osctrl is an open-source osquery fleet manager, implementing the osquery remote API as a TLS endpoint. Full visibility and control over your endpoints — from hundreds to hundreds of thousands of nodes.
osquery gives you a SQL interface to every endpoint. osctrl makes that fleet manageable: enrollment, configuration, queries, logs, vulnerability monitoring, alerting and file carving — from a modern operator UI, a REST API, the CLI, or an AI agent over the Model Context Protocol.
Track every system running osquery in real time — node status, activity, enrollment state and health across all your environments.
Push osquery configuration and scheduled query packs to your entire fleet in seconds, organized by environment and tags.
Ingest status and result logs from every node and route them to your logging pipeline of choice.
Launch distributed queries across any subset of nodes and get results back fast — with optional accelerated query reads.
Open a read-only, shell-like console against any node, backed by osquery: ls, ps, stat, sql, .tables and more.
Retrieve files and directories from remote endpoints for forensics and incident response, with permission-checked access.
Rule-based alerting on result, status and query logs — plus node state — fanned out to webhook and email channels, with cooldown, dedupe and hot reload.
A per-node file explorer backed by accelerated, permission-checked osquery distributed queries — directory listings and stat without a shell.
An optional health page fuses live database and Redis pings, per-service runtime stats, a TLS heartbeat and cached upgrade status.
Your fleet already reports the packages it has installed. osctrl matches that inventory against public advisory data and shows you what is exposed — no new agent, no new collection, and the inventory never leaves your deployment.
Apply a vuln-linux, vuln-darwin or vuln-windows profile to an environment's schedule. The queries run daily in snapshot mode and osctrl-tls stores the result.
osctrl-api syncs the OSV ecosystems your fleet actually reports, plus the CISA Known Exploited Vulnerabilities catalog, then re-matches the nodes whose inventory or advisories changed.
Severity is scored locally from the CVSS vectors in each advisory. Anything CISA lists as known-exploited is flagged, so you can triage by what attackers are actually using.
A vuln_finding rule fires at the threshold you pick — kev, critical, high and so on. Findings are grouped per advisory and rate-capped, so a fleet-wide rollout can't flood your channels.
With posture enabled, nodes get a "Known vulnerabilities" control mapped to ISO 27001 A.8.8 — KEV or critical findings fail at critical weight, and clean-but-unassessed never reads as a pass.
Alpine, CentOS, SUSE and un-synced ecosystems are reported as not assessed rather than counted clean. A node with unassessed packages warns — silence is never mistaken for safety.
Off by default — enable it with --vuln-enabled.
See how teams use it →
Every osctrl component is a small, focused service built on shared Go packages, backed by PostgreSQL and Redis.
osctrl-tlsThe TLS endpoint implementing the osquery remote API. Handles node enrollment, configuration delivery, log ingestion, distributed queries and file carving for your entire fleet.
osctrl-apiThe REST API service, secured with JWT authentication by default, with trusted proxy controls and audit logging. Powers the operator UI and any automation you build. Fully documented with OpenAPI.
A modern React single-page application: nodes, environments, live and saved queries, carves, tags, users, enrollment, audit log, log sinks, auth providers, alerting, posture data, the node console and the file explorer — with live updates over SSE.
osctrl-cliThe operator command-line interface for scripting and administration — manage environments, nodes, queries and users from your terminal or CI, via API or direct DB mode.
osctrl-mcp NewA Model Context Protocol server — a standalone stdio binary, or hosted by osctrl-api at /api/v1/mcp. It gives AI agents permission-checked fleet inspection. Write tools are a separate switch, off by default.
pkg/*)Every service builds on the same Go packages: node state, environments, queries, carves, users and permissions, caching, the log pipeline, alerting, audit log, MFA, GeoIP, posture and health.
Proven from hundreds to hundreds of thousands of nodes without compromising performance.
JWT auth by default, optional MFA with passkeys and TOTP, trusted proxy controls and audit logging throughout. Vulnerability monitoring ships off until you turn it on.
An MCP server exposes fleet inspection to Claude and other MCP clients, bounded by the token's own permissions.
MIT licensed, actively developed, and already used in production environments.
Spin up the full stack locally with Docker Compose — TLS endpoint, API, frontend, PostgreSQL and Redis included.
# Clone the repository $ git clone https://github.com/jmpsec/osctrl.git $ cd osctrl # Prepare the environment file and development certificate $ cp .env.example .env $ make docker_dev_certs # Build and run everything in Docker $ make docker_dev_build $ make docker_dev_up
The operator frontend comes up at https://localhost:8444.
Full installation options: Docker, provisioning script, or building from source →
Free, open source, and ready to deploy today.