PATCHING
Every package. One workbench.
Inspect installed, held and broken packages across APT and RPM systems. Filter, select all eligible updates and approve exact-version batches.
ExploreSELF-HOSTED. FLEET-READY. SLIGHTLY FERAL.
A little wild.
A lot more
under control.
Meet Mr Patchy. Your tireless, slightly unhinged sidekick for patching, protecting and keeping your Linux fleet in line.
Small paws. Serious safeguards.
YOUR FLEET'S NEW SIDEKICKPatched overalls. Patching everything else.
THE GLASS WORKBENCH
Less tab juggling.
More knowing what's going on.
Packages, security, schedules and system health.
One clear view, with Mr Patchy by your side.
Actual application screenshot · Illustrative documentation dataExplore the product tour
ONE RACCOON. A LOT OF RANGE.
Fleet care, end to end.
PATCHING
Patching on your terms.
Daily, weekly and monthly schedules, timezone-aware calendars, maintenance windows and urgent out-of-cycle rules.
ExploreSECURITY
Watch what actually runs.
Follow processes, connections and network namespaces, with executable, script and mapped-library provenance plus optional eBPF execution capture.
Explore
PATCHY'S WORKING ON IT.SMART ASSISTANCE. YOUR CALL.
A second pair of eyes.
With a very good mask.
Make sense of update priorities, investigate unusual behavior and review configuration changes with AI assistance that shows its work.
- Explained update importance scores
- Evidence-linked investigations and response plans
- Parallel triage with the configured model and full evidence
- Exact-match known-good reuse and explicit re-triage
- Rate throttling, daily spending controls or unthrottled operation
- Redacted run logs, stage timings and cost visibility
- Per-server AI controls and policy-scoped automatic response
MORE SIGNAL. LESS WAITING.
Keep the insight.
Lose the repeat work.
Run independent investigations concurrently, reuse an exact match and keep spending visible. All without skipping required evidence checks.
OPERATIONS
Triage in parallel. Keep the evidence.
Configurable threaded AI investigations, independent claims and fair queues retain the configured model, reasoning, follow-up checks and explanations.
ExploreSECURITY
Known good once. Reused exactly.
Reuse a validated safe assessment from the fleet cache only when artifact and security-relevant context match exactly across servers. Keep provenance and request a fresh re-triage when needed.
ExploreOPERATIONS
Pace AI. Budget the day. Or go unthrottled.
Choose smooth rate throttling, a daily spend cap or unthrottled admission. See queued work, reservations, uncertain charges and the next eligible time.
ExploreKNOW WHAT NEEDS YOUR ATTENTION
The next release.
The health of the feed.
See offered OS upgrades wherever a server appears. Keep an eye on event delivery, backlog age and the gaps that need a closer look.
PATCHING
Know when the next release is offered.
See a distribution or major-version upgrade card on the server dashboard and the same accessible badge beside its name throughout the fleet. Detection never starts an upgrade.
ExploreOPERATIONS
Keep observations moving.
Bounded batches in a durable spool, configurable flush and capacity policies, acknowledged delivery, restart recovery and negotiated compression protect observations through bursts and outages.
ExploreOPERATIONS
See a backlog before it becomes a blind spot.
Track spool usage, oldest observation, delivery lag and reasoned loss counters on server dashboards and fleet summaries. Recovery clears active alerts while preserving history.
ExploreFROM ONE HOST TO THE WHOLE FLEET
Find the update.
Keep the service running.
See every available patch, manage device firmware, and keep the workbench available during maintenance.
PATCHING
Every available patch, across the fleet.
Open Available patches from the menu or the Overview count. Search every authorized server and distinguish ready, held and stale candidates.
ExplorePATCHING
Manage firmware through activation.
Inventory device firmware, review trusted releases and verify the running version after installation and reboot. Stage rollouts by device class and report coverage.
ExploreOPERATIONS
Keep the controller available.
Run MySQL-backed controllers in active/standby or active/active mode with redundant ingress, shared artifacts, and protected operation ownership during failover.
ExploreBETWEEN DISCLOSURE AND DEPLOYMENT
Watch the exposure.
Control the response.
Track CVEs until the fix takes effect. Enable automatic containment on your terms, with or without AI.
OPERATIONS
Pause AI. Keep the fleet moving.
Pause or resume AI for each server, with an audited reason. Inventory, patching, schedules, scanning and deterministic monitoring continue independently.
ExploreSECURITY
Watch the CVE exposure window.
Track applicable CVEs from publication to an effective, verified fix. Correlate exploitation evidence, show coverage gaps and reopen exposure after a vulnerable rollback.
ExploreSECURITY
Contain exploitation automatically.
Enable scoped, policy-authorized quarantine or process termination for confirmed CVE exploitation. Choose monitor-only mode, thresholds and exclusions; retain evidence and action history.
ExploreA PLAN FOR EVERY PATCH
Routine maintenance.
Without the routine surprises.
Set the window. Start with a canary.
Verify the result. Keep the receipt.
See what needs attention.
Inventory, advisory context and explained priorities put the next decision in view.
Choose when and how.
Approve exact updates, maintenance windows, staged rollouts and recovery policies.
Follow it through.
Track execution, post-patch health, package changes and the audit trail.
PATCHY HAS SOMETHING FOR YOU.THE MOMENTS THAT NEED A HUMAN
A bell for the things
that matter.
Significant triage results, interrupted jobs and coverage problems reach you while you work. No refresh. No lost selections. No disappearing action item.
- A persistent bell and accessible unread count
- Live in-app alerts and exact links to the finding
- Per-user read state across sessions and tabs
- Reconnect and catch-up, alongside SMTP and webhooks
GET FROM CURIOUS TO CONNECTED
Bring your own infrastructure.
Mr Patchy brings the overalls.
START HERE
Install Mr Patchy
Docker Compose, configuration, HTTPS and your first sign-in.
Let's get set up ADD YOUR FIRST SERVERMeet the fleet
Three steps from endpoint details to verified collector installation.
Enroll a server THE FIELD GUIDELearn the workbench
Practical guides for patching, security, identity and recovery.
Open the docsA FEW GOOD QUESTIONS
Before the raccoon
moves in.
Is Mr Patchy free to use?
Free for personal, noncommercial use and for nonprofits and local governments running their own systems. Commercial use and other organizational use require a separate paid license before deployment. See licensing and request commercial terms.
Where does Mr Patchy run?
The controller runs on your Linux infrastructure using Docker Engine and Compose v2. Managed targets include Ubuntu, Debian, Raspberry Pi OS, Fedora and modern DNF/Yum-based RPM systems.
Do I need an AI account?
AI assistance is optional. Choose provider connections and compatible models for each AI workflow. Core inventory and patch management work independently.
How do servers connect?
Mr Patchy uses verified SSH or supported cloud APIs to reach the endpoint agent. Enrollment supports downloaded scripts and expiring HTTPS links. Connection settings keeps trust, reinstall and transport recovery together.
Does it change things without asking?
Interactive patching uses reviewed approvals. Unattended patching requires an explicitly enabled schedule. For CVE exploitation or qualifying malware findings, an administrator can enable a scoped automatic-response policy that quarantines identified malicious artifacts or terminates identified malicious processes without approving each incident. Monitor-only mode is available; other sensitive response operations keep their separate review steps.
Can I pause AI for just one server?
Yes. Administrators pause or resume AI from the server’s persistent AI integration panel, recording a reason. Inventory, patching, schedules, scanning and deterministic CVE monitoring continue. Pausing AI does not disable an independently enabled automatic-containment policy.
Can I control AI throughput and spend?
Yes. Configure concurrent investigations separately from rate pacing and daily spending. Choose a rate throttle, a timezone-aware daily cap, or unthrottled admission within provider and resource limits. Exact-match known-good reuse avoids another provider call; explicit re-triage remains available.
How do live notifications work?
The bell and notification center receive committed attention events asynchronously, with reconnect and catch-up. Read state is personal and persists across tabs. Reading an alert does not acknowledge an incident or authorize a response.
Does an upgrade notice start an OS upgrade?
No. The server dashboard card and fleet badges report a verified offered transition, separate from routine package updates. Open the details, review the plan and recovery prerequisites, then make the existing explicit GO decision. Stale, unsupported or failed checks do not create an upgrade-available badge.
How do I know event delivery is falling behind?
Server and fleet views show spool utilization, oldest observation age, delivery lag and reasoned loss counters. Alerts explain current pressure and clear after confirmed recovery; cumulative loss history stays available. The event-delivery guide covers batching, restarts, capacity and disk/transport failures.
Can I use it for a homelab or a larger fleet?
SQLite offers a straightforward starting point. MySQL supports coordinated workers and redundant controllers for larger deployments. Size the controller, storage and workers for your actual inventory and telemetry volume.
PUT YOUR FLEET IN GOOD PAWS
Meet your new
favorite sysadmin.
Bring the glass workbench. Keep the control.
Install Mr Patchy Read the docs