Questions, answered plainly.
Short answers about what Vantage does, what it can and cannot do, and where your data stays.
Q1. What is Vantage?
Vantage is an app for Mac and Linux that shows every machine you look after on one screen: servers, Raspberry Pis, cloud instances and laptops. For each one you see whether it is up, how busy it is, what is failing and what changed. A small agent on each machine answers the app. An optional observability server keeps logs and longer graphs. You can let an AI assistant read the fleet, and it cannot change anything unless a machine's own settings and you both allow it.
Q2. What does it cost?
It is free during launch. Pricing will be announced. Nothing in the app asks for payment or an account today.
Q3. Which computers does it run on, and what do I need?
- The app: macOS 10.15 or newer (Apple silicon and Intel in one installer; the widget needs macOS 14), or Linux with a
.deb,.rpmor AppImage on arm64, and a.debor.rpmon x86_64. - The agent, on each machine you watch: Linux on x86_64, aarch64 or 32-bit ARM (glibc 2.28 or newer), or macOS on Intel or Apple silicon. Windows is not supported.
- A way to reach each machine on TCP port 9736: the same network, a VPN or a tailnet.
- Optional: a machine with Docker for the observability server.
- Updates: turn on "Check for updates" in Settings > About and the app can download and install a new version, after checking its signature. It is off until you turn it on.
Q4. How do I add a machine?
Press Add machine on the Fleet and pick the way that fits. Over SSH is the easiest: Vantage copies the agent over, starts it as a service, pairs with it and pins its certificate. The other ways are this Mac, machines from your tailnet, pasting what sudo vantage pair printed, copying the files by hand, and the relay for machines that cannot be reached directly. If you are not sure, pick "A server I can SSH into".
Q5. What does sudo vantage pair do?
Run on a machine that already has the agent, it prints the machine's address, a one-time code and its certificate fingerprint, with a QR code in the terminal. The code works once, for 15 minutes. Paste what it printed into Add machine; Vantage checks the fingerprint and pins it, so nothing can pretend to be that machine later. Run the command again for a fresh code.
Q6. Do I need Tailscale or a tailnet?
No. To see the fleet, any address you can reach on port 9736 works. The observability server and the Web UI listen on a tailnet address only, so they are never on your local network or the internet; those two need a tailnet (Tailscale or Headscale). Add machine can list the machines of a tailnet for you.
Q7. How do I add a machine behind a router or firewall?
Use the relay, which is off by default. In Settings > Relay give an address that reaches your observability server from the internet, forward its port, tick that you understand, and press Update on the observability server. Then Add machine > "It cannot be reached directly" saves an install kit. Carry the folder to the machine and run sudo ./install-agent.sh --relay-kit . there. The machine dials out; the relay only accepts agents and asks every client for a certificate.
Video: Your fleet on your phone, and machines behind a router (coming soon to our channel)
Q8. How do sites and laptops work?
A site is a place, such as an office, a warehouse or a cloud account. The Fleet groups machines by site, and rules, updates and quiet hours can follow a site, including its time zone. A laptop sleeps, shuts or leaves the network, so its silence is not an outage: it shows as Asleep and does not page you. If it comes back after a crash you get "Stopped without shutting down". Choose Server or Laptop when you add a machine; you can change it later.
Q9. Will I get alerts when the app is closed?
Yes, if you have set up the observability server and a phone channel. A small watcher on that server evaluates the same rules and sends to ntfy, Telegram, a webhook or email. It needs the server's machine to be on. With the app open, alerts also show on the Alerts screen and as macOS notifications.
Q10. How do I set up ntfy or Telegram?
ntfy needs no account: in Settings > Notifications press Set up ntfy, which makes a private topic and shows a QR code. Scan it in the ntfy app and press Test send. For Telegram, press Open BotFather, make a bot, paste its token and press Save and check token, then Find my chat. Each channel has its own On/Off switch and a minimum severity.
Q11. What is the health digest?
A short summary of every machine sent to your phone, by default at 09:00 and 21:00. You can change the times, switch it off, or press Send one now. Laptops that are asleep say asleep, not down. It goes to ntfy or Telegram only, so one of them must be on first.
Q12. Can I set quiet hours or snooze an alert?
Yes. A rule has quiet hours, for example 22 to 7, and they follow each machine's site time zone (a machine with no site uses your Mac's). On any alert you can acknowledge it or snooze it, and the notification itself offers Acknowledge and Snooze for an hour.
Q13. What are the three locks?
- A ceiling each machine sets for itself, in
/etc/vantage/config.tomlon that machine. The dashboard shows it and can never raise it. - Your approval. Running a command, updating an agent and renaming a machine ask you in the app first; silence is a refusal.
- A complete record. Every command is written to the machine's own audit file and to the app's AI activity list, with who asked.
Watch: Let AI read your servers without letting it break them →
Q14. What can an AI assistant do, and what can it not?
It can read: the fleet, metrics, logs, alerts and what changed. It can restart a service or container, but only where that machine's ceiling allows. It can add a note and acknowledge an alert. Running a command, updating an agent and renaming a machine need your approval each time. It cannot raise a ceiling, add or remove a machine, or install anything. Text that machines write, such as log lines, reaches it marked as data to read, not instructions to follow.
Watch: Let AI read your servers without letting it break them →
Q15. Can Vantage fix things by itself?
Only with a playbook you wrote and approved. A playbook is tied to an alert rule and has up to five steps: restart a service, restart a container or run one command. Press Preview to see exactly what would run, on which machine, with the machine's ceiling verdict. "Ask me every time" asks before each run; "Run by itself" needs your name and an approval, and saving a change clears it. The app must be open for a playbook to run.
Watch: Fix a full disk automatically, with steps you approved →
Q16. What does Ask Claude send?
Nothing, until you turn it on in Settings > AI; it is off by default. When you press Ask Claude on an alert, Vantage shows the exact text first: the rule, the reason, the machine's label, recent numbers and at most a few log lines, with secrets removed. It is sent only when you press Send, and only those bytes. Credentials, fingerprints and keys are never part of it. The backend is your own Anthropic API key or Claude Code on your Mac.
Watch: Let AI read your servers without letting it break them →
Q17. What does Connect your AI share?
Vantage includes a local program, vantage-mcp, that your AI client starts on your Mac. It reads the app's own database, and its calls go through the same checks as the app's. Whatever the AI asks for goes to the AI service you use, so connect only a client you trust with that. A client on another computer needs its own token, shown once, which you can revoke. Every call shows under AI activity.
Watch: Let AI read your servers without letting it break them →
Q18. Can my team use it?
Yes. Settings > Team lets an owner invite people as a viewer (looks only) or an operator (can act, within each machine's ceiling). The invite is shown once and lasts 72 hours. The person joins from their own Vantage, you both read out a fingerprint, and you accept only if they match. A member cannot add or install machines. Removing someone cuts them off at the gateway at once and from each machine as it answers; a machine that is off is told again every 10 minutes.
Video: Add a teammate, with a fingerprint check (coming soon to our channel)
Q19. What is the Web UI?
A read-only view of the fleet for a phone or another computer on your tailnet. Switch it on in Settings > Web UI, press Pair a browser, and scan the QR code or type the one-time code. The browser warns about the certificate the first time, so compare its fingerprint with the one shown in the app. From the Web UI you can look, acknowledge and snooze, and nothing else.
Video: Your fleet on your phone, and machines behind a router (coming soon to our channel)
Q20. What leaves my network?
Nothing, unless you turn it on. The things you can turn on are ntfy and Telegram (alert text goes to those services), email and webhooks (to your server), Ask Claude (the text you approve, to Anthropic or to Claude Code), cloud import (read-only calls to your cloud provider) and Tailscale.com listing. Each one says what it sends where you switch it on. Vantage has no analytics and no account.
Q21. What does the agent read on a machine, and what ships?
The agent reads CPU, memory, disk and network numbers, temperatures and GPUs, which services and containers run, the busiest processes by name, and an inventory of what is installed. Log lines are read and shipped to your observability server only if you set that up and the machine's owner has not switched shipping off; secrets are masked on the machine first. On a Mac, log files in a home folder are read only if you list them. The agent never runs a command unless the ceiling allows it.
Q22. How do I delete a machine's data?
Forget in the Fleet removes the machine from your app and tells it to stop sending logs; the server refuses its logs from then on. It does not uninstall the agent from the machine. Logs and metrics already on the observability server stay for the days you chose when you installed it (logs 7, 14 or 30 days; metrics 30, 90 or 365). To delete all of it now, uninstall the observability server with "Uninstall and delete the data".
Q23. macOS warns me when I open the app, or asks about the keychain or Local Network
The Mac build is signed by AVYR LABS but not notarized yet, so macOS warns on the first launch. Open System Settings > Privacy & Security, scroll to Security and press Open Anyway (on older macOS you can Control-click the app and choose Open instead). On first launch, or after you install a newer build, macOS may also ask whether Vantage can use its key in your keychain: allow it, because the key is how the machines know the app. If pairing or Ping fails with a network error, switch Vantage on in System Settings > Privacy & Security > Local Network (it is listed only after it has tried once).
Q24. The pairing code is wrong or has run out
A code works once, for 15 minutes. On the machine run sudo vantage pair for a new one and paste the whole block again. If sudo vantage pair is not found, the agent there is an older build, or sudo does not search the folder it is in; run the full command shown on the Pairing command step.
Q25. A machine shows offline, or the relay is not listening
Offline: check that the machine is on, that its agent runs and that port 9736 is open from your Mac; on a Mac also check the Local Network switch above. A machine that changed address (DHCP) needs sudo vantage pair again, or a fixed address in your router. A laptop that is asleep is not offline. The relay: Saving in Settings > Relay changes the setting only, so press Update on the observability server; the panel shows the gateway's reason while it is not listening. Check that the port is forwarded and the address reaches the server from the machine's network.
Watch: Add a Linux server with one command →
Video: Your fleet on your phone, and machines behind a router (coming soon to our channel)
Prefer to watch? See the videos. Not answered here? Contact us.