What is Demerzel?
Demerzel is an operational source of truth for the servers, domains and certificates you run. A single lightweight agent observes each machine and reports what it sees; Demerzel turns that raw evidence into one clear answer to the question you actually care about: “What needs my attention today?”
How it works
- The agent observes. A single Go binary runs on each server. It only reads and summarizes — it never changes your systems, opens an inbound port, or takes commands.
- Demerzel records evidence. Every observation is stored as immutable fact. Nothing is overwritten, so the timeline of your infrastructure is always replayable.
- Demerzel derives meaning. From that evidence it computes a Health Score, surfaces prioritized Actions (disk pressure, pending security updates, expiring certificates, failed services, vulnerabilities…), and can alert you when something crosses a threshold.
What you get
- A dashboard that ranks your fleet by what needs attention, not by hostname.
- Inventory of servers, domains and TLS certificates, kept current automatically.
- Vulnerability tracking correlated against the packages actually installed.
- A security checklist per server, each item answered from evidence, with the command to fix it.
- Security incidents told from your own logs, and a dossier for every address that hit you.
- Active Defense: an optional warden that blocks attackers on your servers, within a policy only root can change — and, if you want, bans on one server applied on all of them.
- Notifications by email, webhook or Slack when a threshold is crossed.
- Teams with roles, invitations, and a full activity log.
- An opt-in, anonymised public status page and badge for a server.
Read-only by design. Demerzel is an observability and decision layer. The agent transmits facts outbound over HTTPS and never accepts remote commands. Blocking is the separate, optional warden's job; the one thing the agent relays to it — fleet decisions signed with your organization's key, if you enable them — the warden verifies against a key root explicitly trusted and applies only within its local policy. See Security & mTLS identity.
Next steps
Ready to connect your first server? Head to the Quickstart, then follow Installing the Agent.