Open-source, agent-first RMM (Remote Monitoring & Management) platform. Endpoints, agents, checks, alerts, scripts, and patches -- managed from one place, extensible through AI agents and an A2A-compatible API.
Get the platform running locally with three commands:
cp .env.example .env && make setupThen in a new terminal:
make build-agent && ./bin/oap-agent -register && ./bin/oap-agentOpen http://localhost:5173 and login with admin@oap.local / password.
What just happened:
- Docker Compose started Postgres, NATS, Dex, server, and web
- Database migrations created the schema (24 tables across all phases)
- The built-in check library was seeded (runs on server boot via
checklib.Seed) - The agent registered itself and is now publishing heartbeats
For the full walkthrough see docs/SETUP.md.
┌────────────┐ OIDC ┌──────────────┐
│ Web UI │ ───────────────▶ │ OAP Server │ ──┐
│ (React) │ │ (Go API) │ │
└────────────┘ └──────┬───────┘ │
│ │
pgxpool │ │ publish/subscribe
▼ ▼
┌──────────┐ ┌──────────┐
│ Postgres │ │ NATS │
│ +TSDB │ │ (mTLS) │
└──────────┘ └────┬─────┘
│
▼
┌────────────────┐
│ Agents │
│ (Go / Python) │
└────────────────┘
For the full component diagram (all phases) and ADRs, see docs/ARCHITECTURE.md.
- Server: Go 1.25 + chi + slog
- Web: React 19 + TanStack Router/Query + TailwindCSS + Monaco
- MCP Server: Go (separate module, stdio/HTTP)
- A2A Adapters: Python 3.12 (FastAPI, Pydantic) -- Anthropic, OpenAI, AutoGen, CrewAI, LangGraph, Semantic Kernel
- LLM Provider: Ozore AI (OpenAI-compatible)
- Data: PostgreSQL 16 + TimescaleDB + Alembic
- Messaging: NATS 2.10 with mTLS
- Auth: OIDC (Dex) + JWT sessions
- Policy: OPA (Open Policy Agent) with rego
- Observability: OpenTelemetry, Prometheus, Grafana
- Secrets: 5 pluggable backends (memory, env, Vault, Infisical, k8s CSI); AES-256-GCM team encryption lives in the separate
mcp-servermodule - CI: GitHub Actions
- Deploy: Docker Compose, Kubernetes (Helm)
| Phase | Sprint | Status | Description |
|---|---|---|---|
| 0 | 0.1 | Complete | Foundation: scaffold, CI, schema, NATS, OIDC |
| 0 | 0.2 | Complete | Agent CLI, registration, heartbeat |
| 1 | 1.1 | Complete | Check CRUD, built-in library, ingest |
| 1 | 1.2 | Complete | Alert rules, notifications, inbox |
| 1 | 1.3 | Complete | OPA policy engine, compliance scans |
| 1 | 1.4 | Complete | Patch approval, inventory, deploy |
| 1 | 1.5 | Complete | Scripts, 4-runtime executor, shell |
| 2 | 2.1 | Complete | A2A Gateway, JSON-RPC, EventBridge |
| 2 | 2.2 | Complete | 6 framework adapters, orchestration |
| 2 | 2.3 | Complete | Python-Go bridge, end-to-end wiring |
| 3 | 3.0 | Complete | Secret vault, A2A auth, OAuth |
| 4 | 4.0 | Complete | Settings, Monaco, dark mode, a11y |
| 5 | 5.0 | Complete | OTel, Prometheus, resilience, tests |
| 5 | 5.1 | Complete | Ozore AI integration |
| 6 | 6.0 | Complete | Live dashboard, multi-tenant, polish |
- Docker 20.10+ with Compose v2
- Go 1.25+ (for agent)
- Node 20+ (for web dev)
- Python 3.12 + uv (for migrations)
See docs/SETUP.md for detailed installation instructions.
Once running, you get:
- Dashboard -- Sites, agents, checks, alerts overview at http://localhost:5173
- REST API -- Full CRUD for all resources at http://localhost:8080
- Agent -- Cross-platform endpoint agent (Linux/macOS/Windows)
- OIDC auth -- Dex with two pre-configured users:
admin@oap.local/password(admin role)tech@oap.local/password(technician role)
- Health checks -- All services have healthcheck endpoints
- Check library -- built-in check definitions seeded on server boot
(
make seedis a documented no-op; extend it with a dedicated seeder if you need sample sites/agents/alert rules)
For active development with hot reload:
make up-devThis mounts your local source into containers. Server changes trigger Air hot-reload; web changes trigger Vite HMR.
make help # Show all available targets
make up # Start stack in background
make down # Stop stack
make logs # Tail logs from all services
make migrate # Run database migrations
make seed # Load sample data
make reset # Destroy volumes and start fresh
make test # Run all tests
make lint # Run linters
make build # Build server and web
make build-agent # Build the endpoint agent
make clean # Remove build artifactscmd/server Go HTTP API server
cmd/agent Endpoint agent (daemon + registration)
internal/ server-only Go packages (api, auth, config, db, events, schema)
pkg/ reusable Go packages (logger, agent, models)
py/ Python services, agents, and Alembic migrations
web/ React + Vite frontend
deploy/ docker-compose, NATS config, Dex config, postgres init
docs/ documentation
All source files must stay under a 500-line hard limit (300-line soft warning).
This is enforced by scripts/regression_check.py with 29 regression tests.
python3 scripts/regression_check.py --all # check everything
python3 scripts/regression_check.py --all --no-audit # skip audit tableKnown violations (4 files, in progress):
| File | Lines | Plan |
|---|---|---|
web/src/routes/patches/index.tsx |
1781 | Split into 4+ files (helpers, sub-components, custom hook) |
web/src/routes/patches/$jobId.tsx |
1135 | Split into 3+ files (helpers, sub-components, custom hook) |
mcp-server/internal/mcp/server.go |
888 | Extract setupHandlers() tool definitions into separate files |
web/src/routes/policies/$policyId.tsx |
586 | Finish right column JSX extraction (helpers + hook already done) |
- Setup -- 5-minute walkthrough
- Architecture -- system design, ADRs
- API -- REST endpoints
- Deployment -- production deployment guide
- Security -- auth, RBAC, secrets, audit
- Commercial -- licensing tiers, billing, SSO
- Changelog -- sprint-by-sprint history
- Contributing -- PR process and coding standards
- Discord -- Join for support
- GitHub Issues -- Bug reports
- Discussions -- Q&A
Business Source License 1.1 -- see LICENSE. Free for non-production use; commercial licenses available for production. See docs/COMMERCIAL.md for tier details.
Status: All sprints 0.1 -- 6.0 complete | Version: v1.1.0 | Last updated: 2026-01-15
If this project helped you, consider buying me a coffee:
