The Live Deck agent — designed so careful people can install it

Optional Pro feature. Outbound heartbeats only. No root password in our cloud. Free surface scans never require an agent.

Does	Does not
CPU, RAM, disk, net byte counters	Ask for or store root / SSH passwords
HTTPS POST to api.hostcloak.com	Open a listen port or remote shell
Per-host token (shown once, hashed server-side)	Process lists, env dumps, file reads beyond stats
Revoke in one click — token dies immediately	Packet capture or per-IP flow tables (v1)
Readable Python agent in the product repo	Opaque “trust us” binary as the only path

What shows on your deck

Gauges for CPU, memory, and disk — plus a dedicated Inbound / Outbound bandwidth history derived from byte counters. Not deep packet inspection. Preview: SAMPLE Live Deck.

Install path (when Pro enroll is live)

Review the agent source before you run anything.
Enroll the host in HostCloak — copy the one-time host_… token (not a password).
Run as non-root when possible (reads /proc + disk stats).
Confirm first heartbeat on the deck.
Revoke anytime in the UI; leftover process becomes a no-op without a token.

Review locally (today)

Agent lives in the private product tree as readable stdlib Python. Shape of a dry run:

# Print metrics JSON only — no network
python3 agent/hostcloak_agent.py --print-only

# After enroll (token once):
export HOSTCLOAK_API=https://api.hostcloak.com
export HOSTCLOAK_AGENT_ID=…
export HOSTCLOAK_AGENT_TOKEN=host_…
python3 agent/hostcloak_agent.py --once

Uninstall

# Stop the agent process/unit, then revoke token in HostCloak UI
# Revoke alone is enough to kill cloud ingest even if the binary remains

Capability freeze (v1)

Capability	v1
metrics	yes
exec / shell / files	no
inbound listen	no

New capabilities later require fresh consent and a new token — not a silent upgrade.

View SAMPLE deck Free scan (no agent) Questions