Server management assisted by AI.
By RCDevs S.A. · 15 years in cybersecurityThe complete platform for your server fleet: system admin, security, compliance, monitoring, PKI, backups, credential rotation and much more. Drive it in natural language with your preferred AI: assisted in the console, or fully agentic. Execution stays on a privately-hosted LLM. No SSH. No scripts. No blind trust.
Built on trusted foundations
The future of IT management.
No more rigid dashboards and scripts. The next era of infrastructure is conversational, intelligent, and secure by design.
Talk to your infrastructure
The future is natural conversations with your IT systems: voice or prompts, no more hard-coded interfaces. Just talk to an AI that distributes tasks to a fleet of autonomous sysop agents, each with their own intelligence and specialized skills.
Local + Cloud AI, the right way
The work is split where it belongs: a local model on your own servers reads the logs, configs and secrets, so what your machines print stays with your machines. The reasoning that needs a frontier model (planning a change, explaining a failure) happens in the cloud, on the description of the problem rather than on its contents.
Not another control panel
Control panels and config tools (Webmin, cPanel, Plesk and the rest) automate only what was predicted, with every button and playbook written in advance. ManageLM is agent-based: smart agents on your servers understand intent, inspect the live system, and handle the tasks no menu or playbook ever anticipated.
Three layers. Zero complexity.
From natural language to server execution in seconds. With every command validated and constrained.
Ask in plain language, from wherever you work
The portal, Claude over MCP, the browser console, the server's own shell, or a plugin in the tool you already use. All the same platform. "Restart the app", "Check logs", "Update packages on all staging servers".
Portal authenticates & routes
The ManageLM portal verifies your identity via OAuth 2.0, checks permissions, identifies the target agent, and dispatches the task over a secure WebSocket channel.
Agent executes with a local LLM
The lightweight agent uses Ollama (or any compatible LLM) in your infrastructure to interpret the task, generates commands, validates each one against the skill's allowlist, and executes. A single LLM server can serve all your agents, and with your own model nothing your servers print ever leaves your network.
See it in action.
A clean, fast interface built for sysadmins who need clarity and full control. In light or dark.
Security isn't a feature.
It's the architecture.
The model is treated as untrusted input. Every command it produces is checked in code, so a hallucination or a prompt injection has nothing to act on.
Command Allowlisting
Skills define explicit permitted commands. Every AI-generated command is validated in code. Anything outside is blocked.
Run the LLM Yourself: Data Stays In Your Network
Point the agents at your own Ollama instance and task interpretation never leaves your infrastructure: passwords, configs and logs stay inside. A hosted model is available too, for teams that do not want to run one.
View-Only AI Access
Switch a server or a whole group to view-only and the AI can inspect and report there, but not change anything. Enforced by the kernel on the host. Skills start with no write commands at all until you grant them.
Zero Inbound Ports
Agents connect outward via WebSocket. Your servers never expose a port. Nothing to scan, nothing to brute-force, no SSH or VPN to keep patched.
Secrets Hidden from AI
Secrets are env vars. The LLM only sees $VAR_NAME. Actual values injected at execution time.
Ed25519 Signed Messages
Every portal-to-agent message is cryptographically signed. Agents reject unsigned or tampered messages. No command can be injected via the WebSocket.
Change Tracking & Revert
Every mutating task is git-snapshotted before and after. See exactly what changed, get the full diff, and one-click revert any task within 30 days.
Kernel Sandbox (Landlock + seccomp)
Opt-in kernel confinement (Linux). Landlock restricts filesystem writes to allowed paths. seccomp-bpf blocks dangerous syscalls like mount and reboot. Even if a command passes all other checks, the kernel stops it.
✓ LLM is untrusted by design
The AI generates commands, but every command is validated in code before execution. A prompt injection or a hallucination cannot reach the shell.
↻ Execution limits per task
Max 10 turns · 120s timeout · 8KB output cap. Every operation logged in a full audit trail.
33 skills. 390+ operations.
From systemd to Kubernetes, Active Directory to VPNs. On Linux and on Windows. Every skill is security-scoped with an exact command allowlist.
Security, monitoring, PKI & backups.
Built in. One click.
Automated security scanning, full service discovery, SSH & sudo access mapping, and user activity auditing on every server: no skills required, no prompting. Just actionable results.
Security Audit
One-click security scan across 28 checks on Linux and 23 on Windows: SSH hardening, firewall rules, TLS ciphers, certificate expiry, SUID binaries, failed logins, Docker exposure, and more. AI-analyzed findings with severity ratings and actionable remediation.
- ● Public vs. private server context
- ● One-click automated remediation
- ● PDF security report export
- ● CVE scanning with actively-exploited alerts
Pentests
Automated penetration testing from the attacker's perspective. Scans your public servers with nmap, nuclei, and testssl.sh. AI-generated reports with findings, severity scores, and compliance mapping.
- ● 9 security tests (ports, vulns, TLS, web, DNS)
- ● Self-scan enforcement & domain verification
- ● Results feed into compliance frameworks
Threat Detection
Real-time, AI-narrated threat detection on your Linux servers. Catches compromised services and risky user sessions, then turns them into plain-English alerts with a severity rating and one-click actions to stop them.
- ● Service & daemon compromise, in real time
- ● User sessions judged against skills and roles
- ● One-click kill or discard from the alert
System Inventory
Discover every running service, installed package, container, database, and user account on your servers. AI-structured into categorized entries with automatic version detection.
- ● 12 service categories
- ● Automatic package version extraction
- ● Fleet-wide PDF inventory export
SSH & Sudo Access
Map every SSH key and sudo privilege across your infrastructure. Fingerprints are matched against team profiles for identity resolution: know exactly who has access to what, and manage it in plain English.
- ● Automatic identity mapping
- ● NOPASSWD sudo detection
- ● Fleet-wide PDF access report
Activity Audit
Track who logged in, what they did with sudo, which config files changed, and what packages were installed. From standard Linux logs or Windows Event Log. Identity mapping links system users to your ManageLM team.
- ● No auditd: works on any Linux or Windows
- ● Team identity mapping via GECOS
- ● Fleet-wide PDF activity report
Service Monitoring
Track availability and response time of 49 services across your fleet: databases, web servers, message brokers, VPNs, and more. Up/down transitions trigger email, webhook and in-app alerts, with hourly response-time rollups for trend analysis.
- ● 49 service types (TCP, HTTP, ICMP)
- ● Email, webhook & in-app alerts
- ● Response time history & rollups
Certificate Management
Issue, renew, and revoke TLS certificates from a built-in internal CA or Let's Encrypt. Certificates are deployed directly to agents over WebSocket with automatic service reload. Daily auto-renewal sweep with CRL generation.
- ● Internal CA + Let's Encrypt ACME
- ● Auto-renewal & CRL generation
- ● Private keys never stored on portal
System Backups
End-to-end encrypted filesystem backups to your own S3 storage (OVH, AWS, R2, B2, Wasabi, Scaleway, Hetzner, DigitalOcean, Google Cloud, MinIO and more). Agent-side AES-256 encryption means ManageLM never sees your data. Streaming decrypt downloads and restore-to-any-agent.
- ● 12 S3-compatible providers supported
- ● AES-256-CBC + HMAC, keys per backup
- ● Service quiesce for consistent DB snapshots
AI-Assisted Console
A root shell on any server, in your browser, with an assistant that reads your screen and suggests the next command. It has no shell of its own and runs nothing. Every command that executes ran because you pressed Enter.
- ● The assistant suggests: you keep the keyboard
- ● No inbound port, no VPN, no jump host
- ● Passkey every time, granted per server
Credential Rotation
Rotate the passwords and keys your service accounts run on (local Linux and Windows accounts, Active Directory, databases, Entra, SSH keys), then deliver each new value where it is actually consumed. The agents already on your servers do the work, so nothing has to be reachable from outside.
- ● Scheduled rotation with an audit trail
- ● Delivered to files, live configs and 8 vaults
- ● No value is ever stored or shown
PKCS#11 Keystore
Hold your signing keys in the portal and let applications use them without ever having them: RSA, elliptic curve, post-quantum ML-DSA, AES and HMAC. The agent installs the PKCS#11 module itself, so there is nothing to deploy on the host and nothing to configure beyond a key handle and a PIN.
- ● Standard PKCS#11: Java and OpenSSL
- ● Post-quantum ML-DSA, RSA and EC
- ● Per-app credentials, instant revocation
Map your security posture
to industry standards.
Automatically evaluate your fleet against 13 frameworks: CIS, SOC 2, PCI DSS, ISO 27001, NIS2, DORA, GDPR Article 32, NIST and HIPAA. Detect drift, track progress, and generate auditor-ready evidence PDFs. All from the same security scans.
13 Frameworks
CIS Level 1, CIS Controls v8, CIS Docker, CIS Windows, SOC 2, PCI DSS, ISO 27001, NIS2, DORA, GDPR Article 32, NIST CSF, NIST 800-53 and HIPAA. All evaluated automatically against your fleet's security scan results. Add custom frameworks with a single JSON file.
Drift Detection
When a rule that previously passed starts failing, ManageLM detects it instantly. In-app alerts and optional email notifications so your team catches regressions before auditors do.
Evidence PDFs
Generate per-framework audit evidence documents with control-by-control status, technical check results, per-server findings with raw command output, remediation guidance, and a full infrastructure inventory.
One platform, many ways in.
Five ways into the same fleet, under the same permissions and the same audit trail: the web portal, Claude over MCP, a browser shell on any server, the server’s own command line, and plugins for the tools your team already works in.
| Portal | Claude / MCP | Console | Shell | Plugins | |
|---|---|---|---|---|---|
| Work in natural language | ✓ Guided | ✓ Best | ✓ Assistant | ✓ On the host | ✓ In your tools |
| Console-based AI assistance | ✓ Launches it | ✗ | ✓ Best | ~ Already on it | ✗ |
| Fleet-level investigations | ✓ Bulk select | ✓ Fleet-wide | ✗ One host | ✗ One host | ✓ Same reach |
| On-demand smart reporting | ✓ Fleet-wide PDFs | ✓ Just ask | ~ This host | ~ This host | ✓ Same answers |
| Security audits and fixes | ✓ Scan + remediate | ✓ Ask for findings | ~ By hand | ~ By hand | ✓ Same findings |
| Auditor-ready evidence | ✓ Per-framework PDFs | ✓ Ask for status | — | — | ~ Via portal |
| Threat detection and response | ✓ Alerts + one-click kill | ✓ Investigate & act | ✓ Hands-on triage | ~ That host | ✓ Same reach |
| One-click privileged access | ✓ Roles + passkey | ✓ Your own role | ✓ Root, no SSH key | ~ Host login | ✓ Your own role |
| Passwords and secrets lifecycle | ✓ Rotate and deliver | ✓ Finds them | — | — | ~ Via portal |
| Scheduled maintenance | ✓ Built-in scheduler | ~ Via portal | — | ✓ Cron | ✓ Workflow tools |
| Emergency troubleshooting | ✓ From anywhere | ✓ Step by step | ✓ Root shell, no VPN | ✓ Works offline | ✓ In your tools |
| Best for | Fleet control, RBAC and reporting | Complex, multi-step work | Hands-on troubleshooting | Local, scripted and offline use | The tools your team already uses |
Assisted and agentic. You choose, task by task.
Most tools pick a side: an AI that only talks about your servers, or automation that only runs playbooks. ManageLM does both. Keep the keyboard when a job needs care, or hand the whole task to an agent.
AI-assisted administration
Open a real shell on any managed host straight from your browser: no SSH key, no VPN, no open port 22. You type, and the assistant works with you: it explains what went wrong and proposes the next command. Nothing reaches the shell until you press Run or Insert.
Agentic administration
Describe the outcome and let the platform work it out. Autonomous agents pick the right skills (33 of them, 390+ operations), plan the steps and run them across the whole fleet, inside a hard-enforced command allowlist, a kernel sandbox and a full audit trail.
Agentic does not have to mean write access.
View-only AI access is a switch on one server or on a whole group. With it on, agents still inspect, correlate and report across the fleet. They simply cannot change anything. The restriction is enforced by the kernel on the host, not by asking the model to behave.
Not just another management tool.
Built for the teams who run mixed Linux and Windows fleets and have to answer for them: internal IT, MSPs and hosting providers. The only platform that puts both AI assistance and AI automation behind hard-enforced security.
| ManageLM | SSH + Scripts | Ansible / Puppet | Generic AI | |
|---|---|---|---|---|
| Natural language interface | ✓ | ✗ | ✗ | ✓ |
| No learning curve | ✓ Just talk | ✗ Bash | ✗ YAML | ✓ |
| AI-assisted browser console | ✓ No SSH key | ✗ SSH client | ✗ | ✗ |
| Agentic server management (autonomous) | ✓ Fleet-wide | ✗ | ~ Playbooks | ✗ Chat only |
| IDE, chat & workflow integrations | ✓ MCP + plugins | ✗ | ~ API only | ~ Chat only |
| Command allowlisting (hard-enforced) | ✓ In code | ✗ | ~ Limited | ✗ |
| Skill-scoped permissions | ✓ | ✗ Full access | ~ Roles | ✗ |
| Kernel sandbox (Landlock/seccomp) | ✓ | ✗ | ✗ | ✗ |
| Zero inbound ports | ✓ | ✗ Port 22 | ✗ SSH | ~ Varies |
| Private LLM (data stays in your network) | ✓ | N/A | N/A | ✗ Cloud only |
| Full audit trail | ✓ | ~ Manual | ✓ | ✗ |
| Multi-tenant RBAC | ✓ | ✗ | ~ Limited | ✗ |
| Built-in security audits | ✓ + remediation | ✗ | ✗ | ✗ |
| Compliance frameworks & evidence PDFs | ✓ 13 frameworks | ✗ | ~ DIY roles | ✗ |
| Automated penetration testing | ✓ 9 tests | ✗ | ✗ | ✗ |
| Runtime threat detection | ✓ + one-click response | ✗ | ✗ | ✗ |
| Credential rotation & delivery | ✓ End-to-end | ~ Scripts | ~ Storage only | ✗ |
| Certificate management & PKI | ✓ CA + LE | ✗ | ~ Modules | ✗ |
| Asset & software inventory | ✓ | ~ Manual | ~ Facts | ✗ |
| Service monitoring & alerts | ✓ 49 services | ✗ | ✗ | ✗ |
| Encrypted S3 backups & restore | ✓ AES-256 client-side | ~ Scripts | ~ DIY | ✗ |
| Cloud & infrastructure connectors | ✓ Synced | ✗ | ~ Modules | ✗ |
Free for 10 servers. No catches.
Every feature, every integration, every skill. Unrestricted on your first 10 agents. No credit card. No time limit. No feature held back for a paid tier.
- All 33 built-in skills
- 390+ operations
- Multi-tenant teams & RBAC
- Server groups
- Scheduled tasks
- Webhooks & API keys
- Full audit trail
- Passkeys & MFA
- Trial LLM included
- Local LLM support
- Security audits & inventory
- Service monitoring & alerts
No credit card required · No feature gates · Full platform access
Need more agents?
Scale beyond 10 agents with flexible plans for growing teams and enterprises.
- Unlimited agents
- Enterprise-grade Pentests
- Priority support
- Custom onboarding
- Volume discounts
Deploy your way.
Start with our managed cloud in seconds, or self-host on your own infrastructure with Docker.
ManageLM Cloud
Managed SaaS: start in minutes
- Free for up to 10 agents
- Fully managed infrastructure
- Automatic updates
- Trial LLM included
ManageLM Self-Hosted
Run on your infrastructure
- Full data sovereignty
- Docker Compose deployment
- Proxied LLM: centralized API keys
- No external dependencies
Everything you need at scale.
Multi-Tenant Teams
Owner, admin, member roles with granular permissions. Invite teammates, scope access per server or group.
Server Groups
Organize agents into groups. Run operations across entire groups with a single request.
Scheduled Tasks
Cron-based schedules for backups, log rotation, health checks, all automated.
Webhooks & API Keys
Real-time notifications on events. Full REST API for integration into existing workflows.
Full Audit Trail
Every action logged with timestamps, IPs, and full context. Complete accountability.
Passkeys & MFA
WebAuthn/FIDO2 passwordless login. Multi-factor auth and IP whitelisting for MCP.
Get in touch.
Questions, demos, or enterprise needs? We'd love to hear from you.
Documentation
Response Time
We typically respond within 24 hours on business days.
Email client opened!
Please send the email from your mail application to complete the message.