Fleet Agent

One agent. Every server you own.

The Sencai fleet agent is a small binary that brings a server under management: a cloud instance, a bare-metal box in your own rack, or the machine under someone's desk. Install it once, and it reports into your Sencai organisation - the same agent, the same fleet, regardless of who runs the hardware underneath.

What it does once it's running

Continuous monitoring of CPU, memory, disk, and host health, visible in your fleet dashboard.
Automated patch management, applied inside maintenance windows your team controls.
Software inventory with end-of-life detection, so ageing packages don't stay invisible.
Approval-gated runbooks - pre-approve an action once, and the agent can run it during an incident without anyone re-typing commands at 3 a.m.
A browser-based terminal session for people your organisation has actually granted access to - no SSH keys to distribute or lose track of.

Install

Run this on the server you want to enrol, as root. It detects the host's architecture, downloads and checksum-verifies the right binary, installs it as a systemd service, and enrols it with your organisation.

curl -fsSL https://storage.googleapis.com/sencai-agent-downloads/latest/install.sh \
  | sudo SENCAI_GATEWAY_URL=https://fleet.sencai.space SENCAI_TOKEN=<your-enrollment-token> bash

You'll need a gateway URL and a one-time enrollment token from your Sencai organisation's fleet settings before running this - the token ties the new host to your account and can only be used once.

Prefer to fetch the binary yourself?

Every release is published as plain, signed binaries - no installer required. Download the one for your architecture, verify it, and run it however your own tooling expects.

Each release also stays available under its own version path (for example /v0.1.0/) if you'd rather pin an exact build than track /latest/.

Verify before you run it

Checksum

Confirm the binary matches the published manifest:

curl -fsSLO https://storage.googleapis.com/sencai-agent-downloads/latest/checksums.txt
curl -fsSLO https://storage.googleapis.com/sencai-agent-downloads/latest/sencai-agent-linux-amd64
sha256sum -c checksums.txt --ignore-missing

Signature

Every release is signed with a key held in our cloud KMS, never on a laptop or a CI runner. Verify the binary against our published public key:

curl -fsSLO https://storage.googleapis.com/sencai-agent-downloads/latest/cosign.pub
curl -fsSLO https://storage.googleapis.com/sencai-agent-downloads/latest/sencai-agent-linux-amd64.sig
cosign verify-blob --key cosign.pub \
  --signature sencai-agent-linux-amd64.sig \
  sencai-agent-linux-amd64

It runs as root - here's exactly what that buys it

The agent installs as a systemd service running as root, because host-level monitoring, patching, and inventory genuinely need that access. That's worth stating plainly before you pipe anything into a root shell, not leaving it to a licence agreement nobody reads.

Reads host metrics, installed software, and OS/kernel version, and reports them to your organisation.
Installs OS patches inside the maintenance window your team configures.
Executes only the specific runbook actions someone in your organisation pre-approved - nothing arbitrary, and every run is logged.
Opens a terminal session on the host, only for people your organisation has granted that permission to.
Talks only to your Sencai organisation, over an authenticated, encrypted connection - the systemd unit itself is hardened (no new privileges, and it can only write inside its own configuration directory).

Removing it

Stop and disable the service, then remove the binary and its configuration directory:

sudo systemctl disable --now sencai-agent
sudo rm -f /usr/local/bin/sencai-agent /etc/systemd/system/sencai-agent.service
sudo rm -rf /etc/sencai-agent

Bring your first server under management

Create a Sencai organisation, generate an enrollment token, and run the install command above - most people are watching real metrics within a few minutes.

Start free trial Talk to us