Observing the
Healing the

v1.6.18
Quick Install View on GitHub

InfraEye is an agentless observability platform. One Command Center for the whole estate: bare-metal Linux boxes, Kubernetes clusters, the databases behind them and the private networks they sit on.

Nothing gets installed on the machines you watch. A Go backend reaches out over SSH and the Kubernetes API to collect metrics, stream logs and run remediation, so your targets stay exactly as you left them. Postgres, MySQL, Redis and Kafka are reached the same way, through a secure gateway rather than a port you had to open.

Netra reads that telemetry and explains an incident in plain language, then hands you the command to fix it. Six built-in scanners sweep for kernel CVEs, weak hardening, and cluster, resource and code security issues before they bite. And when you would rather not be woken at all, XML-defined alert rules close the loop themselves, firing SSH remediation the moment a threshold trips.

Agentless telemetry · AI diagnostics · Security audit · Self-healing

Meet Your Co-Pilot

Netra AI Assistant

Netra is a context-aware co-pilot that sits on top of your infrastructure. It queries logs, metrics and live Kubernetes state directly, so when something breaks it can tell you what happened in plain language instead of handing you another dashboard to read.

Ask it why a pod is restarting and it will pull the events, spot the memory limit, and give you the exact command to fix it. Bring your own model: Claude, Gemini, Mistral, DeepSeek or anything reachable through OpenRouter.

Netra Online
                                                                                              
                                                                                              
                                                                                              
                                    #######################                                   
                               ######*******######******#######                               
                           ####*******##**###*##*###**##*******####                           
                        ###******#####***##*#*##*#*##**######******###                        
                     ###*****###**#***####*#*####*#*#####***#*###*****###                     
                   ###+++*##*****####****##**#**#**##****####*****##****###                   
                 ##*+++*#*****##****#####**##****##**#####****###****#**++*##                 
               ###***+++++*##***#**##********####********##**#***##**+++****###               
              ##++*##******+*#**#*******##############*******#**#********##**+##              
            ##*+++*+#++*#+*+*#*****####****##*##*##****####*****#*+**#***#+*+++*##            
           ##+++*+*+#+++#+*++***###**####################**###****+*+#*++#+*+*+++##           
          ##+=+*++*++****+*+*###**##########################**###*+*+****++*++*+++##          
         #*==+#+++#+++*****###**#*##########################*##*###******++#+++*+==*#         
        #*==+*+++#++##+++*#**##**############################*###**#*+++*#*+#+++*+==*#        
       ##==+*+++#+*+*+++##**#**#############******##############*##*##+++*+*+#*++*+=+##       
      ##===*+++#=++*+++#*+#**#######**********************#######**#+*#+++*++=#+++*===#*      
      #*==*++=*++**+++#*+#**####*+***####*****##*#***####*****####**#+*#+++**++*=++*==*#      
      *===*+++*=*++++##+#**##++++*####*********#*#####**####**+++##**#+##++++*=**++*+==*      
     #*==++==#=+**++*#+***++++*######++##*#############**######*++++***+#*++**+=#==++==**     
     *+====***#==+++#*+*+==+*######*++***################**######*++++*+*#+++=+#***====+#     
    *#===+*==+=**+++#+====*########++*#*###*=++*#########*+########*+==++#+++**=++=**===#*    
    **=+*==+==++=**+*===+#########*+++####+==+++*######**#+*#########*===***#=++==+==**=#*    
    ***==+=+##*+*=**===*##########+++***##=====+++++##***#*+###########===**+*+*##+=+==*#*    
    **=+*==+==++=#*+*===+#########+=#**###=========+##**+++*#########+===****=++==+==**=#*    
    **===++====**+=+#+====*########=+*#*###+======+###**++=########*====+#+++**====*+===**    
     *+====+*+*==+=+**+*====+######+=*+**############**+*=+######*====*+*#+=+==*+**====+*     
     *+==++==*==*+++*#+**++===+#####*=++****##*###****++=*#####+====+**+#*++++==#==++==+*     
      *===+==+*=*=+=+**+#+*##=====####===++++**#*++*#*+=####+====##*+#+*#+=++*=*+==+===*+     
      *+==+===*==++==+**+***###*=====+##+====****+===+##*=====*###***+*#+==*+==*===+==+*      
      **===*===*=+=*+=+**+*+**#####*======================+#####**+*+*#+==*=+=*==+*===**      
       **===++=+*=++*==+**+**+*##########*+========+*##########*+**+**+=+*++=*+=++===+*       
        *+===+===*======++#++*#+**##########################**+#*++#++======*===+===+*        
         *+===+===+=#+=*#++*#*++*+**######################**+**+*#*+++*+*+**===+===+**        
          *+===+=+=*+#=###*=+*#*++#*+****############****+*#++*#*+==*#=*+*#*+=+===+*+         
           ++====+=*=====**===++***++****+++**##**+++****++****+===++++=====+====+*           
            +*===+===+===*+=+*===++*#*++++++++**++++++++*#*++===*+=*##*=+=**====**            
             +*+==+==*+==*+==+++*+==+++********#*******++===+*++++=+#*+=+*+===+*+             
               +*+=========#+==++=+*++====+++****++=====++*+=++==+#+=========**               
                 ++=====++===+*+===+++++*==*#++++**==*++++++==+*+===+*=====+*                 
                   ++=====++=+===**+======*+=+==+=+#+=====+**+==+=++=====++                   
                     +++=====++======++**+=+=+##+=+=+**++======++=====+++                     
                       ++*+======++==++==*+=+=**=+=+*==++==++=======*++                       
                          ++++=============*===+==*=============++++                          
                               ++++=========++==++=========+++++                              
                                   +++++++++++**+++++++++++
Log Analysis Metric Insights Cluster State Guided Remediation
Powered by your choice of model Claude Gemini Mistral DeepSeek OpenRouter Local LLM
Netra · Infrastructure Assistant Live
Why is my payments-api pod stuck in CrashLoopBackOff?
I pulled the pod's recent events and container logs — it's being OOMKilled. The container hits its 128Mi memory limit during startup, so the kubelet keeps restarting it.
kubectl set resources deploy/payments-api \ --limits=memory=512Mi
Apply fix Dismiss
Netra Agent Beta

From answers to actions, with your hand on the brake

Chat tells you what's wrong. The Agent works on fixing it. Give it a goal and a target server, e.g. "find out why nginx keeps restarting and fix it", and it loops: propose one step, wait for you, run it, read the real output, then plan the next step, until the job is done.

  • Nothing runs without a human. Every SSH command and Kubernetes tool call pauses for your Approve or Reject. Nothing is auto-approved.
  • Locked to one server. A run can only act on the target you picked. Cluster calls use that server's context through the MCP sidecar.
  • Verbatim results. stdout, stderr and exit errors go back to the model exactly as returned, so a failure always looks like a failure.
  • Full audit trail. Each run keeps its goal, every proposed step, your decision and the real output. Only admin and devops roles can use it.
Read the Agent guide
Agent Run · web-01 Live
Goalnginx keeps restarting. Find out why and fix it.
Step 1 · SSH executed
nginx -t
[emerg] unknown directive "proxy_bufer_size" in /etc/nginx/conf.d/api.conf:14
Step 2 · SSH needs your approval
sed -i 's/bufer_size/buffer_size/' \ /etc/nginx/conf.d/api.conf \ && nginx -t && systemctl reload nginx
Approve Reject
Key Modules

Everything your infrastructure needs

Purpose-built modules covering monitoring, AI diagnostics, and Kubernetes management — all in a single unified platform.

Server Monitor Production

Real-time CPU, memory, disk, and network metrics across bare-metal Linux, macOS, and Windows hosts — via secure, agentless SSH. Rich per-server overviews with uptime, load, and network throughput graphs.

Kubernetes Explorer Production

A Lens-style cockpit for every cluster: pods, workloads, config, storage, RBAC, CRDs, and the full Gateway API. Create resources from templates, scale and rollout-restart workloads, and edit live YAML — all from one pane.

Networking Inspector Production

OS-native visibility into listening ports, system services, and interfaces — built for Linux (ss/systemctl), macOS (lsof/launchctl), and Windows (PowerShell). See exactly what's exposed on every host.

Live Log Streaming Production

Selectively tail the right stream — journal, syslog, auth, or kernel on Linux; the unified log on macOS; Event Logs on Windows. For clusters, stream Kubernetes events and warnings live. All searchable and persisted.

RBAC & OS Accounts Production

Fine-grained access control — grant individual users visibility of specific servers and clusters. Cockpit-style OS account management lets admins create real Unix users on target machines with Admin, Read/Write, Log-Viewer, or Read-Only privileges.

Fleet Observability Production

A live command-center dashboard: per-node utilization timelines, aggregate network I/O, and automation activity — with 15m / 1h / 6h / 24h time filters and colorblind-safe, theme-aware charts.

AI Diagnostics Production

Powered by Claude, Gemini, Mistral, DeepSeek, and OpenRouter — with per-user API keys — or point it at a self-hosted local LLM (Ollama, LM Studio) for API-key-free, fully private diagnostics. Ask questions about your infrastructure in natural language and get actionable remediation steps.

Web Terminal Production

Full xterm.js-powered terminal directly in your browser — SSH into any managed server, or drop into a pod shell and stream container logs on Kubernetes, without leaving the dashboard.

Alert Engine Production

Define threshold-based alerts on any metric. Receive notifications via Slack and Google Chat webhooks with configurable severity levels.

Self-Healing Engine Production

Automated remediation workflows that trigger on alert conditions — restart services, scale pods, and recover from failures, automatically.

Security Audit Suite Production

Six scanners in one place: kernel CVEs, server hardening, cluster security, resource security, code security, and a DAST scanner backed by OWASP ZAP. Findings land with severity, evidence and a remediation path rather than a raw report dump.

Resource Catalog Production

Register Postgres, MySQL, Redis, Kafka, HTTP/S and plain TCP services as first-class entries. Browse schemas and rows, run SQL from a built-in console, walk Redis keys and Kafka topics, all through a secure gateway so nothing has to be exposed publicly.

Autonomous Agent Beta

Give it a goal and it plans, executes and re-plans against real output. Every step that would touch a server stops for your explicit approval first, so nothing runs unattended. Backed by Claude or any OpenRouter model.

Infrastructure Map Production

A live topology of everything InfraEye can reach: servers, Kubernetes clusters and their nodes, registered resources, and hosts discovered by scanning. Pan, zoom and search the graph to see how the estate actually fits together.

Developer Hub Production

Twenty-plus everyday tools without leaving the console: JSON, YAML and base64, hashes and UUIDs, JWT encode and decode, certificate and chain inspection, SSH key parsing, CIDR and subnet math, DNS lookups, diffs, Docker image inspection, plus a Kubernetes manifest cleaner and an ingress-to-Gateway API converter.

VPN & Mesh Tunnels Production

Reach private hosts in cloud VPCs without opening them up. InfraEye generates the join commands for Tailscale and ZeroTier, and turns an uploaded .ovpn profile into a provisioning script that connects a remote Linux box to your OpenVPN network.

Get Started

Deploy in under 60 seconds

Choose your deployment method. One command is all it takes.

install.sh
# One-line install — requires Docker & Git
$ curl -fsSL https://raw.githubusercontent.com/mnshchtri/infra-eye/main/install.sh | bash
~/infra-eye/.env
# AI & Large Language Models
DEEPSEEK_API_KEY=your_key_here
GEMINI_API_KEY=your_key_here
MISTRAL_API_KEY=your_key_here
# Security
JWT_SECRET=your-long-random-string
PORT=8080
1

Run the installer

The script clones the repo, creates a ~/infra-eye/.env file, and launches all services via Docker Compose.

2

Configure your AI keys

Edit ~/infra-eye/.env with your Gemini, Mistral, or DeepSeek keys to unlock AI diagnostic features.

3

Open your dashboard

Access InfraEye at http://your-ip:8080. Log in and start adding servers and clusters immediately.

4

Prerequisites

Docker Engine 24+, Docker Compose v2.20+, Git, and port 8080 available on your host.

Services Deployed

  • InfraEye Frontend (React via Nginx)
  • InfraEye Backend (Go API)
  • MCP Sidecar (Kubernetes Context)
  • PostgreSQL (persistent data)
  • Redis (pub/sub & caching)

Access Points

  • Dashboard — :8080
  • Backend API — :8080/api
  • MCP Server — :8090
Default Login Credentials
URLhttp://your-server-ip:8080
Useradmin
Passinfra123
Change the default password immediately after your first login.
install-k8s.sh
# One-line Kubernetes install — requires kubectl & Git
$ curl -fsSL https://raw.githubusercontent.com/mnshchtri/infra-eye/main/install-k8s.sh | bash

Useful kubectl Commands

Status kubectl get pods -n infra-eye
Logs kubectl logs -n infra-eye deploy/infra-eye -f
Update kubectl rollout restart deploy/infra-eye -n infra-eye
Uninstall kubectl delete namespace infra-eye
1

Run the K8s installer

The script checks dependencies, auto-detects your kubeconfig (including k3s), and clones the repo into ~/infra-eye.

2

Enter your API keys

The installer interactively prompts for Mistral, Gemini, DeepSeek, and OpenRouter keys. Press Enter to skip any.

3

Manifests applied automatically

A k8s/secret.yaml is generated (gitignored), then all manifests are applied with kubectl apply -k k8s/.

4

Access the dashboard

The installer prints your node IP. Access InfraEye at http://<node-ip>:30080 once rollout completes.

5

Prerequisites

kubectl connected to a cluster, curl, and git. Works with k3s, kubeadm, and managed clusters.

What Gets Deployed

  • InfraEye App Deployment
  • PostgreSQL StatefulSet
  • Redis Deployment
  • MCP Sidecar
  • Secrets (auto-generated)

Access Points

  • Dashboard — :30080
  • Namespace — infra-eye
  • Works with k3s, kubeadm & managed clusters
Default Login Credentials
URLhttp://<node-ip>:30080
Useradmin
Passinfra123
JWT secret is auto-generated per install. Change the default password immediately.

A fully self-contained native app — no Docker, no Postgres, no Redis. Everything (backend, embedded SQLite database, UI) runs as a single local process, built with Wails.

macOS

Apple Silicon

Download .dmg

brew tap mnshchtri/infra-eye
brew install --cask infra-eye

Linux

x86_64 — Debian/Ubuntu or Arch

Download .deb

Arch: pacman -U InfraEye-Linux.pkg.tar.zst

Windows

x86_64

Download .exe

On macOS, installing with Homebrew is recommended — the app is ad-hoc signed rather than notarized, so a directly downloaded .dmg is reported as damaged until you clear its quarantine flag. How to fix that.

Intel Mac builds aren't published yet — see building from source below to build for another platform yourself.

build from source
# Requires Go 1.25+, Node 20+, and the Wails CLI
$ go install github.com/wailsapp/wails/v2/cmd/wails@latest
$ git clone https://github.com/mnshchtri/infra-eye && cd infra-eye && make desktop-build
1

Install or build the app

Download a prebuilt binary above, or run make desktop-build to build it yourself — it compiles the frontend and packages a native .app/.exe/binary via Wails.

2

Launch — everything runs locally

No setup wizard. The app creates its own SQLite database and a random JWT secret on first launch, stored under your OS's standard app-data directory.

3

Log in

Same seeded credentials as the server install — admin / infra123. Change the password immediately.

4

Kubernetes features (optional)

Install kubernetes-mcp-server and have it on your PATH to enable cluster management. Linux-server (SSH) monitoring works regardless.

What Runs Locally

  • Native window (Wails — WebKit/WebKitGTK)
  • Embedded InfraEye Backend (Go API, same codebase)
  • SQLite (single file, no server process)
  • Optional MCP sidecar (Kubernetes only, if installed)

Storage Locations

  • macOS — ~/Library/Application Support/InfraEye
  • Linux — ~/.config/InfraEye
Default Login Credentials
URLthe native app window
Useradmin
Passinfra123
Single-user, local-only by default. Change the default password immediately after your first login.
Architecture

Distributed Bridge — Zero Agents

Instead of installing heavy agents on every node, InfraEye's Go backend establishes secure, lightweight SSH connections to gather metrics and stream logs.

DevOps Engineer
React Dashboard
Go API Gateway
MCP Sidecar
Linux Targets
K8s Clusters
PostgreSQL/Redis
Roadmap

What's coming next

InfraEye is actively evolving. Here's what's in the pipeline.

SHIPPED
🔐

OIDC / SSO Integration

Enterprise single sign-on with Keycloak, Auth0, Okta, and Azure AD — now live.

SHIPPED
🛡️

Granular RBAC & OS Accounts

Per-server access grants plus Cockpit-style Unix account management with tiered privileges.

SHIPPED
🧭

Gateway API & CRD Explorer

Browse Gateways, HTTPRoutes, and any CRD, and create or scale resources natively.

SHIPPED
🖥️

Desktop App

A native macOS (Apple Silicon)/Linux app — SQLite-backed, single binary, no Docker required.

SHIPPED
🗂️

Infrastructure-as-Code Sync

Sync server lists and alert rules directly from a Git repository.

SOON
🌍

Terraform Bridge

Visualize and drift-detect Terraform-managed infrastructure resources.

SOON
📈

Metric Persistence

Long-term data retention backed by Prometheus or VictoriaMetrics.

SOON
📱

Mobile Command Center

A dedicated PWA optimized for on-call emergency status checks.

SOON
🧩

Dynamic Alert Builder

A visual drag-and-drop builder for self-healing automation conditions.

Removal

Uninstall InfraEye

Select the method you used to install — each has its own clean removal process.

uninstall.sh
# Interactive uninstaller — stops containers, removes volumes
$ curl -fsSL https://raw.githubusercontent.com/mnshchtri/infra-eye/main/uninstall.sh | bash
What the Docker uninstaller does
  • Stops and removes all InfraEye containers
  • Removes Docker volumes (database data, caches)
  • Optionally removes InfraEye Docker images
  • Optionally deletes the install directory (~/infra-eye)
  • Leaves shared Docker networks and host credentials untouched
kubectl
# Removes the entire infra-eye namespace and all its resources
$ kubectl delete namespace infra-eye

Optional Cleanup

PVCs kubectl delete pvc --all -n infra-eye
Secrets kubectl delete secret infra-eye-secrets -n infra-eye
Local repo rm -rf ~/infra-eye
What the Kubernetes uninstall removes
  • Deletes the infra-eye namespace and all resources inside it
  • Removes all Deployments, StatefulSets, Services, and ConfigMaps
  • Removes the auto-generated infra-eye-secrets Secret
  • Optionally delete PersistentVolumeClaims (database data) — see commands above
  • Does not affect other namespaces, cluster config, or kubeconfig
  • Node-level data and host files remain completely untouched