Every endpoint.
Always in sight.
Sentinaut is a self-hosted RMM platform for managed service providers. Monitor, alert on and manage all your endpoints — servers and workstations — from a single interface, on your own infrastructure. A lightweight phone-home agent reports back outbound-only.
Self-hosted · Multi-tenant · Lightweight phone-home agent · Outbound-only connections
Works with the infrastructure you already run
- Windows
- Linux
- macOS
- Bash
- PowerShell
- Webhooks
- Slack · Teams · n8n
Why an RMM platform?
Most MSPs monitor their endpoints with a patchwork of scripts, single-purpose tools and manual checks — one setup per customer, no shared overview, and a failed server often goes unnoticed until the customer calls. Sentinaut replaces the patchwork with one consistent operating model.
End the tool sprawl
One platform covers monitoring, alerts, remote access, remote scripts, asset inventory and patch management across Windows, Linux and macOS — instead of six disconnected tools with six different states of documentation.
Know the state of every endpoint
Dashboards per customer, alerts on threshold violations or offline devices, e-mail and webhooks into your monitoring — a problem never goes unnoticed until the customer calls.
Isolation your customers can audit
Every customer lives in its own database. Devices, metrics, alert rules and audit logs are physically separated — a clear answer to the data-separation question in every audit.
See it in action
Real screenshots from the product — dark theme, live data, no mockups. Click any screenshot to enlarge it.
Everything an MSP needs to manage endpoints
From onboarding a new customer to the remote script at 3 a.m. — the complete lifecycle in one place.
Central monitoring
CPU, RAM, disk and uptime of every endpoint — reported by the phone-home agent and shown live in the interface. One overview across all customers and devices, instead of scattered single checks.
Alerts
Define thresholds for CPU, RAM or disk and get warned when a device goes offline. Notifications by e-mail and via webhooks into Slack, Teams or automation platforms like n8n.
Remote access
Take control of the screen via remote desktop, open a terminal in the browser, manage files with the built-in file manager and trigger reboot, shutdown or Wake-on-LAN — all straight from the device view.
Remote scripts & tasks
Run Bash and PowerShell scripts remotely on single endpoints or whole groups. The agent fetches its tasks itself and reports the result back — no inbound access required.
Asset inventory
Automatically collected inventory per endpoint: operating system, installed software, hardware essentials. Keep track of your entire device fleet without maintaining manual lists.
Patch management
Surface operating-system and application updates across your fleet and roll them out in a targeted way — scheduled or on demand, with live status per update. Keep every customer's endpoints on a consistent level.
Customizable dashboards
Build the overview your team needs from modular widgets — status and alert donuts, top CPU/RAM/disk lists, fleet health — arranged the way you work, per customer.
Docker at a glance
The same agent reports the containers running on your endpoints — one overview of every Docker host across the fleet, including a central check for available application updates.
Per-device activity log
Every endpoint keeps its own timeline — enrollment, online/offline transitions, executed tasks, patch rollouts, alerts and remote sessions. What happened on this machine? One look answers it.
True tenant separation
Every customer gets its own database in the control plane and its own audit trail. Team members only see the customers they are assigned to — with roles per customer.
Outbound-only connections
The lightweight agent establishes all connections outbound over HTTPS to the control plane — no inbound port at the customer site, no firewall exceptions, works behind NAT too.
Your infrastructure, your data
Fully self-hosted. No SaaS dependency, no third party holding your customers' metrics — the platform runs on your servers, in your network.
How it works
From zero to monitored endpoints in three steps.
Create a customer
Create a customer — its database is provisioned automatically. Under "Devices" you generate an enrollment token for that customer's endpoints.
Install the agent
Roll out the lightweight phone-home agent via prebuilt installers
(MSI for Windows, .deb for Linux) or via python -m
sentinaut_agent. The agent reports outbound over HTTPS and
joins the right customer.
Monitor & manage
Metrics, alerts and webhooks keep your team informed. Run remote scripts, keep the inventory current and roll out patches — every action lands in the audit log.
Installing the agent
A lightweight phone-home agent runs on every endpoint and connects to the control plane outbound-only over HTTPS. Two ways to roll it out — both need the enrollment token you generate in the app under "Devices".
Prebuilt installers
Ready-made packages: MSI (Windows) and .deb (Debian/Ubuntu). Install, provide the enrollment token, done — ideal for distribution through your software deployment. The agent then keeps itself current via self-update.
Python module
On systems with Python, python -m sentinaut_agent is
all it takes, configured via SENTINAUT_* environment
variables: SENTINAUT_CONTROL_PLANE_URL and the
enrollment token.
Security is the default, not an add-on
An RMM platform has access to your customers' systems. This one is built accordingly.
Outbound only, no open port
The agent initiates every connection itself — outbound over HTTPS to the control plane. No inbound port has to be opened at the customer site, which shrinks the attack surface considerably.
Token-based enrollment
Endpoints join via an enrollment token that you generate per customer under "Devices". That way every agent lands with exactly the right tenant.
Roles per customer
Granular roles per customer — administrator, operator or read-only access, assigned individually or via groups. Team members only see and control the customers they are assigned to.
LDAP/AD login & MFA
Your team signs in with its existing directory accounts — LDAP and Active Directory are supported natively, including group sync. Multi-factor authentication adds another layer on top.
Complete audit trail
Every security-relevant action — executed remote scripts, patch rollouts, user changes — is logged with user, time and target, per customer.
Isolation per customer
Every customer lives in its own database. Devices, metrics and audit logs are physically separated — a clear answer to the data-separation question.
Self-hosted — on your infrastructure
Sentinaut runs entirely on your own servers. Maximum sovereignty: platform, databases and metrics stay in-house.
Self-hosted
Runs entirely on your infrastructure.
- Runs on your servers (Docker Compose), in your network
- Full data sovereignty: platform, databases and metrics stay in-house
- A dedicated database per customer in the control plane
- Agent reports outbound-only over HTTPS
- Guided installation and onboarding by us
- Optional support & maintenance contract
Starter
For getting started: one team, first customers, every feature included.
Professional
For growing MSPs: more customers, more devices, the same control plane.
Enterprise
Individual volume, individual SLAs — let's talk about your environment.
Licensing is based on the number of managed endpoints. Not sure which tier fits? We'll figure it out together in the demo — switching later is possible at any time.
Frequently asked questions
What does Sentinaut monitor?
CPU, RAM, disk and uptime of every endpoint, reported by the phone-home agent. On top of that: alerts on threshold violations or when a device goes offline — by e-mail and via webhooks.
Does the customer site need open inbound ports?
No. The agent establishes all connections outbound over HTTPS to the control plane. No inbound port has to be opened, and it works behind NAT and firewalls too.
How do I install the agent?
Via prebuilt installers (MSI for Windows, .deb for Debian/Ubuntu)
or via python -m sentinaut_agent with
SENTINAUT_* environment variables
(SENTINAUT_CONTROL_PLANE_URL and the enrollment token).
You generate the enrollment token in the app under "Devices". See
the agent documentation for
details.
Which operating systems are supported?
The agent runs on Windows, Linux and macOS. Remote scripts and tasks can be executed as Bash or PowerShell.
Can I run scripts remotely?
Yes. Sentinaut runs Bash and PowerShell scripts as remote tasks on single endpoints or whole groups. The agent fetches the tasks itself and reports the result back.
Is there remote access with screen control?
Yes. Straight from the device view you take control of the screen via remote desktop, open a terminal in the browser or manage files with the file manager. Power actions (reboot, shutdown) and Wake-on-LAN are included too. Remote access can be disabled per device, and every action lands in the audit log.
Where does the data live?
Entirely on your own infrastructure. Sentinaut is self-hosted, with a dedicated database per customer in the control plane — no third party holds your customers' data.
How do I get it?
As a self-hosted installation on your own infrastructure. Book a demo and we'll walk you through the platform and the onboarding.
Book a demo
Pick a slot that suits you — we'll walk you through the platform along your use cases: your endpoints, your alerts, your customer structure.
Booking window not opening? Open the booking page · Prefer e-mail? info@inal-it.de
Or write to us
Questions about features, sizing or onboarding — we usually reply within one business day.