The Control Plane for Your Infrastructure

Linux servers and Kubernetes clusters — real-time visibility, safe execution and full auditability. Self-hosted, with a free tier for both.

For servers and VMs

ServerMind for Linux

One agent per machine. Real-time state, fleet-wide operations, SafeApply with automatic revert, OpenSCAP compliance and an audit log.

Free for 1 server · Scale from 2

Start free Explore Linux →

For clusters

ServerMind for Kubernetes

One console for every cluster, wherever it runs. Outbound-only agents, built-in GitOps, security posture, NIS2/CRA evidence and a human-approved AI assistant.

Free up to 3 worker nodes · then $99.99/node

Start free Explore Kubernetes →

Operating Infrastructure at Scale Is Hard

As systems grow, safe and consistent execution becomes increasingly difficult.

Coordinating actions across multiple servers requires manual orchestration
Validating changes across environments is difficult, and rollbacks are not always reliable
Observability provides insight, but acting on issues is still operationally heavy
Servers, VMs and Kubernetes clusters are managed through separate workflows
Auditability and consistency often depend on manual processes

The core challenge is not visibility, but controlled and reliable execution.

ServerMind for Linux

Built around a unified model for operating servers — not a collection of tools.

Real-Time Infrastructure State

Live over QUIC

Unified system visibility across your servers and the services on them

Metrics pushed live by an outbound-only agent over QUIC
Files, services, processes, packages and network — in one interface
Browser terminal, gated by permissions
No context switching between tools or SSH sessions
Hardware inventory, disk I/O and network connections

Learn more →

Safe Execution & Rollback

Auto-revert

Config changes that undo themselves if they break

SafeApply for Nginx, Apache and HAProxy configs
Backup, validate, reload, then a 45-second health watch
Automatic revert if the service fails after the change
Config snapshots with diff and restore

Learn more →

Fleet-Scale Operations

Fleet-wide

Run the same operation across your servers from one place

Service control, package installs and upgrades across the fleet
Config deploys with a timestamped backup
Live progress, abort, and searchable job history
Signature-verified agent updates with automatic rollback

Learn more →

Service Map & Topology

Auto-discovered

How your services depend on each other — across hosts

Dependency map built from live connections — nothing to configure
Cross-host dependencies in one visual graph
Live health per service, straight from the agent
Blast radius: see what breaks before you touch it
Hidden dependencies surfaced, such as systemd units and tunnels

Learn more →

Application & Runtime Observability

7 runtimes · 5 databases

Application and data-layer visibility without external tooling

JVM, Node.js, Python, .NET, PHP-FPM, Ruby and Go runtimes
PostgreSQL, MySQL/MariaDB, Redis, MongoDB and Cassandra
Nginx, Apache, HAProxy, RabbitMQ and Kafka
From infrastructure to application layer — in one view

Learn more →

Compliance, Security & Auditability

Full audit trail

Operational control with built-in governance

OpenSCAP compliance scanning — CIS, STIG and more
Audit log of actions, users and changes, with CSV/JSON export
File integrity monitoring and access tracking
Incident management with severity levels and post-mortems

Learn more →

Intelligent Operations

4 AI providers

Context-aware AI with guardrails — it proposes, you approve

Anthropic Claude, OpenAI, Google Gemini and self-hosted Ollama
Reads logs, configs and metrics — suggests scoped actions
Changes require your approval; permissions enforced server-side
Secrets redacted before anything reaches the model

Learn more →

Access Control & Identity

600+ permissions

Fine-grained access control for every action

Custom roles over 600+ permissions in 50+ categories
MFA/TOTP with single-use backup codes
Break-glass login, lockout protection and session management
Join servers to Active Directory via realmd, SSSD and Kerberos

Learn more →

Alerting & Notifications

4 channels

Alerts on the signals that matter, where your team works

Slack, Microsoft Teams, Telegram and webhooks
CPU, memory, swap and disk thresholds per server or fleet-wide
Log pattern matches and security events trigger alerts
Auto-resolve, and critical alerts open incidents

Learn more →

Backup & Config Recovery

8 destinations

Back up ServerMind itself and roll web server configs back

ServerMind database backups to disk, S3, Azure, GCS, B2, SMB or SSH
Web server configs versioned before every edit
One-click restore for Nginx, Apache and HAProxy configs
Last 10 versions kept per config

Learn more →

Uptime & Synthetic Monitoring

5 check types

Health checks run by your own agents, with response time history

HTTP, TCP, DNS, SSL and Ping checks, every 5s to 1h
Uptime percentage per check and across the fleet
SSL certificate days-to-expiry at a glance
Response time history per check

Learn more →

Scheduling & Automation

Visual builder

Cron jobs and systemd timers across your servers, managed visually

Visual cron builder with presets and a plain-English summary
Create, edit and delete cron jobs with a run-as user
See every systemd timer and cron job on each server
Server-enforced permissions on every change

Learn more →

Explore ServerMind for Linux→

ServerMind for Kubernetes

A self-hosted multi-cluster control plane: one console for every cluster, wherever it runs.

Multi-Cluster Fleet

Outbound-only

Import, registration token, or secretless ServiceAccount/OIDC join
Fleet inventory by region with health and capacity
Provision k3s or RKE2 over SSH on bare metal or VMs
Multi-cluster Services and federated workload placement

Learn more →

Live Operations

Exec · logs · port-forward

Work with every cluster in real time, from the browser

Cluster and API explorer across every kind, including CRDs
YAML editor driven by the cluster’s own OpenAPI schemas
Pod exec, port-forward and live log tails
Events kept beyond the apiserver’s one-hour window

Learn more →

GitOps & Helm

No Argo · no Flux

Deliver from git or a chart repository, with guardrails

Generators: list, clusters, git directories and files, matrix, merge
Sync gates on deletions, policy, image vulnerabilities and readiness
Hydration opens GitHub pull requests or GitLab merge requests
Helm catalog rendered on the hub — no repository egress needed

Learn more →

Upgrades & Lifecycle

Drain preview

Know whether, when and in what order to upgrade

Readiness scan: deprecated APIs, version skew, blocking PDBs
Read-only preview of a drain’s blast radius
30-day window of deprecated-API usage per cluster
Ingress-nginx to Gateway API migration with cutover checks

Learn more →

Security Posture

Every 5 minutes

A continuous, per-cluster view of risk

RBAC, NetworkPolicy, images and PolicyReports assessed
Falco runtime alerts
Vulnerability triage per image, with optional EPSS scores
Fleet-wide TLS certificate expiry inventory

Learn more →

Compliance & Audit

NIS2 · CRA

Evidence an auditor can take away

CIS, NSA and PSS results from the scanners you already run
Sealed NIS2/CRA evidence packs, printable to PDF
CRA Article 14 report content and fleet-wide CVE exposure
Hash-chained audit log with an integrity check

Learn more →

Identity & Access

OIDC · SAML · LDAP

Your identity provider, your rules

Single sign-on with OIDC, SAML 2.0 and LDAP / Active Directory
MFA (TOTP and WebAuthn), just-in-time access, break-glass
Optional impersonation — the cluster’s own RBAC decides
Multi-tenant isolation down to database row-level security

Learn more →

AI With Guardrails

Human-approved

The model proposes; a human approves

Explain, diagnose and chat, grounded in live cluster state
Anthropic, OpenAI, Azure OpenAI, Ollama or compatible endpoints
Secrets scrubbed before anything reaches a prompt
Approved remediations for crash loops, OOM and stuck rollouts

Learn more →

Observability

No Prometheus to run

Metrics, topology and health — built in

Metrics with a PromQL subset
eBPF service topology — no Cilium or Hubble required
Health audits across every cluster
Daily or weekly email digests

Learn more →

Alerting & Anomalies

No thresholds needed

Know about problems before your users do

Alert rules delivered to email, Slack, Teams or a webhook
Anomaly detection with no thresholds to set
Deletion protection for critical resources
Protected Secrets that can’t be read casually

Learn more →

Backup & Recovery

Restore-tested

Backups you have actually seen restore

Hub database backups on by default
Weekly automated restore check
etcd snapshots to S3
Velero and CSI snapshots surfaced per cluster

Learn more →

Hub Operations

HA · air-gap

Built to be run by a platform team

Multiple replicas with mTLS peer forwarding
Air-gap mirroring; images with SBOM and SLSA provenance
Encryption at rest with Vault Transit or AWS KMS
Optional FIPS 140-3 build of the manager

Learn more →

Explore ServerMind for Kubernetes→

How ServerMind Works

From state to execution — without context switching.

1 — Live state

Observe

Live state from every server and cluster — no polling.

Agents stream state outbound over QUIC — no inbound ports
Servers, services, clusters and workloads in one console
No SSH sessions, no kubeconfig juggling

→

2 — Unified context

Assess

Context in one place — no tool switching.

Service map and blast radius for servers; health audits for clusters
Incidents with severity, timelines and post-mortems
AI explanations grounded in live state (optional)

→

3 — Preview + validate

Decide

See what a change will do before it happens.

Web server configs tested before reload on Linux
Kubernetes dry-run and diff against the live cluster
GitOps sync gates on deletions, policy and vulnerable images

→

4 — Scoped + reversible

Execute

Changes applied safely — scoped and reversible.

One server, a selection, the whole fleet — or one cluster
SafeApply watches the service and reverts automatically
Helm upgrades roll back on failure; GitOps rolls back to a previous sync

→

5 — Status + audit

Verify

Clear status and a record of what changed.

Job and sync status with searchable history
Audit log of every action and who took it
Health checked again after the change

Live state from every server and cluster — no polling.

Agents stream state outbound over QUIC — no inbound ports
Servers, services, clusters and workloads in one console
No SSH sessions, no kubeconfig juggling

Context in one place — no tool switching.

Service map and blast radius for servers; health audits for clusters
Incidents with severity, timelines and post-mortems
AI explanations grounded in live state (optional)

See what a change will do before it happens.

Web server configs tested before reload on Linux
Kubernetes dry-run and diff against the live cluster
GitOps sync gates on deletions, policy and vulnerable images

Changes applied safely — scoped and reversible.

One server, a selection, the whole fleet — or one cluster
SafeApply watches the service and reverts automatically
Helm upgrades roll back on failure; GitOps rolls back to a previous sync

Clear status and a record of what changed.

Job and sync status with searchable history
Audit log of every action and who took it
Health checked again after the change

From visibility to controlled execution.

Get Started

Deploy ServerMind and start operating your infrastructure with full visibility and safe execution.

Register & activate

Create your account and get your activation code.

Install the control plane

Self-hosted: Docker Compose for Linux, a Helm chart for Kubernetes.

Connect servers or clusters

Agents dial out to your control plane — no inbound ports to open.

Get Started Free View Pricing Read the Docs

No credit card required to start. Fully self-hosted and on-prem.