Host Advisor
Host inspection, configuration auditing and evidence collection on Linux, Windows and macOS, with the exact commands behind every finding.
Which of these 200 servers still permit SSH password authentication?
One card per host — the exact command, exit code and output, then the finding. Read-only by default; changes need the full policy.
- linux-host-triage
- windows-host-triage
- active-directory-investigation
- identity-dns-edr
- file-provenance
- infrastructure-incident-rca
- exchange-server-triage
- network-firewall-triage
- storage-filesystem-triage
- kubernetes-cluster-triage
- virtualization-platform-triage
- sshd
- systemctl
- ss
- journalctl
- PowerShell
- launchctl
- Linux
- Windows
- macOS
What it does
You select hosts and ask a question in plain language. Each selected machine answers for itself: the diagnostic that was chosen, the command that ran, the exit code, the output, and then the finding drawn from it. Two hundred machines produce two hundred answers, not a summary.
Joining a host to the fleet
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
The install command carries an enrollment token scoped to one workspace. The machine appears in the console with its own metadata and tags, and it can be revoked from the same place.
The execution policy
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Read-only is not a promise in the prompt: it is the policy the host worker enforces, with a deny-list on the paths it will not touch. Turning it up to the full policy is a deliberate, recorded choice made per host, not a setting an agent can change for itself.
The evidence
Every answer shows the exact commands that ran, their exit codes and output, per host.
The answer streams while it is being collected, and it can be replayed afterwards. That record is what makes a finding checkable months later by someone who was not there.
The skills it may use
Skills come from a signed vendor catalogue or your own uploads, and can be enabled or disabled per workspace.
What it will not do
- It will not change a machine while the read-only policy is on it.
- It will not run anything that is not in an enabled skill.
- It will not reach a host that has not been enrolled into the workspace.
- It will not answer from memory when the host did not respond — the failure is shown as a failure.
Where it runs
The whole stack self-hosts with one command; an air-gap bundle ships every image.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Sign in with your own identity provider (OIDC with PKCE); no shipped default administrator password.
Bring one question of your own.
Request a demo