IT-AI: the self-hosted RMM your AI can operate safely
You run the hub. A lightweight agent on each Windows, macOS and Linux device dials out to it, so no inbound ports are needed. Your AI drives the fleet through an MCP server and a CLI, bounded by the token you mint, the deny-list on your hub and an audit log. The agent, MCP server and CLI are open source under MIT.
- MITagent, MCP server and CLI, built in public CI
- Sigstorebuild-provenance attestation and SHA256SUMS on every release
- ed25519signature checked before an agent replaces itself
- 0inbound ports needed: devices dial out
- 32MCP tools, plus the itai CLI
- v3.9.0latest agent release, 2026-10-10
What your AI can do without you, and what it cannot
IT-AI does not rely on the model behaving well. The limits below are enforced by the hub and the agent, whatever the model decides.
| Action | Without a person in the loop? | What enforces it |
|---|---|---|
| List devices, read reports, take screenshots, grade compliance, look up CVEs | Yes, with any MCP token, including a read-only one | Token scope on the hub |
| Run a command, install software, push a file, reboot | Yes with a write token, no with a read-only token (the hub answers 403) | Token scope on the hub; your MCP client can still ask you before each tool call |
| Run a command your deny-list forbids | No, for anyone: the hub refuses before the device is contacted | Hub policy (deny_actions, deny_patterns) |
| Apply a fix proposed by the hub's own AI assistant | No: it proposes from a fixed menu and waits for a person to click Apply | Approval gate on the hub |
| Get local admin on a Windows device | No: a person approves a time-boxed grant, and the hub removes it when the window ends | Hub JIT elevation (Windows only today) |
| Reach a device directly over the LAN to skip the hub | No: every direct call needs a 60-second capability the hub mints after the same authorization, deny-list and audit | ed25519 capability checked by the agent |
| Act without a record | No: every device action goes to the hub's audit log, and a command's entry is written before the command runs | Hub audit log |
A deny-list only blocks what you put in it: a hub with no policy file allows every command. The security page lists the gaps as well as the controls.
What it does
Shell, scripts and background jobs
Run a command and get its output, run a community script from the Tactical RMM library, or start a long job (a build, a dev server) and read its log as it grows.
Screen, input and camera
Take a screenshot or watch the live screen, click, type and press keys, and take a webcam photo.
Files
Download from a device, upload up to 100 MB directly, or push larger files by stage-and-pull with a SHA-256 check.
Packages and updates
Install or remove software with winget, brew or apt, and list pending OS and app updates.
Compliance and CVEs
Grade disk encryption, firewall, antivirus and OS updates per device or across the fleet, and look up CVEs in NVD.
Just-in-time admin
A user asks for admin from the tray; you approve a time-boxed grant; the hub removes it when the window ends. Windows only today.
VPN exit behind CGNAT
A Linux device can be a WireGuard exit through the hub's UDP relay, with built-in userspace WireGuard for kernels without the module.
AI assistant with an Apply button
The hub's assistant inspects read-only, explains the problem and proposes a fix from a fixed menu. Nothing changes until a person clicks Apply.
Drive it from your AI
The MCP server and the itai CLI expose the fleet to Claude Code or any MCP client, scoped by the token you give it.
Where the keys and the data live
Devices dial out to your hub over HTTPS. The hub holds ownership, token scopes, the deny-list, the audit log and the AI assistant's API key, and checks every call before it reaches a device. Your AI connects through the MCP server or the itai CLI with a token you mint. On a shared LAN, calls can go direct, each one carrying a 60-second capability the hub issued after the same checks.
Who it is for
Internal IT
Teams with 20 to 500 mixed Windows, macOS and Linux devices who already work in Claude Code.
Small MSPs
One to ten technicians who want an RMM without per-endpoint or per-technician fees.
Edge and robotics
Linux devices behind CGNAT that need a shell, files, a camera and a VPN exit.
How it compares
Big cloud RMMs (NinjaOne, Atera, Action1, Level) are SaaS, and their AI features and MCP connectors, where they exist, run in the vendor's cloud under the vendor's permission model. Self-hosted tools (Tactical RMM, MeshCentral, RustDesk) keep the data with you but have no built-in AI operator. IT-AI is self-hosted and built to be driven by your AI over MCP and a CLI. It is also younger and narrower: no patch rollout policies, no PSA, no backup, no mobile clients. See the full comparison.
Pricing
Self-hosting is free: the agent, MCP server and CLI are MIT, and the hub is licensed under the Elastic License 2.0, free for your own organization. You bring your own AI key. A hosted plan is coming; no prices are published yet. See pricing.
Questions
Is IT-AI an RMM?
Yes, a self-hosted one. It does remote control, shell, file transfer, software install, update checks and compliance grading for Windows, macOS and Linux. It does not do patch rollout policies, PSA or ticketing, backup or MDM.
Can my AI change a machine without me?
It depends on the token you give it. A read-only MCP token can inspect but cannot run commands or change anything. A write token can run commands, and the hub checks each one against your deny-list and records it in the audit log first. The hub's own assistant only proposes fixes; nothing runs until a person clicks Apply.
Is IT-AI open source?
The agent, the MCP server and the itai CLI are open source under MIT. The hub is licensed under the Elastic License 2.0, which lets you self-host it for your own organization free of charge.
Do I need to open firewall ports?
No. Each device dials out to your hub over HTTPS and holds that connection open, so a managed device needs no inbound port and no public address. When the controller and the device share a LAN, traffic can go direct: the agent then listens on port 8765 on the local network and accepts only calls carrying a capability your hub issued. Set HIVE_LAN=0 to turn that off.
Where does my data go?
To your hub. Screens, shell output, files and telemetry stay on infrastructure you run. The agent has no hardcoded endpoint, and the AI assistant's API key is set on the hub and never sent to devices.
Are the agent binaries code-signed?
Not with Apple or Microsoft certificates yet: macOS builds are ad hoc signed and Windows builds are unsigned, so Gatekeeper and SmartScreen may warn. Every release does carry a SHA256SUMS file, an ed25519 signature per binary and a Sigstore build-provenance attestation.
What does it cost?
Self-hosting is free. A hosted plan is coming; no prices are published yet.