osctrl is a set of small, focused Go services sharing a common core, backed by PostgreSQL and Redis, with a modern React operator frontend and an MCP server for AI agents.
osquery agents talk to the TLS endpoint. Operators, automation and MCP clients talk to the API. Everything shares one backend.
osctrl-mcp and the CLI are just authenticated REST clients — the API's
permission checks bound every one of them.
osctrl-tlsImplements the osquery remote API as a TLS endpoint. This is what your fleet talks to:
osctrl-apiREST API service powering the frontend, automation and MCP:
React single-page application served alongside the API:
osctrl-cliCommand-line interface for operators and automation:
osctrl-mcp NewA Model Context Protocol server, in two shapes serving the same tools:
osctrl-mcp: a stdio binary launched by the client, for one operator on a workstation/api/v1/mcp inside osctrl-api, so a shared deployment serves every user as themselvespkg/*)All services build on the same Go packages: node state, environments, queries, carves, users and permissions, tags, caching, logging pipeline, alerting, audit log, MFA, GeoIP and posture ingestion, health, rate limiting and more.
Boring, proven infrastructure — chosen for performance and operational simplicity.
| Layer | Technology | Notes |
|---|---|---|
| Backend services | Go (1.27.1) | Single static binaries per component; fast, concurrent log and query handling. GORM, go-redis, zerolog, Viper and Prometheus underneath. |
| Operator frontend | React 19 · TypeScript · Vite 8 · Tailwind CSS 4 | Modern SPA served with the API, using TanStack Router/Query/Table and Monaco Editor; Node.js 22+ for development. |
| Database | PostgreSQL | Primary datastore for nodes, environments, queries, users and results. |
| Cache | Redis | Caching and fast node state for high-throughput fleets. |
| Endpoint agent | osquery | Schema metadata shipped through osquery 5.23.1 for query authoring and console .tables. |
| Deployment | Docker · systemd · nginx | Docker Compose stack for development; provisioning script and configs for production. |
| API contract | OpenAPI | osctrl-api.yaml ships in the repository. |
| AI integration | Model Context Protocol | Standalone osctrl-mcp over stdio, or hosted over HTTP at /api/v1/mcp. |
| Identity | JWT · OIDC · SAML · WebAuthn · TOTP | Federated providers configurable per deployment; passkeys, security keys and recovery codes for password logins. |
JWT authentication is the default for the API, with optional MFA — TOTP, passkeys and security keys, recovery codes. Table metadata and sample libraries require authentication too.
Operator actions are audit-logged — hosted MCP writes a row for every tool call, reads included — and trusted proxy controls keep client attribution honest behind load balancers.
The node console is read-only, permission-checked, and scoped to the target node with fresh, active sessions only.
MCP carries no authorization logic of its own. Hosted tool calls dispatch back through the API's handlers as the calling user, and the standalone binary is bounded by its token's environment permissions.
MCP write tools are not registered unless explicitly enabled. Scheduled queries always require a target, always expire, are never hidden, and carve queries are refused outright.
Hostnames, process names and result rows come from the monitored endpoints themselves. osctrl treats that content as data, never as instructions — the reason writes ship off by default.
Found a vulnerability? Please follow the responsible disclosure guidelines.
One command with Docker Compose, or deploy natively with the provisioning script.