About Servor

Built by operators, for operators.

Servor is one console for the servers you already run: terminal, files, cron, monitoring, status pages. It is built so that the people who host it — us — can never touch your machines.

What
One console for the servers you already run.
How
The agent dials out. Nothing to open inbound.
Rule
Every command is signed in your browser.

SEC.01

What it is. What it is not.

A product is defined by what it refuses to do. Here is the line, so you can decide in a minute whether Servor fits.

In scope

  • ✓Web terminal, re-attachableclose the tab, come back to the same shell
  • ✓Command execution, recordedoutput · exit code · duration
  • ✓Official recipes150+, from nginx to fail2ban
  • ✓Monitoring and thresholds11 check types · hysteresis
  • ✓Public status pagescustom domain · automatic certificate
  • ✓Incidents and notificationsemail · Slack · Discord · signed webhook
  • ✓Hash-chained audit logwrite-only at the database level
  • ✓Public API/v1 · scoped bearer tokens

Out of scope

  • —Application deploymentno Git connection, no build, no releases
  • —Infrastructure provisioningyou bring the machines, Servor runs them
  • —Backup and restorenot managed by the product
  • —Multi-region checkschecks leave from a single vantage point
  • —Terminal session recordingplanned, not shipped
  • —SAML/OIDC SSO and bring-your-own AI keynot offered

SEC.02

Three principles, no exceptions.

They shape every screen and every line of the architecture.

P01

Secure by default

Zero-knowledge is the base architecture, not a slide. The passphrase, the derived key and the private key never leave the browser; every command is signed there before it is relayed. A fully compromised control plane can neither read your credentials nor forge an execution.

  • Argon2id
  • X25519
  • AES-256-GCM
  • Ed25519

P02

Explicit over implicit

Every command is classified by risk, approved under the mode you picked, then written down with its output and exit code. Guardrails reduce the risk of an automated operation; the operator stays responsible — and nothing happens that you cannot read back.

  • Ask / Plan / Auto
  • Chained audit log
  • Scoped API tokens
  • Command blocklist

P03

Built to last

We write the code we still want to maintain in ten years: a stable stack, no framework of the month, no dependency abandoned two releases later. Server operations are no place for novelty for its own sake.

  • Stable foundations
  • Type-safe end to end
  • No framework churn
  • Battle-tested

SEC.03

What ships today.

  • 01Agent on the machine, outbound only7 build targets
  • 02Re-attachable web terminalsurvives a control-plane restart
  • 03Recorded executionevery origin, one history
  • 04Recipes150+ official
  • 05Monitoring and alerts11 check types
  • 06Status pagescustom domain
  • 07Incidents and notificationsemail · Slack · Discord · webhook
  • 08Hash-chained audit logwrite-only
  • 09Public API/v1 · scoped tokens
  • 10AI copilotAsk · Plan · Auto

SEC.04

What comes next.

  • →Structured Plan mode
  • →Multi-region checks
  • →Terminal session recording
  • →Custom recipes
Read the changelog

Put your fleet on the deck.

Free for two servers, no credit card. Your first machine reports in within a minute.

Start free