An AI sysadmin that guards your Linux servers.
Kernelward connects to your hosts over SSH, audits every one of them, explains what is wrong in plain words, and fixes it only after you approve. Built for teams that run Linux without an SRE.
Agentless. Read-only until you say otherwise.
Why Kernelward
Most Linux servers have no SRE.
They belong to small SaaS teams, agencies, MSPs, labs and hosting customers, and they are managed by SSH and memory.
Alerts say that something broke, not what to do.
Monitoring tells you a disk is at 91 percent. Kernelward tells you the journal grew 14 GB since Tuesday, why, and how to fix it safely.
Runbooks live in one person's head.
Kernelward writes down what it found, what it changed and why, so the next person can follow.
How it works
-
Connect
Add Kernelward's public key to the hosts you choose. There is no agent to install, and nothing runs as root until you allow it.
-
Review
Every host is audited on a schedule. Findings arrive ranked by risk, with the evidence and an explanation you can hand to anyone on the team.
-
Approve
Each fix is proposed as the exact commands it will run. A dry run comes first. You approve, it runs, and a receipt with a rollback plan is kept.
What it watches
- Security updates and CVEs
- Pending patches ranked by exposure on that host, not by a generic score.
- End-of-life distributions
- Hosts still on releases that no longer get fixes, with an upgrade path.
- TLS certificates
- Expiry across every service, plus the renewal jobs that quietly stopped.
- Disks and inodes
- Growth trends and the directories responsible, before the pager goes off.
- systemd units
- Failed, flapping and disabled services that should be running.
- SSH, sudo and firewall
- Password logins, stale keys, open ports and sudo rules nobody remembers adding.
- Drift
- Configuration that changed since the last audit, and which user changed it.
- Logs
- Repeated errors, brute-force attempts and kernel messages worth a look.
The ward in Kernelward
- Read-only until you say otherwise. The default key can inspect, not change.
- Nothing runs without a proposal. You see the exact commands before anything executes.
- Allowlisted commands only. Kernelward runs what your policy permits and refuses the rest.
- Dry run first. Every fix is rehearsed, and the rehearsal output is part of the proposal.
- A receipt for every change. Who approved it, what ran, what changed, and how to undo it.
- Revocable on any host, any time. Kernelward connects with its own key and never asks for root passwords.
Who it is for
Kernelward is for the people who keep Linux running without a platform team: the founder who is also the ops person, the two-person infrastructure team at a growing SaaS, the MSP responsible for fifty customers' servers, the lab that inherited a rack. If you have between five and five hundred hosts and no SRE, it is built for you.
Get early access
Kernelward is in private development. Leave your email and we will write when your invite is ready. One email, no newsletter.