A login sees only its organization's machines, read-only.
Telegram groups
An organization with its own chats receives its machines' reports and
alerts only there — never in the global groups. Save with both
chat ids empty to return the org to the global groups. Add the bot to
each group once, then use Send test to verify.
AI analysis
Which model analyses each scan, and how much effort it spends, grouped
by provider. Applies to every machine that has no setting of its own;
each machine can be pinned separately on its card below. Changes take
effect on the machine's next scan.
The analysis runs on this server and the API key is set here, in
the backend's .env (ANTHROPIC_API_KEY, or
DEEPSEEK_API_KEY for a DeepSeek model) — machines hold no
keys of their own. Selecting a provider whose key is missing fails the
next scan with a message that says so; agents from before this change
still analyze locally with their own keys.
Machines
Archived machines
Archived machines are hidden from the list above and skipped by
"Scan all online". Their past scans stay in the history below, and a
machine that checks in again returns to the list automatically.
Archive is for machines that are gone — to stop a machine you still
use from scanning, use "Pause scanning" on its card instead: it stays
in the list, stays online, and stays paused until you resume it.
Phishing checks
Loading…
Checked
Source
From
Subject
Verdict
No messages analyzed yet.
Accepted conditions
Things the AI keeps reporting that you have looked at and decided are
fine — "we keep Remote Login on for support", "AnyDesk is ours". The AI
is told not to report them again, so real findings stop being buried
under the same known ones every night. It will still speak up if the
same area changes in a genuinely new way. Reaches every machine on its
next check-in, within about a minute.
Remote sessions
A session lets the machine hold a reverse SSH tunnel open for a limited
time. It does not by itself give anyone a shell — your own SSH private
key does that, and this server has never seen it.
Online history
Online — the machine was checking in during this time.
The app was running and the machine was reachable.
Scan received — one scan arrived at this moment. It proves the
machine was up just then, but says nothing about the hours either side, so it is
not counted as uptime.
No record — nothing was heard from the machine. Either it was off
or asleep, the app was not running, or it could not reach this server.
Scan history
Scanned
Host
Type
Risk
Summary
Each cell is one day for one machine: the worst risk level seen that
day, and how many scans ran. Empty means no scan was received.
Archived machines are left out — switch to List to see their scans.
clean nothing worth reporting
low minor findings, no action needed today
medium worth looking at
high act soon
critical act now
data only collected without AI analysis
no scan nothing received
The level is Claude's judgement of that scan, and a cell shows the
worst of the day — one critical finding colours the whole day, even
if a later scan came back clean.
No scans received yet. Run a scan from the desktop app with a backend URL
configured.
Admin activity
Changes made from this panel — pausing, renaming, moving, deleting,
and the AI analysis settings. Scans themselves are in the history above.