Safeavio ServerGuard
Monitoring and protection for Linux servers, with signed agent updates.
In production at safeavio.com. The one-line installer sets up the current agent (Linux 3.19), which polls the hub over HTTPS and updates itself from signed manifests. The macOS (3.16) and Windows (3.14) agents are less tested.
- For
- Anyone running servers
- Devices
- Servers you administer
- Platforms
- Linux (supported) · macOS (less tested) · Windows (not verified in production)
- Works today
- 17 of 19 listed features
Is Safeavio ServerGuard the right edition?
Anyone running Linux servers
A VPS, a dedicated box or a small fleet. Metrics, checks and security basics in one console.
Small teams without a separate security tool
SSH brute-force incidents, malware scans and firewall control next to the metrics.
Operators who want a record
Privileged actions go through typed commands with an audit trail, not an open shell.
You also manage company phones and members
→ Sentinel for Small BusinessYou want correlation across sources and a SOC view
→ Sentinel Enterprise XDR
A server on the internet is probed all day.
Password guessing on SSH, port scans and crypto-miners are routine. Monitoring and security usually live in separate tools, and fixes are run by hand as root with nothing written down. ServerGuard puts the metrics, the security events and the actions in one place, and every action has a record.
- SSH password guessing
- Port scans and unexpected logins from new addresses
- Crypto-miners and suspicious processes
- Services, sites and databases going down
- Unsigned or tampered agent updates
From install to response
- 01
Create an account
Open Servers in the console.
- 02
Install with one command
The installer sets up a systemd service and prints an API key, also stored in /etc/serverguard-agent/api_key.
- 03
Connect
Paste the API key into the console. Metrics start arriving within seconds.
- 04
Add checks and alerts
Uptime, HTTP and database checks; alerts by email, Slack, Discord, Telegram or webhook.
- 05
Scan on demand
ClamAV quick or full scans, rkhunter and chkrootkit, and the security-console scan, from the console. Results stay in your tenant.
- 06
Act through audited commands
Firewall, service, process and container control as typed actions. Reboot, shutdown and firewall-disable show a preview and need confirmation.
Every feature, with its state today
Grouped by where it runs. A feature is available only when it works in production or in the current download.
- Available
- 07
- Limited
- 10
- Not released
- 00
- Coming
- 02
Monitoring
- Live metricsAvailable
CPU, memory, disk and network, every few seconds.
- Processes, services, Docker and logsAvailable
Lists and live views from the agent.
- Uptime, HTTP and database monitoringAvailable
MySQL, PostgreSQL, Redis and MongoDB.
- Alerts and notification channelsAvailable
Email, Slack, Discord, Telegram, webhooks.
- Anomaly flagsLimited
Statistical flags (z-score from 2.0) on the hub's own metrics.
- Backups and capacity viewsLimited
In the console; not verified end to end on every agent.
Security
- SSH brute-force incidentsAvailable
5 failed logins from one address in 5 minutes. Old log lines can re-raise an incident.
- Port-scan, lateral-movement and account-change eventsLimited
From the XDR collector, which runs on the hub agent only.
> Server agent (Linux)
- On-demand malware scansLimited
ClamAV quick and full, rkhunter and chkrootkit.
> Server agent (Linux)
- Security-console scanLimited
Miners, pool ports, temp executables, cron, SUID. A known defect in the binary-integrity step reports false tampering.
> Server agent (Linux)
- Ransomware detection, data-leak scan, secure deleteLimited
Linux 3.19 and macOS 3.16 agents. Ransomware is detect only (decoy files, ransom notes, ransomware extensions); data-leak findings are redacted and no file content leaves the host; secure delete states when SSD/NVMe or copy-on-write storage means no erasure guarantee. Windows 3.11: built, not yet verified on a real host.
> Server agent (Linux)
- Web protection, anti-tracker, privacy guard, safe bankingComing
Desktop browser features; not applicable to a server agent.
Control
- Service, process and container controlAvailable
Start, stop and restart from the console.
- Firewall controlLimited
Administrators only, through typed actions.
> Server agent (Linux)
- Reboot and shutdown with previewLimited
Confirmation required; the outcome is recorded.
> Server agent (Linux)
- Command queue for agents behind NATLimited
Agents that cannot be reached directly pick commands up from the hub.
> Server agent (Linux)
Updates and integrity
- Signed agent updatesLimited
Signature, expiry, anti-rollback, hash, size and platform are checked before install.
> Full Linux and macOS agents
- Staged rollout and rollbackAvailable
5 / 25 / 50 / 100 % bands, with a reason recorded for a rollback.
- Windows agent update verificationComing
The Windows agent checks for updates but does not verify signed manifests.
Where it runs, as it is today
Linux
systemd-based distributions. The supported agent.
macOS
Agent with signed updates; less tested.
Windows
Not verified in production; no signed-update verification.
Who can see what, and what is enforced
What the agent will never do
- Run a command string from the API through a shell
- Act on a server outside your tenant
- Accept a request without its API key (compared in constant time)
- Install an update whose signature, version or hash does not verify
Where your server data goes
- Metrics, logs and events go to your tenant in the console
- Scan results stay in your tenant
- The agents verify the hub's TLS certificate by default
- Security fixes run as structured actions, re-validated at fix time
Agents connect out to the hub over HTTPS: a heartbeat and a 10-second poll fetch commands, so no inbound port is needed. The old plaintext push path from the hub is switched off and scheduled for removal on 31 October 2026. Keep port 9876 closed to the internet.
Edition ceiling: Safeavio ServerGuard may never
- Run a command from an API-supplied string through a shell
- Act on a server outside your tenant
A product boundary, not a setting. No flag, plan upgrade or API call can raise it.
How data moves
Each box is a step the data passes through, labelled with where it runs.
- your serverAgentsystemd service
- networkAPI keyconstant-time check
- our hubHubtenant-scoped stores
- our hubRules and checksincidents, alerts
- consoleConsoleyour team
- our hubReleasesigned manifest
- our hubRollout band5 → 25 → 50 → 100 %
- your serverAgent verifiessignature, expiry, hash
- your serverInstall or refuseno partial apply
Requirements and installation
| Operating system | Linux with systemd. On apt-based distributions the installer adds Python 3 if missing; elsewhere Python 3 must be present. |
|---|---|
| Privileges | Run the installer as root (sudo). The service runs as root. |
| Install location | /opt/serverguard-agent; configuration and API key in /etc/serverguard-agent. |
| Service | serverguard-agent (systemd), enabled at boot. |
| Agent port | 9876 by default; change with --port. |
| macOS | curl -sSL https://safeavio.com/install-mac.sh | bash (per-user install). |
| Windows | irm https://safeavio.com/install.ps1 | iex, in PowerShell as Administrator. |
| Uninstall | Re-run the installer with --uninstall; it removes the service, files and API key and reports anything it could not remove. |
The one-line installer sets up the current single-file agent (Linux 3.19, macOS 3.16, Windows 3.14). It opens no port: it sends a heartbeat and polls for commands over HTTPS, and it updates itself from signed manifests. Features marked Server agent depend on the platform; Linux is the best tested.
How it differs from the editions next to it
Limits come from the edition ceiling in our product boundary. The full matrix compares all seven.
| Property | ServerGuard (this page) | Small business | Enterprise XDR | Personal |
|---|---|---|---|---|
| State today | Available | Limited | Limited | Not released |
| Devices | Servers you administer | 5–250 | Organisation | 1–3 |
| Runs today on | Linux; macOS and Windows less tested | Web console, Linux servers, Android | Web console, Linux server agent, Android | Android. Windows and macOS an unsigned pre-release is available. |
| Strongest action | Firewall, service, process, reboot through audited commands | Typed server actions by administrators; phone lock and locate | Supported server actions; wider endpoint and identity response unavailable | Quarantine and restore, both reversible |
| Who sets policy | Server administrators | Organisation administrators | Tenant administrators and analysts | You, on your own device |
| Device credential | Agent API key | Agent API key; phone device token | Agent API key; mTLS identity not built | Phone enrolment token; separate desktop credentials |
| Cloud reporting | Console-hosted at safeavio.com, one region | Console-hosted at safeavio.com, one region | Console-hosted at safeavio.com, one region | Off by default; opt-in, revocable |
| May never | Run an API-supplied command string through a shell | Silently encrypt devices | Borrow consumer account semantics | Bypass phone permissions or the screen lock |
Questions about Safeavio ServerGuard
Q01Can the console run any command it likes on my server?
No. The console sends typed actions, the agent runs them with an argument vector and no shell, and an API-supplied string never becomes command text. Security fixes are structured actions, re-validated at fix time.
Q02Which Linux distributions are supported?
Distributions with systemd. The installer can install Python 3 for you on apt-based systems such as Debian and Ubuntu; on others, install Python 3 first.
Q03Are agent updates signed?
Yes for the full Linux and macOS agents, which pin our root key and refuse an update that fails any check. Agents installed before 1 October 2026 pin no key and need one manual upgrade. The current Windows agent verifies signed manifests but has less runtime evidence than Linux yet.
Q04Is Windows supported?
There is a Windows agent, installed from PowerShell, but it is less tested, less tested, with signed update checks; see the current download and platform limits.
Q05How many servers are being monitored?
We do not publish customer numbers. The status page shows whether safeavio.com is reachable from your browser right now.
Capabilities in this product
Each capability page lists the attack families it covers and how far our coverage register says it goes.
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.
Wi-Fi and connection awareness on phones; port-scan visibility and firewall control on servers.
A risk score built from real device signals: root, screen lock, encryption, risky apps.
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.
Install the agent and see your server in minutes.
One command on the server, one API key in the console.