Who runs IT-AI, and for what

IT-AI fits teams that want an AI to do real work on their machines without handing a vendor, or the AI itself, standing power over the fleet. Three groups fit best.

Internal IT at a technical company

Who: IT and platform teams with roughly 20 to 500 mixed Windows, macOS and Linux devices, who already use Claude Code or a similar agent.

What they do with it:

• Ask Claude about a machine and get a read-only diagnosis: list_devices, system_report, compliance_posture, screenshot.
• Fix it with a write token and the deny-list on, or through the hub assistant's Apply button.
• Grade disk encryption, firewall, antivirus and OS updates across the fleet with fleet_compliance.
• Give a developer admin rights on a Windows laptop for an hour instead of forever, with the hub removing them when the hour is up.

Why IT-AI: the hub, the audit log and the AI key stay on your infrastructure, and the AI's reach is set by the token you mint.

Small MSPs (1 to 10 technicians)

Who: small managed service providers looking after several small clients.

What they do with it:

• Give each technician their own account and enrollment token. On a hub with identity configured, each one sees and drives only the devices they enrolled.
• Run the same check or community script across every device (fleet_report, run_script_fleet).
• Push installers with push_file and install software with winget, brew or apt.

Why IT-AI: self-hosting is free, with no per-endpoint or per-technician fee. Where it falls short: there is no PSA, ticketing, billing or backup, and no patch rollout policies. An MSP that needs those should keep a full-suite RMM.

Edge and robotics fleets

Who: teams running Linux devices, such as NVIDIA Jetson boards, on networks they do not control: behind CGNAT, on a customer's site, on cellular.

What they do with it:

• Reach a device with no inbound port and no public address, because the agent dials out.
• Get a shell, start a long job and follow its log, pull a file, or take a camera photo.
• Turn a device into a WireGuard VPN exit through the hub's UDP relay, so a pass holder can browse from the site's own network. The built-in userspace WireGuard runs on kernels without the WireGuard module, including a Jetson Orin's.

Where it falls short: IT-AI is not an over-the-air image updater. It updates its own agent, not your root filesystem or containers.

When IT-AI is the wrong tool

• You need phone and tablet management (MDM) or mobile viewer apps.
• You need patch rings, maintenance windows and per-patch approval at scale.
• Your contract requires a SOC 2 report or OS-code-signed agents today.

See the comparison for tools that cover those.