What’s new in Opservo

API tokens with scopes and expiry; stronger agent signing

• Workspace API tokens now carry a scope (read, deploy or ops) and an expiry (default one year), and every token-reachable route checks it.
• The agent signs every request with a timestamp and a one-time nonce on top of the body signature; old agents keep working until you require the new scheme.
• Login, two-factor and password-reset endpoints are rate-limited per address and per account; wrong codes count toward the lockout.

Security →

Ask Claude, Cursor or VS Code about your servers (MCP server)

• A read-only MCP server at api.getopservo.com/mcp exposes the same per-server reads as Opservo’s chat: overview, services, recommendations, log summary, incident timeline, domains, recent commands and Kubernetes snapshot.
• Connect with one click: Sign in with Opservo (OAuth) from Claude, Cursor or VS Code, pick the workspace, and see connected apps under Account → Developer. Or use a workspace API token.
• Listed in the official MCP Registry, Smithery and Glama. It can never run a command.

MCP docs →

Live terminal in the browser

• Open a real shell on a server from the dashboard for top, vim and anything that asks a question. Sessions are recorded for the audit log; what you type at a password prompt never is.
• Two locks, both off by default: an owner turns it on per server in the dashboard, and the server itself must allow it. Opening a session always asks for a fresh two-factor step-up.

Remote actions →

Fleet runs: dry run, schedules and stop now

• Preview exactly which servers a run would touch, and which would be skipped and why, before dispatching anything.
• Schedule a run daily, on weekdays or every N hours in your time zone; a schedule pauses itself with a reason if its creator loses admin, the plan changes or the runbook disappears.
• “Stop now” closes queued commands and kills the running ones on every server.

“Monitored by Opservo” badge

• Put a small badge on any site you monitor, optionally with a live up/down dot from one of your uptime monitors.
• Each verified badge earns 100 credits a month, up to five per workspace.

Owners can reset a teammate’s two-factor

• Lost an authenticator and the recovery codes? A workspace owner can reset two-factor from Account → Team after a fresh step-up; the person is signed out everywhere and emailed.

Fleet runs and server tags

• Tag servers (prod, client-x, web) and run one command, a saved runbook or a file push on every server with a tag or a hand-picked set, in waves, stopping at the first failure if you want.
• Every step on every server is a normal audited command; nothing new runs on the agent. Rollout 1 / 25 % / 50 % / all, with per-server output in one results table.
• Available from the fleet grid, from Runbooks, and from the AI chat in act mode, which always shows who would run before anything is dispatched.

Remote actions →

Kubernetes clusters

• A separate read-only agent runs as one Deployment per cluster and reports nodes, workloads, pods, resources and events; install with one kubectl apply.
• Findings per workload (crash loops with the exit code and the last log lines, pending pods, failing probes) and critical ones become alerts like any server.

Docs →

Compliance evidence: SOC 2, PCI-DSS v4 and HIPAA

• Each control is mapped to the facts the agent already reports, so every server gets pass / fail / partial / manual per control with evidence lines and the fix. Nothing new to install.
• A score and a coverage figure side by side, so manual controls are never overstated, and a PDF report with a scorecard and a per-server control table.

On-call schedules with SMS, WhatsApp and voice paging

• Daily, weekly or custom rotations in your time zone, a backup layer, overrides and business-hours follow-the-sun. Import a PagerDuty or OpsGenie schedule to start.
• Escalation steps page the on-call person by SMS, WhatsApp or a voice call that asks them to press 1, through your own Twilio account. Unverified phones are never paged.

Incident management →

Custom dashboards, Prometheus export and a Grafana data source

• Build your own dashboards from 80+ catalogued metrics, share one publicly with an optional password.
• Scrape any server or the whole fleet in Prometheus format with an API token, or stream metrics every 1–15 minutes to a webhook, Datadog or New Relic.
• An Opservo data source for Grafana.

Cloud cost per server (AWS, Azure, Google Cloud)

• Daily cost per resource joined to the server it belongs to, so the cost page ranks servers by spend and shows actual cost next to the right-sizing estimate.
• Reserved Instance and Savings Plan recommendations, and an optional monthly cost digest by email.

SLA tracking and PDF reports

• Set a promised uptime per monitor (99.9 %, 99.95 %…) over a month, quarter or year and see achieved uptime, the error budget and the incidents that used it.
• A warning at 80 % of the budget and a critical at 100 %, once per period, and a one-page PDF per period for a client or an auditor.

Uptime monitoring →

Database insights without instrumentation

• MySQL: slow-log status, buffer-pool hit rate, temp tables on disk, index-less joins, queries running right now and the top slow patterns. Redis: eviction policy, fragmentation, rejected clients, the slow log.
• PostgreSQL on the host, in a container or on a private RDS (read-only role): connections, idle-in-transaction, cache hit, pg_stat_statements top queries and table bloat.
• Literals are stripped before anything leaves the server, and the agent never reads an application .env.

Tabbed terminal with AI mode and streamed output

• Several servers open at once in a dock that remembers its tabs. One input for commands and for the AI, which can run fixes on servers where actions are enabled.
• Long commands stream their output every second, and the agent polls faster while a terminal is open.
• SSH keys: grant or revoke a public key for a Linux user from the Users tab, tracked so it can be revoked by row.

One alert for a failing disk

• Kernel I/O errors, SCSI sense codes, filesystem complaints and SATA link resets are attributed to the device and folded into one critical alert naming the disk, instead of dozens of log alerts.
• The SMART check now warns on reallocated, pending or uncorrectable sectors and NVMe media errors, not only on a normalized value.
• A workspace with open critical alerts and no notification channel sees a banner and its owners get a reminder email.

Screen lock: PIN or passkey after idle

• The dashboard locks after a period you choose (5 minutes to 12 hours) and needs a 4–8 digit PIN or a passkey to continue. Enforced by the API, not just an overlay.
• Five wrong PINs sign the account out everywhere.

Agency plan is per server

• Agency is ₹799 per server per month with a 10-server minimum, no cap, 250 pooled AI credits per billed server; ₹7,990 per server per year annually.

Pricing →

Auto Scaling groups and golden AMIs

• Mint a long-lived fleet enrollment key for launch-template user data; every instance registers itself as its own server.
• An instance cloned from an installed AMI is detected and re-registered instead of reporting as the same server.
• Servers that scale in are archived automatically after they go quiet, stop counting toward the plan, and come back on their own if they return.

Docs →

AI act mode: let the chat fix it

• Turn on “Let AI fix things” in a conversation and the assistant diagnoses, runs the fix on the server and verifies it, with the same gates as a hand-typed command: owner or admin, step-up, actions enabled on that server, every command audited.
• Anything destructive is asked about first. Each run shows as a live card in the thread.

Uptime checks from inside your network

• Assign a TCP check to an agent and it runs from that server, so a private database or an internal service can be monitored without exposing it.
• Opt-in per server; assignments are signed, and a probe whose agent goes quiet is flagged rather than silently green.

Uptime monitoring →

Fleet-wide app inventory

• A searchable Apps view across every server — deployed frameworks (Laravel, WordPress, Django) and running dev/app servers (Vite, Next, Node) behind listening ports.
• Each app is enriched with its open URL, domain + SSL, runtime version, reachability, git repo (branch/commit/drift) and health.
• Per-app quick actions and an “At risk” filter that surfaces exposed dev servers and end-of-life frameworks.

The Opservo Health Standard (OHS v1.0)

• A deterministic, explainable 0–100 health score for every server — every point lost traces to a named rule, its threshold, the current value and a fix.
• Seven weighted categories (Performance, Security, Storage, Reliability, Maintenance, Network, Configuration), each scored independently.
• Confidence scoring (Definitive / Likely / Heuristic) so hard facts outweigh hunches — and the AI recommendations on top can be trusted proportionally.

Incident management + on-call escalation

• Declare an incident, set severity, acknowledge, assign an owner, and post status updates (open → investigating → identified → monitoring → resolved) on a shared timeline.
• Post-mortems attached to every incident, so the learning survives the outage.
• On-call escalation: unacknowledged critical alerts repeat on your interval and escalate to an on-call email until someone picks them up.

External uptime monitoring & status pages

• Six cloud-side check types — HTTP(S), raw API, TCP, ICMP ping, DNS record and domain-registration expiry — with response-time and keyword matching.
• SSL-certificate and domain-registration expiry tracking, plus heartbeat/cron “dead-man’s switch” monitors.
• Shareable public status pages — overall-only or per-server — reflecting servers and external checks together.

Deploy, rollback & remote control

• AI-guided and manual deploy flows from the dashboard, with one-click rollback and per-app restart / stop / logs / status.
• GitHub push-to-deploy webhooks and Infisical secret injection at deploy time — no secrets on disk.
• A file browser (with large-file relay upload) and a live process tree you can act on.

AI you control — wallet, credits & BYOK

• A live spend meter and per-call ledger — every AI action shows exactly what it cost.
• Monthly credit pools with one-click top-ups; no background AI quietly billing you.
• Bring your own AI key (BYOK) on any plan to run AI actions on your own key.

Account hardening

• Two-factor auth with recovery codes, optionally required workspace-wide, plus team roles (owner/admin/member).
• Step-up 2FA before running a command or enabling remote actions — a hijacked session still can’t touch your servers.
• Brute-force lockout, new-login email alerts, an audit log and one-click “sign out everywhere.”

AI chat + security intelligence

• Ask “why is web-01 slow?” and get an answer grounded in that server’s live metrics, processes and logs — tenant-scoped and read-only.
• A no-config 0–100 security posture score with the specific, actionable risks behind it.
• AI log summaries and an automatic incident timeline that shows what triggered what during an outage.