Host Advisor
Host inspection, configuration auditing and evidence collection on Linux, macOS and Windows, with the exact commands behind every finding.
Which of these 200 servers still permit SSH password authentication?
One card per host — the exact command, exit code and output, then the finding. Read-only by default; changes need the full policy.
The use case, on film
- linux-host-triage
- windows-host-triage
- active-directory-investigation
- identity-dns-edr
- file-provenance
- infrastructure-incident-rca
- exchange-server-triage
- network-firewall-triage
- storage-filesystem-triage
- kubernetes-cluster-triage
- virtualization-platform-triage
- sshd
- systemctl
- ss
- journalctl
- PowerShell
- launchctl
- Linux
- macOS
- Windows
What it does
You select hosts and ask a question in plain language. Each selected machine answers for itself: the diagnostic that was chosen, the command that ran, the exit code, the output, and then the finding drawn from it. Two hundred machines produce two hundred answers, not a summary.
Joining a host to the fleet
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
The install command carries an enrollment token scoped to one workspace. The machine appears in the console with its own metadata and tags, and it can be revoked from the same place.
The execution policy
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Read-only is not a promise in the prompt: it is the policy the host worker enforces, with a deny-list on the paths it will not touch. Turning it up to the full policy is a deliberate, recorded choice made per host, not a setting an agent can change for itself.
The evidence
Host investigations show the commands that ran, their exit codes and output, per host.
The answer streams while it is being collected, and it can be replayed afterwards. That record is what makes a finding checkable months later by someone who was not there.
The skills it may use
Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.
What it will not do
- It will not change a machine while the read-only policy is on it.
- It will not run anything that is not in an enabled skill.
- It will not reach a host that has not been enrolled into the workspace.
- It will not answer from memory when the host did not respond — the failure is shown as a failure.
Where it runs
Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.
Bring one question of your own.