Security & trust
Built to be trusted in production
Opservo runs on real production servers — ours included. It’s designed from the ground up to add insight without adding attack surface.
In short
The Opservo agent is safe to run on production servers because it opens no inbound ports, is read-only by default behind two locks (a per-server dashboard switch and a local kill switch), signs every request with HMAC plus a timestamp and nonce, never reads .env files or stores raw log lines, and only accepts Ed25519-signed updates and commands. The agent is open source. Every command, fleet run, AI fix and terminal session is audited. Dashboard access is protected by 2FA, step-up confirmation, an idle PIN or passkey lock, brute-force lockout, scoped expiring API tokens and a full audit log.
Read-only by default, two locks to change it
Out of the box the agent only reads. Remote actions need two locks open: a per-server switch in the dashboard that is off by default, owner- or admin-only and audited, and a local switch on the box that you can set to off as a hard kill switch. A fleet-wide agent update never changes either.
No inbound ports
The cloud never connects to your servers. The agent pulls everything, heartbeats and any approved commands, over its own outbound HTTPS. There is no listening port to attack, and the live terminal dials out the same way.
Signed both ways
Every request the agent sends is HMAC-SHA256 signed with a per-agent secret plus a timestamp and a one-time nonce, so a captured request cannot be replayed. Every command the cloud sends is Ed25519-signed with a key the agent verifies before running anything; a bad or missing signature is refused and reported.
Every action is audited
Each command, who dispatched it, its output and exit code are recorded in an audit log you can read in the dashboard. Fleet runs and AI-run fixes go through the same channel, one audited command per server. Live terminal sessions are recorded too; what you type at a password prompt never is.
Account & access
A stolen password shouldn’t be enough
A session that can run commands on your servers is a high-value target — so we harden the login and gate the dangerous actions.
Two-factor authentication
TOTP 2FA with one-time recovery codes. Owners can require it for the whole workspace; a member without it is held at enrolment until they set it up. An owner can reset a locked-out teammate’s 2FA after a step-up.
Step-up before server actions
Running a command, enabling remote actions, opening a live terminal or minting an API token asks for a fresh 2FA code, so even a hijacked session cannot touch your servers.
Screen lock after idle
The dashboard locks after a period you choose and needs a PIN or a passkey to continue, enforced by the API rather than an overlay. Five wrong PINs sign you out everywhere.
Brute-force lockout
Repeated failed logins, wrong 2FA codes or wrong recovery codes lock the account, and every login path is rate-limited per address.
New-login alerts
A sign-in from a new location emails you at once with the IP, device and time, so you spot unauthorised access fast.
Revocable sessions
One click signs out every other device, and so does changing your password. Connected AI apps can be disconnected from Account → Developer.
Roles & audit log
Owner / admin / member roles. Enabling actions, running commands, changing channels, policies and integrations are admin-only, and every sign-in and sensitive action is in the audit log: who, what, from where, when.
Hardening
Defense in depth
Open-source agent
The Linux agent is published on GitHub, so you can read exactly what it collects and build it yourself. Auto-updates are verified against an Ed25519-signed manifest with anti-rollback, so a compromised API alone cannot push a bad build.
The agent protects its own locks
Commands that would edit the agent’s configuration, its service unit or its enable switches are refused by the API and by the agent, so the dashboard cannot be used to loosen the box-side lock.
Encrypted secrets at rest
Agent shared secrets and integration keys are encrypted with AES-256-GCM in the database, never stored in plaintext. The API refuses to start in production without the encryption key.
Tenant isolation
Every query is scoped to your workspace and re-checked server-side, including inside the AI tools and the MCP server. One customer can never see another’s data.
No secrets read from disk
The agent never reads your .env files or application secrets. It collects system and service facts, not your application data, and strips literals from database queries before anything leaves the server.
Privacy-minded collection
Source IPs are masked to their network prefix, usernames redacted, and raw log lines are never stored; only normalized patterns are. Command text is redacted in the agent’s local journal.
Scoped, expiring API tokens
Workspace API tokens carry a scope (read, deploy or ops) and an expiry, default one year. Minting one needs an owner or admin and a fresh two-factor step-up, and is audited.
Read-only integrations
The MCP server for Claude, Cursor and VS Code and the Prometheus export can only read. The tokens they use are never dashboard sessions, so they can never reach the command channel.
Browser hardening
Strict security headers (HSTS, nosniff, no framing), session cookies that JavaScript cannot read, CSRF tokens on every change, and rate limits on login, two-factor and password reset.
FAQ
Security questions
How do you protect the login itself?＋
Two-factor auth with recovery codes (optionally required workspace-wide), an idle screen lock with a PIN or passkey, brute-force lockout, per-address rate limits, new-login email alerts, an audit log, and one-click “sign out everywhere.” The highest-risk actions, running a command, enabling remote actions, opening a live terminal or minting an API token, ask for a fresh 2FA confirmation, so a stolen session still cannot reach your servers.
Can the agent run commands on my servers?＋
Not unless two locks are open: the per-server switch in the dashboard, off by default and owner/admin-only, and the local switch on the box, which you can set to off as a hard kill switch. When both are open, commands are pulled over outbound HTTPS, Ed25519-signed by the cloud and verified by the agent, run as the agent’s user with a timeout, and every one is audited. You can leave a server read-only forever.
What stops someone with dashboard access from loosening the box-side lock?＋
Both the API and the agent refuse any command that touches the agent’s configuration, its service unit or its enable switches. The local lock can only be changed by someone logged in to the server.
Does Opservo open any ports on my servers?＋
No. The agent makes only outbound HTTPS connections, including for the live terminal, which the agent dials out over a WebSocket. There is no inbound listener, so there is no new attack surface on your boxes.
What data leaves my servers?＋
System and service facts: CPU, memory and disk, which services and containers run, listening ports, SSL expiry, security posture, database health with query literals stripped, and normalized log patterns. Raw log lines are not persisted, and the agent never reads application secrets or .env files.
Is the agent open source?＋
Yes. The Linux agent is published at github.com/getopservo/opservo-agent so you can read what it collects and build it yourself. Updates are signed with a key that only the build pipeline holds, so a compromised API cannot push a modified build.
How is AI used, and is my data sent to a model?＋
AI only runs when you click an action, or when you have switched on act mode or a policy for it. At that point relevant, scoped infrastructure context is sent to the model to produce an explanation or fix. The wallet shows every call, and you can bring your own key for any of six providers.
Is the MCP server safe to connect to Claude or Cursor?＋
It is read-only by construction: the only tools it exposes are the per-server reads, the command tools are not reachable, and its tokens are not dashboard sessions. Every call re-checks your membership, and connections can be revoked from Account → Developer or by signing out everywhere.
Can I run it on my own infrastructure?＋
The agent is open source and runs wherever you put it. The platform is hosted by Opservo. For a dedicated deployment, contact hello@getopservo.com.