A server operations assistant for builders and operators
Connect a server, then ask what broke in plain English, or type the commands yourself. When you want ongoing checks, confirm monitors and start patrols.
A real walkthrough
Use the product screens to see the full path from connecting a server to handling an anomaly.
Help me inspect the app's error logs
Add SSH details. Desktop credentials stay on the device by default; cloud hosting is an explicit choice.
See containers, apps, databases, and caches so you know what the machine is running.
Checks are generated from discovery. Continuous patrols start after you confirm them.
For example: “Help me inspect the app's error logs.” You do not have to start from a memorized SSH recipe.
Related anomalies become one problem, with logs, check results, and suggested next steps.
Accept, edit, or ignore a suggestion. Every action is sorted into one of three risk tiers. Low-risk actions (such as a confident service restart or log rotation) run automatically. Medium-risk actions (such as changing config or recreating a container) are sent to you for approval first, and run automatically if no one responds within 30 minutes. High-risk actions (database schema, kernel parameter, network and firewall changes) only raise an alert and are never executed. When the system isn't sure, it treats the action as the next tier up; commands that fail the safety check are blocked and never run, and every step is logged. Use a least-privilege account on production servers.
Two audiences
AI gathers evidence and helps you decide the next step. It does not replace operators.
After launch, you do not need a full monitoring stack first. Connect a server, confirm what was discovered, and inspect unusual logs in plain language.
Spend less time on repetitive patrols and evidence gathering. AI gathers evidence and suggests next steps. Every action is sorted into one of three risk tiers. Low-risk actions (such as a confident service restart or log rotation) run automatically. Medium-risk actions (such as changing config or recreating a container) are sent to you for approval first, and run automatically if no one responds within 30 minutes. High-risk actions (database schema, kernel parameter, network and firewall changes) only raise an alert and are never executed. When the system isn't sure, it treats the action as the next tier up; commands that fail the safety check are blocked and never run, and every step is logged. Use a least-privilege account on production servers.
Telegram
The official group can host the bot for introductions. Server lists, patrols, problems, and AI-assisted SSH happen only in a private chat with the bot. Group chat cannot manage servers.
After you bind your account, review runtime status, patrol records, and open problems in private chat.
You can troubleshoot with AI in private chat only if the cloud already has that server's credentials. Binding Telegram is not enough when the key stays only on your computer.
Groups are for welcome text and orientation. Server data and sensitive actions are not completed in the group.
Desktop · Open source
The standalone desktop client is open source under MPL-2.0. SSH keys and passwords stay in a local encrypted vault by default. Sign-in, monitoring, and AI still go through app.itops.sh. Open source lets you review the client; it is not a third-party security audit.
macOS and Linux prerelease · Windows coming soon
SSH keys and passwords stay in the encrypted vault on this device by default and are never uploaded automatically.
Unattended patrols after the computer is off require credentials you explicitly host in the cloud. Keep production credentials local unless you choose otherwise.
Cloud AI may receive related logs, terminal output, or patrol summaries. Private keys are not sent to the model as SSH credentials.
The standalone desktop client is open source. The OpsMate cloud SaaS is not.
Pricing
Free has no trial window and no server cap. A subscription only adds AI quota; it does not unlock menus or other features. Enterprise complete capabilities and private deployment are quoted.
$0
Permanently free
$10 / unit / month
Each unit adds 500 requests / month · $100 / unit / year
Contact us
Full platform · private deployment
One complete model request counts as 1, totaled by UTC calendar month. In the terminal, running commands and then analyzing their output counts as another request. SSH patrol checks themselves do not consume quota; AI summaries of patrol results or logs do. The counter resets at the start of each UTC month.
Recommended troubleshooting guides
Collect evidence before changing a service. These steps work with or without OpsMate.
On one screen, ask AI to check the logs, or type the command yourself and verify the evidence.
Read the guide →Away from your desk? Read the patrol alert in a private Telegram chat, then gather evidence with AI before deciding what to do.
Read the guide →What exit codes 0, 1, 125-127, 137, 139 and 143 mean, what to check next, and what each code does not prove.
Read the guide →Exit code 137 means SIGKILL: often out of memory, not always. Check OOMKilled, docker events and kernel logs.
Read the guide →Check who can still log in, lock their account without locking yourself out, and change the passwords and keys they saw.
Read the guide →Inventory services, ports, containers, cron jobs, backups and certs. Write one page, then run a weekly check.
Read the guide →Separate startup errors, unavailable dependencies and memory pressure before restarting again. Includes read-only commands and an AI troubleshooting prompt.
Read the troubleshooting guide →Investigate sudden disk-usage spikes, or open all troubleshooting guides.
FAQ
On desktop, SSH keys and passwords stay in the local encrypted vault by default and are not uploaded automatically. They reach the cloud only if you explicitly choose cloud hosting. Credentials added in the web console are cloud-hosted.
Cloud AI may receive your question, recent terminal output, patrol summaries, or related log excerpts. OpsMate attempts to redact secret-looking material first, but redaction isn't guaranteed, so remove sensitive information yourself. SSH private keys are not provided to the model as connection credentials. Keeping credentials on-device does not mean all data stays on-device.
Yes, if the cloud has the connection details it needs and that server's credentials are hosted in the cloud. If credentials exist only on a computer that is off, the cloud cannot keep connecting for unattended patrols.
Bind your Telegram account and talk to the official bot in a private chat. Status, patrols, and problems only need that binding. AI-assisted SSH also needs the cloud to reach the host: credentials must be cloud-hosted (added in the web console, or explicitly uploaded from desktop). If the key stays only on your computer, binding Telegram does not let you operate that server remotely. The group is for introductions only and cannot manage servers.
AI gathers evidence and suggests next steps, and patrols run check commands automatically. Every action is sorted into one of three risk tiers. Low-risk actions (such as a confident service restart or log rotation) run automatically. Medium-risk actions (such as changing config or recreating a container) are sent to you for approval first, and run automatically if no one responds within 30 minutes. High-risk actions (database schema, kernel parameter, network and firewall changes) only raise an alert and are never executed. When the system isn't sure, it treats the action as the next tier up; commands that fail the safety check are blocked and never run, and every step is logged. Use a least-privilege account on production servers.
Only AI pauses. Server views, patrol records, problems, and non-AI Telegram actions keep working. Subscribe by the unit when you need more requests.
Free stays free, with unlimited servers. Subscribe by the unit for more AI. Contact us for complete Enterprise capabilities.
Registration and subscriptions happen in the console · payments by Stripe
