IT Operations
Root-cause investigation across Linux, macOS, Windows, Kubernetes and the network, on the hosts a team already runs.
Question
Which hosts still allow SSH password sign-in?
srv-web-01No action needed$ sshd -T | grep -i passwordauthpasswordauthentication no exit 0
srv-app-02Needs action$ sshd -T | grep -i passwordauthpasswordauthentication yes exit 0
ops-laptop-07Evidence still pending
The examples below describe potential use cases. Execution depends on available skills and connectors, customer permissions and qualification in the customer environment.
What the IT team is asking for
An application got slow at eleven this morning. The answer is somewhere across a load balancer, four application servers, a database and a cluster that rolled out a change last night. Someone opens six terminals and starts pasting commands into a chat window. Two hours later there is an answer and no record of how it was reached.
- Ask a question once and have it answered on every server it concerns.
- Get back the commands that ran, not a summary of what an assistant believes happened.
- Find configuration drift across an estate before an auditor does.
- Keep the investigation record, so the next person starts from it rather than from zero.
What people ask
Find the cause of today's application latency.
Which of these 200 servers still permit SSH password authentication?
Why have the pods in this namespace been restarting since the last rollout?
Hosts are the execution and evidence workers
A small agent runs on each machine. The model never touches the machine; it asks the host worker to run an approved diagnostic, and the host worker returns what happened. That is why the answer can be checked.
- AgentModel, skills and policy
- Host workerA small agent on each machine
- Approved diagnosticRead-only by default
- What happenedCommand, exit code, output
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Host investigations show the commands that ran, their exit codes and output, per host.
The diagnostic skills an agent may use
Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.
The built-in catalogue covers the estate an operations team actually runs, and each skill is a scoped set of diagnostics rather than a free-form prompt:
- linux-host-triage
- windows-host-triage
- active-directory-investigation
- exchange-server-triage
- kubernetes-cluster-triage
- virtualization-platform-triage
- network-firewall-triage
- storage-filesystem-triage
- identity-dns-edr
- file-provenance
- infrastructure-incident-rca
Each skill is a versioned package. Uploads are checked before they install, every version is archived, and each workspace enables or disables each skill.
The agent pack
What it is made of
- Host workers on Linux, macOS and Windows
- Read-only execution policy
- Signed skill catalogue
- Ask one host or the whole fleet
- Agents as objects
- Skill capability manifests
- Evidence store and Runs view
- Kubernetes, Prometheus and ServiceNow connectors
- Human approval before a change is applied
How an investigation is carried out
An agent is a model, a set of approved skills, tools and a policy, applied to a scope.
Agents reach your systems through the MCP servers you connect in the console. A token you enter there is sealed, never shown again, and acts only with the permissions your system gives it; a connector that runs on one of your hosts keeps its token in that host's own connector file.
Execution follows the configured host policy. A command can be approved, denied or referred for human review; individual approval depends on that policy.
Deployment, use-case film and related resources
Where it runs
Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.
Customer-controlled inference and execution boundaries.
Related guides and agents
See how IT operations teams use private AI agents for infrastructure management:
- AI for IT operations — how IT teams use private AI agents to audit systems and answer operational questions.
- Host Advisor — the agent built for IT operations, connecting to enrolled hosts and infrastructure systems.
The use case, on film
Guides for this team
- Managed private AI agents for IT and security
- How to compare private AI agent services
- IT operations: review a host investigation with evidence
- Security investigations: from host question to evidence
- On-premise AI agents, and what to check before you run one
- An AI agent for IT operations, from one server to the whole fleet
- Installing a customer-hosted AI agent platform
Bring one question of your own.