Launch Festival! RasnuOS v1.0 is live. $5 free AI tokens and 50% off base plans.

Claim Offer

The Autonomous
AI Infrastructure.

Link every server into a single intelligent control plane. Chat with your infrastructure, access live terminals, and execute complex operations across your entire fleet from one tab.

Outbound-only mTLS Open Source Agent
RASNUOS

Infrastructure automation
you can verify.

Every action is limited by an allowlist, gated by the autonomy level you choose, and written to a tamper-evident ledger. Hover a card to replay what it does.

runbook

Talk to your servers

Describe the outcome, like “update all web nodes”. RasnuOS turns it into an ordered plan you can read before anything runs.

plan_tasks
› Update all web nodes
✓Snapshot web-01 to web-04
✓apt-get upgrade, one node at a time
✓Health check after each node
Rollback armed, 2 of 4 done
migrate

Move between providers

Migrate entire servers, files, and live databases to a new host with zero downtime. Watch the replication lag fall to zero, then cut over and update DNS.

pg_basebackup → WAL stream
AWS · source
Hetzner · target
replication lag 0 ms
cutover complete · DNS updated
fleet

One playbook, every node

Run a playbook across your whole fleet in controlled batches, with live per-node status and automatic stop on failure.

deploy-v3 · batch of 4
24 / 36 nodes complete
debounce

An agent that doesn’t panic

One spike is ignored. It acts only on a sustained breach, then holds a 24-hour cooldown so it can’t loop on the same fix.

cpu · threshold 80%
spike ignored sustained, acts 24 h cooldown
alerts

Know what happened at 3 AM

When AutoPilot fixes something, you get a Telegram message with the cause, the commands it ran, and the result.

telegram
OOM kill on node-04 · 03:12 UTC
api.service restarted, memory cap 768 MB
Resolved in 38 s
allowlist

Hard limits on what AI can touch

Whitelist the exact services the agent may manage. Anything outside the list is refused before it reaches the server.

policy.yaml
nginx.serviceallowed
redis-server.serviceallowed
sshd.serviceblocked
systemctl stop sshd → denied by policy
mTLS

No inbound ports to find

The agent connects outward over mTLS with a pinned certificate. Your servers expose nothing for a port scan to discover.

network
scanner your server 0 inbound 443 mTLS control
ed25519 · certificate pinned · outbound only
autonomy

Choose how much it decides

Start with alerts only, move to approvals, and grant full autonomy per server once you trust the results.

autonomy.mode

Proposes a fix, then waits for your approval.

ledger

A record you can check

Every command and decision is appended to a hash-chained ledger. Change one entry and every hash after it stops matching.

audit.ledger
restart db-primaryprev 7f3a…c4e2
sha256 a41f…c9e2
✓signed
inject_secret DB_PASSWORDprev a41f…c9e2
sha256 09bd…71a0
✓signed
  • Outbound-only agent
  • mTLS with certificate pinning
  • Hash-chained audit ledger
  • Open-source agent

How RasnuOS compares
to SSH-based tooling.

Seven design decisions that change how remote execution works, side by side with the way most teams run servers today.

Network topology
How the control plane reaches your servers.
SSH-based tooling Inbound connections. Port 22 stays reachable from the internet, a bastion host or a VPN.
RasnuOS
Outbound-only agents
The agent opens the connection to the control plane. No inbound port has to be open on your servers.
0 inbound ports
Encryption and identity
The security model for remote execution.
SSH-based tooling Long-lived SSH keys or shared passwords, rotated by hand and easy to leak.
RasnuOS
mTLS tunnels
Every node has its own identity, and the agent pins the certificate fingerprint, so an impostor server is rejected.
ed25519 · pinned
Command interface
How you work with your fleet.
SSH-based tooling CLI sessions, long YAML playbooks and separate dashboards.
RasnuOS
Chat plus live terminals
Describe the task in chat, review the plan, and open a live terminal on any node from the same tab.
AGI Chat · AIPty
Accountability
The record of what was executed.
SSH-based tooling Shell history and plain-text logs that anyone with root can edit or delete.
RasnuOS
Hash-chained ledger
Each entry contains the hash of the one before it, so an edit or deletion shows up as a broken chain.
sha256 chain
Pre-flight safety
Knowing the impact before anything runs.
SSH-based tooling Run the script and watch. Broken dependencies show up only when something fails.
RasnuOS
Plan before execution
Complex jobs compile into a task graph you can read. In Copilot mode nothing runs until you approve it.
plan_tasks · copilot
Handling drift
What happens when a server differs from the script.
SSH-based tooling Scripts run line by line and fail, or keep going, when the environment is not what they expected.
RasnuOS
Diagnose and adapt
On an error the agent reads the logs, proposes a fix for that step, and stays inside your allowlist.
allowlist-bound
Secret handling
Database credentials and API keys.
SSH-based tooling Scattered .env files, plaintext config and credentials pasted into scripts.
RasnuOS
Injected at runtime
A secret is passed to the agent for one step, held in memory, and kept out of the disk and the ledger.
RAM only · not logged

The left column describes common setups. A hardened SSH deployment can close some of these gaps with extra tooling; the right column describes RasnuOS defaults. Read the architecture deep dive.

One static binary.
Nothing else to install.

The agent is a single file with no runtime or package dependencies. Run one command and the node connects outward to your swarm. Pick a platform to see what happens.

Support matrix

What runs where

RasnuOS agent is compiled directly to machine code for every major operating system and architecture.

Platform x86_64ARM64i386
Linux Ubuntu, Debian, Alpine, RHEL
macOS Intel and Apple Silicon —
Windows Server 2016+, Windows 10 and 11 — —
Cloud and virtualized

Any provider that gives you an OS

The agent runs inside the operating system, so it needs no hypervisor access and no provider integration. If the machine runs a supported OS and can reach the internet on port 443, it can join.

AWS
Google Cloud
Azure
DigitalOcean
Hetzner
Vultr

Provider names are trademarks of their owners. Listing them indicates where the agent is used, not an endorsement or partnership.

Local and bare metal

Every node dials out

On-premise racks, a Raspberry Pi or an edge box all connect the same way, outward over mTLS.

topology
control plane cloud VM on-prem Pi / edge outbound 443 · zero inbound

Ready to manage your servers from one tab?

Install a 15 MB agent. Connect in under 10 seconds. Manage, monitor, and automate your entire fleet — through conversation.

Cancel anytime SOC 2 & HIPAA ready Deploy in 60 seconds Zero vendor lock-in