Platform Architecture · v1.0.0
Security & Guardrails → Open-Source Agent ↗

One 15 MB agent. Every server in one workspace.

Connect Linux, macOS, and Windows servers over outbound port 443. RasnuOS inspects live server health, prepares clear configuration diffs with automatic backups, and waits for your sign-off before changing production systems.

01. DiagnosisChecks live health + recalls server setup
02. Safety CheckAutomatic safety checks + risk rating
03. ApprovalManual click, team webhook, or Auto
04. ExecutionOutbound port 443 + .bak backup
05. VerificationService health check + audit record
01 · Intelligence AI
Server Memory
Remembers ports & configs
02 · Runtime < 15 MB
Universal OS Agent
Linux, macOS & Windows
03 · Network Port 443
Zero Inbound Ports
No shared root SSH keys
04 · Guardrails Protected
Built-In Safety Checks
Human & team sign-off
05 · Audit Log Verified
Tamper-Evident History
Cloud + host log & CSV
Plain-Language Operations & Persistent Server Memory

Context-aware troubleshooting backed by self-updating server memory.

Every request inspects your server's live health, running services, and saved configuration history so you never have to re-explain your setup.

Plan, Apply & Verify

Separates architecture planning, configuration diffs, root-cause diagnosis, and post-change health checks so every update is verified end to end.

Automatic Memory Updates

Saves verified facts (custom ports, config paths, installed versions) after each task and automatically replaces outdated settings when your server changes.

diagnosis-session // prod-api-01 SERVER MEMORY ACTIVE
> "Deploy Redis 7 cache and raise Nginx worker_connections to 4096"
Context & Server Memory Lookup
→ Active setup: Nginx 1.26 bound to :443 (8 vCPU / 16 GB RAM)
→ Workflow: Plan → Config Diff → Health Check
[Plan] Scoped Redis 7 to 127.0.0.1:6379 (maxmemory-policy allkeys-lru)
[Diff] Prepared visual diff on /etc/nginx/nginx.conf
[Check] Verified: redis-cli ping == PONG && nginx -t == syntax ok
✓ Server memory updated: worker_connections=4096 saved Synced
Lightweight Agent & Safe Credential Handling

One lightweight binary for Linux, macOS, and Windows.

Installs in one command without Python, Node.js, or Docker dependencies. The agent connects outbound over port 443 and checks safety rules right on your server.

Visual Edits & Browser Terminals

Streams command output in real time, supports multiple live browser terminal tabs, and saves automatic .bak backups before modifying any file.

Zero-Disk Task Secrets

Task passwords are held strictly in temporary memory, used for a single approved step, and cleared immediately—never saved to disk.

rasnuos-agent v1.0.0 (x86_64 & ARM64)
Linux · macOS · Windows background service
Verified Release
Safe File Edit: /etc/nginx/sites-enabled/api.conf .bak backup saved
- proxy_read_timeout 30s;
+ proxy_read_timeout 120s;
Temporary Memory Credential & Password Masking
[VAULT] Using temporary secret from memory: [DB_PASS] = ***MASKED***
[EXEC] pg_dump -U app_user -h 127.0.0.1 prod_db > /backups/pre_migrate.sql
Staged Fleet Rollouts & Direct Server-to-Server Transfer

Ordered multi-server updates and direct server-to-server migrations.

Coordinate multi-server changes stage by stage with automatic health checks, or stream files and databases directly between hosts without uploading data to a third-party cloud.

Staged Updates & Auto-Rollback

Runs multi-server updates in the right order, verifies health after each stage, and automatically rolls back in reverse order if any server fails a check.

Single-Use Encrypted Stream

Opens a temporary encrypted connection directly between your source and destination servers for fast file and database transfers.

Rollout Plan #108 // Cross-Cloud Cutover Direct Transfer
Stage 1: dest-node-01 (Open temporary encrypted receiver) ✓ Port: :44918
Stage 2: src-node-01 (Stream files + DB directly) Streaming 412 MB/s
Stage 3: Health Verification (Integrity & HTTP 200 check) Armed (Rollback Ready)
Direct Server-to-Server Transfer (0 Bytes Stored in Cloud) Integrity Verified
15-Second Health Checks, Smart Alerting & Audit History

Continuous 15-second monitoring paired with a tamper-evident audit log.

Checks server health every 15 seconds with local offline buffering, filters out brief CPU blips before alerting your team, and records every action in a permanent, verifiable audit trail.

45s Spike Filter vs Instant Crash

Resource spikes are checked across 3 consecutive 15s readings (45s) before alerting, while service crashes and out-of-memory kills trigger root-cause diagnosis immediately.

Tamper-Evident Audit Log

Records every approved command, who approved it, and the exact output in a tamper-evident audit log with one-click CSV export.

Tamper-Evident Audit Log // Integrity: VERIFIED 15s Health Checks + CSV Export
Actor & Gate Command & Result Status
Alex Rivera (Owner)
Manual Approval
systemctl reload nginx
Exit 0 · Health Verified
 Verified #1042
AutoPilot Monitor
Team Approved (ServiceNow)
journalctl --vacuum-size=500M
Freed 4.2 GB on /var/log
 Verified #1041
Server Guardrail
Blocked by Safety Rule
mkfs.ext4 /dev/sda1
Refused before execution
 Blocked #1040
Verifiable Engineering Specifications

Hard Operational Limits & Runtime Guarantees

Full Security Architecture →
Cadence & Buffering Every 15s
Offline-Resilient Monitoring

Checks CPU, RAM, swap, disk, I/O wait, load, and active processes every 15s with local in-memory buffering during brief network drops.

Concurrency & Quotas Protected
Built-In Rate & Session Limits

Automatically paces command traffic, isolates running tasks with safe timeouts, and protects interactive terminal sessions from overload.

Update Verification Signed & Verified
Verified Automatic Updates

Verifies digital signatures and file integrity before downloading or applying agent updates, and aborts automatically if any check fails.

Password Safety Zero-Disk
Masked Passwords & Temporary Memory

Never stores plain server tokens, masks -p / --password flags before logging, and clears temporary task secrets from memory immediately after use.

Local Health Endpoint 127.0.0.1:9090
Optional Local Metrics

Exposes /healthz and /metrics strictly on the server's local interface (unreachable from outside networks; disable via METRICS_PORT=off).

Dual Audit Trail Cloud + Host
Cloud + On-Server Audit Log

Pairs your workspace's tamper-evident audit log and 24-hour signed team approval links with a local audit.jsonl receipt file on every server.

Universal Server Compatibility

Runs anywhere you run servers. Installs in one command.

Whether your infrastructure runs on Linux, macOS, or Windows—and whether your machines use standard Intel/AMD processors or modern ARM64 chips—the RasnuOS agent installs cleanly with zero extra software dependencies.

Operating Systems

Linux, macOS & Windows

Native support for both standard x86_64 and ARM64 processors, cryptographically verified before installation.

Platform x86_64 (amd64)ARM64 (aarch64)
Linux Ubuntu, Debian, Alpine, RHEL (x86_64 & ARM64) ✓ Verified ✓ Verified
macOS Intel & Apple Silicon (x86_64 & ARM64) ✓ Verified ✓ Verified
Windows Server 2019+, Windows 10/11 (x86_64 & ARM64) ✓ Verified ✓ Verified
Cloud & Bare Metal

Any environment where you have a shell

Connect virtual machines, dedicated bare-metal servers, private subnet nodes, or local hardware via the agent—and manage them together in a single workspace.

Cloud VMs
Dedicated Servers
Bare Metal
Private Subnets
ARM64 Nodes
On-Premise

Works on any existing server via outbound agent connection—no cloud provider API keys required.

Firewall Friendly

Outbound-only connection

Your servers connect outbound over standard HTTPS (port 443), so you never need to open inbound firewall ports or expose SSH to the public internet.

connection // port 443
control plane cloud VM on-prem ARM64 edge outbound-only by default (HTTPS :443)

Compiled into 6 zero-dependency native agent binaries (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64, windows/arm64), cryptographically signed offline, and auditable at github.com/rasnu/os-agent.

Ready to manage your servers in plain language?

Start free with 1 server and $5.00 in welcome credit. Connect your server in 30 seconds and run your first safe health check right away.

1. Create your free account (1 server + $5.00 usage credit included immediately).
2. Paste the one-line install command on your Linux, macOS, or Windows server.
3. Ask any question in plain language or open a live browser terminal.
No credit card required Prepaid wallet prevents surprise bills Cancel or switch plans anytime