PATCHING
Every package. One workbench.
Inspect installed, held and broken packages across APT and RPM systems. Filter, select all eligible updates and approve exact-version batches.
ExploreTHE WHOLE TOOLBOX
Serious fleet care.
Delightfully scruffy.
Patching, protection, investigation and recovery. Everything that keeps a Linux fleet moving, together in one glass workbench.
63 capabilities. One workbench.
PATCHING
Patching on your terms.
Daily, weekly and monthly schedules, timezone-aware calendars, maintenance windows and urgent out-of-cycle rules.
ExplorePATCHING
Canary first. Fleet next.
Stage ordered rollouts, preview dependencies, gate later hosts on successful health checks and see expected installation times.
ExplorePATCHING
An explained importance score.
AI scores pending updates from 0–100 with reasoning, model details and assessment time, alongside policy priorities and advisory context.
ExplorePATCHING
Repositories under control.
Manage APT .list and Deb822 .sources, RPM .repo files, signing keys, scoped credentials, private CAs, mirrors, proxies and pinning.
ExplorePATCHING
Reboot and recover deliberately.
Review reboot and snapshot rollback policies with each job. Verify recovery evidence and isolate interrupted work from the queue.
ExplorePATCHING
A whole new release. One GO.
Review adjacent Ubuntu LTS and Debian upgrades, AI-assisted configuration diffs and recovery prerequisites before a go/no-go decision.
ExplorePATCHING
A history for every package.
Follow before-and-after versions, observed changes, job links and actor attribution. Export CycloneDX inventory for downstream review.
ExploreSECURITY
Watch what actually runs.
Follow processes, connections and network namespaces, with executable, script and mapped-library provenance plus optional eBPF execution capture.
ExploreSECURITY
Scan with context.
Use on-demand, scheduled and execution-triggered ClamAV scanning, authenticated YARA rules, freshness checks and explicit coverage receipts.
ExploreSECURITY
Verify files against trusted sources.
Inspect native package checksums, compare authenticated Debian/RPM artifacts, define custom integrity scopes and review startup baselines.
ExploreSECURITY
Turn evidence into an investigation.
Two-stage AI triage, cross-source behavioral and threat-intelligence correlation, evidence-bound response proposals and fleet hash correlation.
ExploreSECURITY
A response you can review.
Preserve evidence, acquire controller copies, quarantine and restore files, suspend selected processes and stage authenticated replacements through separate approvals.
ExploreSECURITY
Contain. Repair. Recover.
Coordinate reviewed service restart and rollback, typed remediation, credential rotation, rebuild escalation and cloud isolation with recovery checks.
ExploreSECURITY
Keep detection current.
Manage reviewed scanner and signature maintenance and combine execution and file-write triggers with scheduled verification.
ExploreSECURITY
Evidence that outlives the incident.
Retain portable integrity-verifiable response records, configurable evidence retention, external immutable storage and independent audit archives.
ExploreOPERATIONS
A workspace for every server.
Move between overview, packages, patch timeline, investigations, AI activity, history, repositories and maintenance without losing context.
ExploreOPERATIONS
Enroll online or offline.
Use a personalized Bash script or an expiring HTTPS curl link, verify the SSH fingerprint and independently verify collector installation.
ExploreOPERATIONS
The right access for each person.
Named administrator, operator and viewer accounts, self-service passwords, TOTP MFA, OIDC SSO, session revocation and SSH-key rotation.
ExploreOPERATIONS
Alerts that reach you.
Follow overdue patches, stale telemetry, integrity changes and recovery holds. Deliver SMTP email and HTTPS webhooks with acknowledgements, retries and escalation.
ExploreOPERATIONS
Grow beyond one worker.
Coordinate distributed workers with durable queues, leader leases, per-host serialization, backpressure and authenticated operational metrics.
ExploreOPERATIONS
Your data. Your deployment.
Run Docker Compose with SQLite or MySQL, Caddy HTTPS, internal and external certificate profiles, custom ACME and uploaded certificates.
ExploreOPERATIONS
Backups with a way back.
Use encrypted restic backups with verified database, keys, TLS, evidence, trusted vendor/YARA artifacts and GCP state, plus staged restore and database migration.
ExploreOPERATIONS
An audit trail with answers.
Search package and operator history, rejected sign-ins and sanitized SSO failures. Trace AI costs, export JSONL audits and retain independent off-host records.
ExploreOPERATIONS
Cloud connections, without detours.
Connect directly or through Google Cloud IAP. Bring cloud inventory and lifecycle visibility into the same fleet workflow.
ExploreOPERATIONS
Keep the agent in good shape.
Inspect collector health, verify deployed files and service state, and perform reviewed agent maintenance and upgrades.
ExplorePATCHING
From advisory to inventory.
Match distribution advisories and affected versions, review CVSS-driven priority policies, and export CycloneDX SBOMs with dependency relationships.
ExploreSECURITY
Trust with a stronger foundation.
Combine package-artifact evidence, custom baselines and hardware-backed attestation on supported hosts, with explicit coverage and trust boundaries.
ExploreOPERATIONS
Pause AI. Keep the fleet moving.
Pause or resume AI for each server, with an audited reason. Inventory, patching, schedules, scanning and deterministic monitoring continue independently.
ExploreSECURITY
Watch the CVE exposure window.
Track applicable CVEs from publication to an effective, verified fix. Correlate exploitation evidence, show coverage gaps and reopen exposure after a vulnerable rollback.
ExploreSECURITY
Contain exploitation automatically.
Enable scoped, policy-authorized quarantine or process termination for confirmed CVE exploitation. Choose monitor-only mode, thresholds and exclusions; retain evidence and action history.
ExploreOPERATIONS
Triage in parallel. Keep the evidence.
Configurable threaded AI investigations, independent claims and fair queues retain the configured model, reasoning, follow-up checks and explanations.
ExploreOPERATIONS
Pace AI. Budget the day. Or go unthrottled.
Choose smooth rate throttling, a daily spend cap or unthrottled admission. See queued work, reservations, uncertain charges and the next eligible time.
ExploreSECURITY
Known good once. Reused exactly.
Reuse a validated safe assessment from the fleet cache only when artifact and security-relevant context match exactly across servers. Keep provenance and request a fresh re-triage when needed.
ExploreOPERATIONS
A retry with a reason.
Durable classified retries respect provider Retry-After, bounded jitter, pause state and spending controls while surfacing configuration blockers for review.
ExploreSECURITY
Known threats. Unfamiliar behavior.
Combine maintained ClamAV and YARA detection with evidence-linked AI malware triage, scoped automatic quarantine and verified process termination.
ExploreSECURITY
See what starts. Understand why.
Discover cron, systemd, boot and login automation. Compare package defaults and custom changes, inspect effective triggers and review explained AI assessments.
ExploreOPERATIONS
Attention, without a page refresh.
Live asynchronous notifications, a persistent bell, unread counts and a searchable center bring significant triage findings and human-attention alerts into every workspace.
ExploreOPERATIONS
Controller here. Workers where you need them.
Choose complete, controller-only or worker-only deployments, with MySQL for remote workers, explicit shared-state provisioning and graceful drain.
ExploreOPERATIONS
See the whole deployment.
Track expected controllers, workers, integrations and endpoint agents with identity, readiness, heartbeat freshness, active work and explained health states.
ExploreOPERATIONS
Give cloud integration its own home.
Run an optional dedicated GCP integration node that isolates CLI dependencies and cloud identity while retaining scoped operations and verified SSH/IAP routing.
ExplorePATCHING
Know when the next release is offered.
See a distribution or major-version upgrade card on the server dashboard and the same accessible badge beside its name throughout the fleet. Detection never starts an upgrade.
ExploreOPERATIONS
Keep observations moving.
Bounded batches in a durable spool, configurable flush and capacity policies, acknowledged delivery, restart recovery and negotiated compression protect observations through bursts and outages.
ExploreOPERATIONS
See a backlog before it becomes a blind spot.
Track spool usage, oldest observation, delivery lag and reasoned loss counters on server dashboards and fleet summaries. Recovery clears active alerts while preserving history.
ExploreOPERATIONS
Waiting is a state you can inspect.
Keep AI scoring and advisory work durably queued through rate, budget, provider and pause waits. Inspect the next eligible time and review interrupted paid work before resuming.
ExplorePATCHING
Every available patch, across the fleet.
Open Available patches from the menu or the Overview count. Search every authorized server and distinguish ready, held and stale candidates.
ExplorePATCHING
Manage firmware through activation.
Inventory device firmware, review trusted releases and verify the running version after installation and reboot. Stage rollouts by device class and report coverage.
ExploreOPERATIONS
Keep the controller available.
Run MySQL-backed controllers in active/standby or active/active mode with redundant ingress, shared artifacts, and protected operation ownership during failover.
ExploreOPERATIONS
Patch the infrastructure that runs Patchy.
Map controllers, workers and shared dependencies to the underlying hosts. Review the maintenance order, hand off work and verify each dependency before advancing.
ExploreOPERATIONS
Recover a connection in place.
Verify or replace an SSH fingerprint, rerun the installer and switch transport in Connection settings without creating a second server record.
ExploreOPERATIONS
Find the setting you need.
Use a searchable, role-aware Settings index with focused pages, persistent navigation and clear save, test and apply actions.
ExploreOPERATIONS
Reach endpoints through cloud APIs.
Use AWS Systems Manager, Google Cloud or Azure Managed Run Command to reach the existing endpoint agent through scoped cloud identities.
ExploreSECURITY
Route each AI workflow to its own model.
Select named provider connections and compatible models per feature. Keep provider-specific capacity, backoff and cost evidence visible.
ExplorePATCHING
Roll out with service availability in view.
Stage canaries and rollout rings, honor freezes and expiring exceptions, and wait for fresh application-health evidence and the full soak period.
ExplorePATCHING
Find competing updaters before a change.
Identify scripts, timers and native automatic updaters that conflict with maintenance. Preview and approve a reversible disable or restore.
ExploreOPERATIONS
Apply policy by site, owner and criticality.
Group assets by tags or rules, preview inherited policies and scope each role to its permitted servers.
ExplorePATCHING
Measure effective patch compliance.
Save fleet queries and export evidence-backed compliance reports. Drill into overdue updates, restart requirements and gaps in coverage.
ExploreOPERATIONS
Track lifecycle and host pressure.
Separate vendor support deadlines from offered upgrades and use disk, inode, memory, clock and certificate signals to prepare maintenance.
ExploreSECURITY
Review configuration posture.
Inspect applicable SSH, sudo, firewall and security-control checks with measured evidence, versioned rules and scoped exceptions.
ExploreSECURITY
Trace dependencies to the workload.
Distinguish host packages, container images and application libraries in inventory, advisory review and software bill of materials exports.
ExploreSECURITY
Give incidents clear ownership.
Assign cases, record evidence-linked decisions and deadlines, and expire tightly scoped exceptions without removing source evidence.
ExploreOPERATIONS
Integrate with scoped service identities.
Use expiring credentials, retry-safe request identities and durable event delivery for ticketing and SIEM workflows.
ExploreOPERATIONS
Verify recovery and rotate keys safely.
Track isolated restore evidence and rotate versioned encryption keys with resumable re-encryption and tested access to older backups.
ExploreNo matching capabilities. Try another search.
PUT YOUR FLEET IN GOOD PAWS
Meet your new
favorite sysadmin.
Bring the glass workbench. Keep the control.
Install Mr Patchy Read the docs