The problem
The clients are different. The 2am phone call is always the same.
When you maintain servers for a roster of clients, every box is a slightly different snowflake — Ubuntu here, Debian there, PM2 on one, raw systemd on another, Nginx vs Caddy, MySQL vs Postgres. You're juggling a password manager full of SSH keys, hopping between boxes to answer "is it up?", and finding out a disk filled only when the client emails you.
Standing up a heavyweight monitoring stack per client isn't worth it, and giving every client a seat in some SaaS platform means more accounts, more cost, and their data leaving your control.
How ServerMind helps
Designate one instance as a controller and run a lightweight agent on each client box. Every agent dials OUT to the controller over a single WebSocket — so you open no new inbound ports on client servers — and the controller shows every server in one dashboard, under one login.
Reports and alerts from every server are deduped into one inbox, so you get a single morning health digest instead of twelve, and one alert when something actually needs you.
Onboarding a new client
Adding a server is one command. From the Fleet dashboard's "Add server" button you get the exact one-line enroll command to run on the new box:
$ curl -fsSL https://servermind.dev/install.sh | bash -s -- \
--controller wss://your-controller/fleet/agent --token <token>Want the controller↔agent link fully under your control with no third party at all? Add --mesh to run it over a self-hosted WireGuard mesh — each agent generates its own keypair locally and enrolls with just its public key. Add and revoke agents from the dashboard; there's no coordination server like Tailscale's.
Per-client isolation, by design
Managing many clients from one console is only safe if a mistake can't cascade — so ServerMind keeps each server sovereign:
- Security is per server. Each agent enforces its own read-only allowlist and arm switch. The controller can ask a box to do something, but can't bypass that box's guardrails.
- Tools are agent-owned. Each server defines its own custom tools and advertises only their names; when you act, the call runs on that box and is re-validated locally. The controller can trigger a server's tool but never define or push one.
- No new attack surface on clients. Agents dial out — there are no extra inbound ports to firewall, and the WireGuard keys are per-agent and individually revocable.
Why agencies like it
- One login, not twelve. Stop hopping between boxes to answer "is it up?".
- It's free and self-hosted. MIT-licensed, no per-server SaaS fee, and client data never leaves infrastructure you control — use local Ollama for zero egress.
- It scales down too. A single client box runs zero-config on its own; you only add the controller role when you've got more than one.
FAQ
Do I open ports on each client's server?
No — agents dial out to your controller over one WebSocket, so there are no new inbound ports on client boxes. The link can optionally run over a self-hosted WireGuard mesh.
Can one client's box affect another?
No. Each agent enforces its own allowlist and arm switch and owns its own tools. The controller can ask but can't override a server's guardrails.
Does fleet-wide chat need a specific AI?
Yes — fleet-wide chat ("which servers are unhealthy?") requires an OpenAI-compatible backend on the controller. Per-server chat works with any supported backend.
Get started
$ curl -fsSL https://servermind.dev/install.sh | bashInstall the controller first, then add each client with the agent command above. Full walkthrough in the fleet setup guide.
Related use cases: Startups without DevOps · On-call & incident response · Indie developers