and maintenance terms.
- [Company](https://www.managelm.com/company.html): RCDevs S.A., the cybersecurity company behind ManageLM.

## Feature Pages

- [AI-Assisted Console](https://www.managelm.com/features/consoles.html): a browser root shell on any managed server with an assistant that reads the terminal and proposes one command at a time. Assisted, not agentic: the assistant has no shell of its own and executes nothing; a person presses the key. Windows hosts open a full graphical desktop the same way. No inbound port, passkey confirmed at every open, granted per server.
- [Privileged Access](https://www.managelm.com/features/privaccess.html): PAM without a bastion or a VPN. A Console Portal listing every server an operator may open (terminal, file browser, Windows desktop), and a Session Portal drawing who is connected to which server right now and by what, including SSH and RDP logins ManageLM did not open. Logins made with a key ManageLM does not manage are flagged as unmanaged and can raise an email. Passkey step-up on every session, idle lock, per-server grants, optional recording to the account's own S3 storage. Owners and admins only.
- [Security Audit](https://www.managelm.com/features/secaudit.html): 28 deterministic Linux checks and 23 Windows checks covering SSH, firewall, TLS, certificates, SUID binaries, failed logins and Docker, with CVE scanning, severity scoring and automated remediation.
- [Threat Detection](https://www.managelm.com/features/threats.html): real-time detection of compromised services and risky user sessions on Linux, with plain-English alerts.
- [Pentests](https://www.managelm.com/features/pentests.html): automated network, web and DNS penetration tests (nmap, nuclei, testssl.sh) with AI-generated reports.
- [System Inventory](https://www.managelm.com/features/inventory.html): fleet-wide discovery of services, packages, containers, databases and user accounts with version detection.
- [SSH & Sudo Access](https://www.managelm.com/features/access.html): every SSH key and sudo privilege mapped to a person, including NOPASSWD detection and PDF access reports.
- [Service Monitoring](https://www.managelm.com/features/monitoring.html): 49 monitor types over TCP (with TLS and STARTTLS), HTTP, DNS and UDP, plus CPU, memory, filesystem, process and custom script checks, with email, webhook and in-app alerts.
- [Certificates & PKI](https://www.managelm.com/features/certificates.html): issue, renew and revoke TLS certificates from a built-in internal CA or Let's Encrypt (ACME HTTP-01 and DNS-01).
- [System Backups](https://www.managelm.com/features/backups.html): agent-side AES-256 encrypted filesystem backups to your own S3 bucket, restorable to any agent.
- [Credential Rotation](https://www.managelm.com/features/credentials.html): scheduled rotation of service accounts, SSH keys and application secrets, delivered to your vault.
- [PKCS#11 Keystore](https://www.managelm.com/features/keystore.html): RSA, EC, post-quantum ML-DSA, AES and HMAC keys used by applications through a standard PKCS#11 module.

## Blog Posts

Each link is the full post as JSON: title, summary and HTML content in English (en), French (fr) and German (de). Newest first.

- [Privileged Access, Brought to the Next Level: No Passwords, No VPN, No Bastion](https://www.managelm.com/assets/blog/blog9.json): 2026-09-15. Your administrators hold a root password, an SSH key, a VPN profile and a domain account, and every one of them outlives the reason it was issued. Now picture them holding none of it: just a ManageLM account, a passkey, and a page listing the servers they may open. Terminals, Windows desktops, file transfer and an assistant that reads the screen, with no credential anywhere in the story.
- [Not Another Webmin: The Admin Tool That Could Only Be Built Now](https://www.managelm.com/assets/blog/blog8.json): 2026-08-31. Control panels have looked the same since 1997, because every button is a guess somebody made in advance about your future Tuesday. Everything they never guessed ended up in an unlogged SSH session. Why agents change what an admin tool can be, and why the PKCS#11 keystore is the clearest proof.
- [The Password Nobody Changes: Why Credential Rotation Keeps Failing](https://www.managelm.com/assets/blog/blog7.json): 2026-08-21. Most companies have a 90-day rotation policy and a handful of service accounts that haven't changed since 2019. The gap isn't discipline: changing one password means changing it in six other places in the same minute. Where vaults, PAM and Ansible stop short, and why an agent that's already on every server changes the maths.
- [What is ManageLM? Explanation for non-techs](https://www.managelm.com/assets/blog/blog6.json): 2026-07-31. Your team runs your servers by writing what they want in plain English, and an allowlist written in code decides what is actually allowed to happen. Here's how that works, why the AI never holds the keys, and the security review pre-answered so you can forward this to whoever is about to ask.
- [Four Locks on One Door: The Complete Infrastructure Security Stack](https://www.managelm.com/assets/blog/blog5.json): 2026-05-30. Most security platforms give you one lock on the door. ManageLM gives you four: internal audits, daily CVE checks, external pentests, and live threat detection. All bundled into compliance-ready reports.
- [I Was Scared To Let An AI Manage My Servers. I Use It Every Day Now.](https://www.managelm.com/assets/blog/blog4.json): 2026-04-30. Five reasonable fears about letting an AI run commands on production, what actually happened, and how my daily admin life looks now. Includes one 4:12 AM page that ended in eleven minutes.
- [How a DGX Spark Accidentally Became a Server Management Platform](https://www.managelm.com/assets/blog/blog3.json): 2026-04-03. It started with an NVIDIA DGX Spark, a parade of open-source models, and one nagging question: what is this thing actually useful for? The answer turned into ManageLM, AI server management that keeps your data where it belongs.
- [Why MCP Changes Everything for Server Management](https://www.managelm.com/assets/blog/blog2.json): 2026-03-31. The Model Context Protocol (MCP) by Anthropic gives AI tools a structured, authenticated way to interact with external systems. For server management, this is transformative. It replaces fragile scripts and manual SSH sessions with secure, auditable, natural-language operations. Here's how ManageLM leverages MCP to make infrastructure management safer and more accessible.
- [Introducing ManageLM: AI-Powered Server Management](https://www.managelm.com/assets/blog/blog1.json): 2026-03-25. Meet ManageLM, the platform that lets you manage your entire Linux and Windows infrastructure using natural language. Built on Claude's MCP protocol with local LLM execution, command allowlisting, and zero inbound ports.