How it works
A small agent on each machine. Everything else is yours.
Vantage has five parts, and all of them run on machines you own.
Machines and the app reach each other over your private network, usually a tailnet. A machine that cannot be reached directly can join through the relay.
What runs where
Five parts, each with one job.
| Part | Where it runs | What it does |
|---|---|---|
| Agent | Each machine you watch | Reads CPU, memory, disk, network, services, containers, ports and logs. Serves metrics. Runs only what the machine's own ceiling allows. |
| Gateway | Your observability host | Takes in logs and metrics from the agents, serves them to the app, and lets in only certificates the app enrolled. Runs beside Loki and Prometheus. |
| Watcher | Your observability host | Evaluates your alert rules and sends them to your phone, even when the app is closed. |
| App | Your Mac or Linux computer | The window you use. Holds your approvals, rules, sites and the audit, and keeps its key in the keychain or keyring. |
| Phone | Wherever you are | Receives alerts through ntfy or Telegram, and can open the read-only Web UI on your private network. |
Getting started
From a blank screen to a fleet in four steps.
- Install the agent. From the app over SSH, from your tailnet list, or by hand. It generates its own certificate and starts as a service.
- Pair. A code generated on the machine, valid once for 15 minutes, lets the app pin that certificate. The agent pins the app's key in return.
- Optional: add the observability server. Vantage installs Loki, Prometheus and optional Grafana on a machine you pick, behind the gateway. Logs and long-term graphs start filling in.
- Turn on alerts and your AI. Phone alerts need ntfy or Telegram. Your AI connects through the MCP server in the app.
Your data
What leaves your network.
What leaves your network
Nothing, unless you turn it on. There is no usage data, no analytics and no account with us. The things you can switch on, each off until you do, are listed below.
What stays on your machines
The app's data lives on your computer. Logs and metrics live on your observability host. The audit is written on the machine and in the app.
What you can switch on, and what each one sends
| Feature | What is sent, and to whom |
|---|---|
| Phone alerts with ntfy | The alert text to the ntfy server, which is ntfy.sh by default or a server of your own. |
| Telegram | The alert text to Telegram through your bot. |
| Webhook and email | The alert text to the address you enter, signed in the webhook case. |
| Ask Claude | The text you read and approve, to your own Anthropic API key or to Claude Code on your Mac. See Ask Claude. |
| Cloud accounts | Read-only list requests to AWS, Oracle Cloud or Google Cloud with a credential you provide. |
| Tailscale.com list | A read-only request for your device list. |
| Relay | Agent traffic through a listener on your own observability host. Nothing goes through us. |
Install Vantage.
Version 1.8.1 for Mac and Linux, signed by AVYR LABS. Free during launch.