osctrl is an open-source osquery fleet manager, implementing the osquery remote API as a TLS endpoint. Full visibility and control over your endpoints — from hundreds to hundreds of thousands of nodes.
osquery gives you a SQL interface to every endpoint. osctrl makes that fleet manageable: enrollment, configuration, queries, logs, alerting and file carving — from a modern operator UI, a REST API, the CLI, or an AI agent over the Model Context Protocol.
Track every system running osquery in real time — node status, activity, enrollment state and health across all your environments.
Push osquery configuration and scheduled query packs to your entire fleet in seconds, organized by environment and tags.
Ingest status and result logs from every node and route them to your logging pipeline of choice.
Launch distributed queries across any subset of nodes and get results back fast — with optional accelerated query reads.
Open a read-only, shell-like console against any node, backed by osquery: ls, ps, stat, sql, .tables and more.
Retrieve files and directories from remote endpoints for forensics and incident response, with permission-checked access.
Rule-based alerting on result, status and query logs — plus node state — fanned out to webhook and email channels, with cooldown, dedupe and hot reload.
A per-node file explorer backed by accelerated, permission-checked osquery distributed queries — directory listings and stat without a shell.
An optional health page fuses live database and Redis pings, per-service runtime stats, a TLS heartbeat and cached upgrade status.
Every osctrl component is a small, focused service built on shared Go packages, backed by PostgreSQL and Redis.
osctrl-tlsThe TLS endpoint implementing the osquery remote API. Handles node enrollment, configuration delivery, log ingestion, distributed queries and file carving for your entire fleet.
osctrl-apiThe REST API service, secured with JWT authentication by default, with trusted proxy controls and audit logging. Powers the operator UI and any automation you build. Fully documented with OpenAPI.
A modern React single-page application: nodes, environments, live and saved queries, carves, tags, users, enrollment, audit log, log sinks, auth providers, alerting, posture data, the node console and the file explorer — with live updates over SSE.
osctrl-cliThe operator command-line interface for scripting and administration — manage environments, nodes, queries and users from your terminal or CI, via API or direct DB mode.
osctrl-mcp NewA Model Context Protocol server — a standalone stdio binary, or hosted by osctrl-api at /api/v1/mcp. It gives AI agents permission-checked fleet inspection. Write tools are a separate switch, off by default.
pkg/*)Every service builds on the same Go packages: node state, environments, queries, carves, users and permissions, caching, the log pipeline, alerting, audit log, MFA, GeoIP, posture and health.
Proven from hundreds to hundreds of thousands of nodes without compromising performance.
JWT auth by default, optional MFA with passkeys and TOTP, trusted proxy controls and audit logging throughout.
An MCP server exposes fleet inspection to Claude and other MCP clients, bounded by the token's own permissions.
MIT licensed, actively developed, and already used in production environments.
Spin up the full stack locally with Docker Compose — TLS endpoint, API, frontend, PostgreSQL and Redis included.
# Clone the repository $ git clone https://github.com/jmpsec/osctrl.git $ cd osctrl # Prepare the environment file and development certificate $ cp .env.example .env $ make docker_dev_certs # Build and run everything in Docker $ make docker_dev_build $ make docker_dev_up
The operator frontend comes up at https://localhost:8444.
Full installation options: Docker, provisioning script, or building from source →
Free, open source, and ready to deploy today.