An AI agent for IT operations, from one server to the whole fleet
An AI agent for IT operations answers plain questions about your servers, such as which hosts miss security updates or have certificates about to expire, by running read-only checks on each host and showing the result. Each value comes with the command, exit code and output that produced it, so an engineer can trust it or rerun it. AcTree runs this on your own infrastructure, with Host Advisor as the first agent.
Evaluating this for your team? Discuss your use case, deployment boundary and success criteria in a technical briefing.
Book a technical briefingOperations teams spend a large part of the day gathering facts: logging into hosts, running the same commands, copying output into a ticket. An operations agent does the gathering and hands back the facts with their source, so people spend their time on the decision.
What it answers
- Which of these servers still permit SSH password authentication?
- Which hosts miss security updates, have TLS certificates expiring within 30 days, or have disks over 90 percent?
- Why did this deployment fail, and what changed on the host since yesterday?
The Host Advisor page shows the first of these end to end, and the fleet-health and deploy-triage films in the use-case library show the others with sample data.
How it works
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
Host investigations show the commands that ran, their exit codes and output, per host.
An agent is a model, a set of approved skills, tools and a policy, applied to a scope.
A question goes to an agent. The agent chooses its skills, runs their commands on the enrolled hosts in scope, and returns one result per host with the evidence attached.
Why read-only is the default
An agent that can restart services or edit configuration is a privileged account. Starting read-only limits the risk of changing systems, while risks from accessing sensitive data and exposing it in outputs remain. Permissions and evidence still need review. When a team wants the agent to do more on a specific host, that is a deliberate, recorded decision.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Changing a host's execution policy from read-only to full is an administrator-only action.
Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.
Skills your team can read
Each skill is a versioned package. Uploads are checked before they install, every version is archived, and each workspace enables or disables each skill.
Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.
Rolling it out
- Install the platform on one host. The self-hosting guide has the commands.
- Connect a model endpoint.
- Enrol a handful of non-production servers and ask the questions your team asks every week.
- Sign in through your identity provider and give access team by team.
- Extend to production servers, still read-only.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.
The documentation covers installing the host agent, and the IT operations solution page lists the agents for the team.
Questions buyers ask
What kinds of questions can it answer?
Questions an engineer would answer by logging into servers one by one, such as which hosts still allow SSH password login, which disks are over 90 percent, or which services failed since the last reboot.
Will it change our servers?
Not by default.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Changing a host's execution policy from read-only to full is an administrator-only action.
How does a server join?
With one command.
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
Can we add our own checks?
Yes. You can upload your own skills next to the vendor's signed catalogue and turn each one on or off per workspace.
Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.
Where to go next
All guidesBring one question of your own.