Monitor
Complete inventory
Hardware, software and patch state of every machine.
Open source · AGPL-3.0
Monitoring, automation and remote access for your clients' devices
AI assistant integration via MCP and API
Inside OpenRMM
One console for the whole fleet
The same console for whoever looks after 20 machines or 5,000. Click each area to see the real screen.
Everything that needs you, on one screen
Fleet health, pending approvals and open alerts — including what the AI proposed.
Learn more- Devices online and offline, and failures in the last 24 h
- An approval queue with the AI's proposals
- Each technician's recent activity
- Ask the AI about the fleet in plain language
The AI proposes. You approve.
It investigates in plain language and prepares the job; nothing runs until someone approves it.
Learn more- Scripts from the AI are created awaiting approval
- Tasks, checks and policies from the AI are created disabled
- On its own, only read-only queries and scripts you released
- Everything recorded in the audit log
Bring your own AI, through MCP
Connect Claude or ChatGPT with a token or by signing in. It works within each technician's permissions, and you approve or revoke every application.
Learn more- Connect by token or by sign-in
- Each app can be approved or revoked
- Same scope, same approval lock and IP allowlist
- An API to integrate with the rest of your operation
Every machine, down to the detail
Hardware, software, storage and network, with remote access one click away.
Learn more- Installed software and patch state
- Disks, memory and network interfaces
- The device's checks and tasks
- Remote access straight from the machine's page
Bring someone into a remote session
Send a link and a one-time code to someone without an account. They join only when you accept, and only for as long as you set.
Learn more- An invite with a link and a 6-digit code
- View-only, or view and control
- Valid from 15 minutes to 24 hours
- The guest only joins when the technician accepts
Checks and tasks on each machine
Every device shows the monitoring and scheduled tasks that apply to it — its own and those its policies bring — with their state there.
Learn more- Disk, memory, CPU, ping and services
- One alert per problem, which closes itself on recovery
- Acknowledge or silence alerts
- Email notification for technicians
Organised by company, site and department
Tick devices to move or delete them together. Each technician sees only their own scope.
Learn more- A company, site and department hierarchy
- Bulk actions
- Each technician sees only their own scope
- New machines inherit the policies
Patches on your schedule
Approve by classification, set maintenance windows and follow every endpoint.
Learn more- Manual or policy approval
- Installation inside maintenance windows
- Restart postponed while the user is connected
- Status per endpoint
How the AI works
The AI investigates and prepares. You decide what runs.
Follow a real ticket from start to finish. A client's print queue got stuck and the AI found the cause. The decision to run anything is yours.
- 1Alert
A check fails and opens a single alert, with no duplicates.
- 2Investigation
The AI queries the device in read-only mode.
- 3Proposal
It writes the script, the target and the reason. The job is created paused.
- 4Your decision
A technician with permission over that client approves or refuses.
- 5Audit
Who proposed it, who approved it, what ran and the result.
It runs only what you allowed. On its own, read-only queries and scripts an administrator released in advance; everything else it proposes.
The lock is in the database. Tasks and checks created by the AI are created disabled and cannot be enabled without review.
Patches only with human approval. The AI can install only what a person has already approved, and there is no tool for it to approve patches.
It respects the technician's scope. The AI only sees what the technician using it can see. Moving or deleting machines requires approval in the pending-operations queue.
NW-CD-PRINT · Windows ServerAlert openAI investigatingAwaiting approvalYour decisionResolvedRefused
14:02:11 ● Check "Print queue" failed
14:02:11 23 jobs stuck for 40 min on NW-CD-PRINT
14:02:12 Alert #482 opened · email sent to ana.tech
14:03:02 AI querying NW-CD-PRINT (read-only)
14:03:03 Get-Service Spooler → Running, not responding
14:03:04 Queue: 23 jobs · the oldest in error for 41 min
14:03:05 PrintService log: corrupted job 1187 jammed the queue
14:03:06 AI probable cause: corrupted job in the spool
Job proposed by the AI · target NW-CD-PRINT · state: awaiting approval
Reason: corrupted job 1187. Clearing the spool frees the other 22.
Stop-Service -Name Spooler -Force
Remove-Item "$env:SystemRoot\System32\spool\PRINTERS\*" -Force
Start-Service -Name Spooler
14:04:30 Nothing has been executed so far. The AI cannot continue on its own.
14:04:30 Approving requires permission over the client Northwind / Distribution Center.
14:05:12 ✓ ana.tech approved job #2291
14:05:13 Running on NW-CD-PRINT…
14:05:16 Completed · exit code 0 · 22 jobs printed
14:06:10 ✓ Check back to normal · alert #482 closed itself
Audit log
14:02 system opened alert #482
14:03 AI proposed job #2291 (requested by ana.tech)
14:05 ana.tech approved job #2291
14:05 agent ran the job · exit 0
14:06 system closed alert #482
14:05:12 ✕ ana.tech refused job #2291
14:05:12 Nothing was executed on NW-CD-PRINT
14:05:12 Alert #482 stays open for another treatment
Audit log
14:02 system opened alert #482
14:03 AI proposed job #2291 (requested by ana.tech)
14:05 ana.tech refused job #2291
Features
Everything an RMM needs, with no limited edition
There is no "community" version with features cut out. The software is the same on Cloud and self-hosted.
Monitor
Health checks
Disk, memory, CPU, ping and services, with thresholds per policy.
Monitor
Alerts without the noise
One alert per problem. It closes itself when the problem goes away and can be acknowledged or silenced.
Monitor
Customizable dashboard
Fleet health, approvals, alerts and recent activity on one screen.
Automate
Inherited policies
Group checks and routines by company, site or department. New machines inherit everything.
Automate
Scheduled tasks
Routines per device or per policy, with an execution history.
Automate
Scripts and jobs
Reusable scripts sent to the agents. Approved jobs wait for the machine to return if it is offline.
Automate
Update management
Windows, Linux and macOS. Manual or policy approval, inside maintenance windows.
Automate
AI with a brake
Writes scripts and prepares jobs that wait for approval. On its own it runs only read-only queries and scripts an administrator released in advance.
Access
Remote access in the browser
Remote desktop, terminal and file transfer through the agent itself, with no other program to install.
Access
Guest sessions
A link and a 6-digit code, view-only or control, valid from 15 min to 24 h.
Access
MeshCentral and RustDesk
Already use one of them? Open the session straight from the OpenRMM console, with your own server.
Protect
Roles and scope
Ready-made or custom roles, and access limited to a company, site, department or machine.
Protect
SSO and 2FA
Single sign-on through OpenID Connect, with MFA required from the provider, and TOTP 2FA for local accounts.
Protect
Tamper-proof audit trail
An append-only log. Database triggers refuse changes and a hash chain shows tampering.
Protect
Isolated instance
Its own database, secrets, backups and domain for each Cloud customer.
Integrate
MCP server
Connect Claude, ChatGPT or any MCP client with the same permissions.
Integrate
API
Integrate OpenRMM with your PSA, billing or your own scripts.
Integrate
Your own AI key
OpenAI, Anthropic or any compatible provider. No middleman.
Integrate
Multi-client
Companies, sites and departments, with bulk actions.
Device-based pricing
One isolated instance per customer. Choose the capacity you need and the progressive discount is calculated automatically.
You run OpenRMM on your own servers, free (AGPL). The plan pays for our support, at 60% of the Cloud price.
Monthly price
US$94.00/month
Includes up to 100 devices
Progressive discounts are applied automatically as your fleet grows.
devices
Choose from 1 to 5,000 devices. Above that, our sales team will prepare a dedicated quote.
Dedicated instance and database
Your own subdomain with TLS
Daily backups
Unlimited remote access
Support with an 8-hour response, 24/7
Runs on your own servers
Support with an 8-hour response, 24/7
Help with installation and upgrades
Security advisories before they are published
Help migrating to the Cloud when you want
Priority for your bugs and suggestions
Custom capacity
More than 5,000 devices?
Tell us about your fleet. Our team will size the infrastructure and reply by email.
The AI model is not included. The assistant and MCP are included with the service, but the model is yours to bring: connect OpenAI, Anthropic or any provider with an OpenAI-compatible API, using your own API key, billed to you by that provider. We never resell tokens, and your conversations go straight from your instance to the provider, with no middleman of ours.
Subscribe
Your instance is ready in a few minutes and the URL arrives by email.
Security
How OpenRMM protects your access
An RMM has administrative access to every machine it manages. That is why each guarantee below is in the public code, and not only in this text.
Public code
All of the code is on GitHub under AGPL-3.0. Anyone can review, audit and contribute.
Mandatory human approval
Scripts from the AI are created awaiting approval. Tasks, checks and policies it creates are created disabled, and a database constraint prevents enabling them without review.
Isolated instance
Each Cloud customer has its own namespace, database, secrets, backups and domain, with TLS and a daily backup.
An audit trail that cannot be erased
An append-only log. Database triggers refuse changes and deletions, and a hash chain reveals any rewrite.
Roles and scope
Ready-made or custom roles, checked on every route. Scope by company, site, department or machine also applies to the AI.
Strong sign-in
SSO through OpenID Connect with MFA required from the provider. TOTP 2FA for local accounts, with single-use recovery codes.
Protected secrets
Passwords with bcrypt, tokens stored only as SHA-256 hashes and configuration secrets encrypted with AES-256-GCM.
MCP with a padlock
Revocable tokens, its own permission and an IP allowlist. A limit of 60 calls per minute.
Signed updates
Agent binaries can be signed with Ed25519 and verified before every update.
Want the technical details?
See every security layer
The security overview in the documentation explains each layer, including the known limitations. Found a vulnerability? Report it privately to contact@openrmm.io, without opening a public issue.
Community
Built in public
Follow what is being done, ask for features and talk directly to the people who write the code.
Frequently asked questions
Before you ask
Did not find your question? Ask on Discord or write to contact@openrmm.io.
Is OpenRMM really open source?
Yes. The complete code is on GitHub under the AGPL-3.0 license. You can read it, audit it and run it on your own servers without paying for a license.
Is there a free version with features cut out?
No. The software is the same on Cloud and self-hosted. On Cloud you pay for hosting and support. Self-hosted, the software is free and the paid plan covers only support (60% of the Cloud price).
Can the AI run anything on its own?
Only for roles granted it (the built-in administrator is), and only what was allowed in advance: read-only queries on a device, and library scripts an administrator released, bound to their exact content. Reboots, installs, deletions, accounts and security settings can never be released. Everything else it writes is created awaiting approval; tasks and checks it creates are created disabled, and the database prevents enabling them without review. One switch in the settings pauses it all, and everything goes into the audit log.
Do I pay for the AI separately?
The AI model is not included. You use your own key from OpenAI, Anthropic or any provider compatible with the OpenAI API, and pay the provider directly. OpenRMM does not resell tokens and does not sit between you and the provider.
Where is my data on Cloud?
Each customer has a dedicated instance, with its own namespace, database, secrets, backups and domain. Nothing is shared with other customers. Instances have TLS and a daily backup.
Which operating systems are supported?
Windows, Linux and macOS, with inventory, monitoring, remote desktop, terminal and update management on all three. On Linux, remote desktop requires Xorg. On macOS, the agent needs the Screen Recording and Accessibility permissions.
Is there SSO and two-factor authentication?
Yes. Single sign-on uses OpenID Connect and can require MFA from the provider. Local accounts can use TOTP 2FA, with single-use recovery codes.
I already use MeshCentral or RustDesk. Can I keep using it?
Yes. OpenRMM opens MeshCentral and RustDesk sessions straight from the console, using your own servers. Native remote access stays available alongside.
How long does it take to get started?
The Cloud instance is ready a few minutes after payment, and the URL arrives by email. If you want to look first, the live demo needs no sign-up.
How does support work?
Both plans include 24/7 support with a response within 8 hours. Self-hosted with support also includes help with installation and upgrades, early security advisories and priority on bugs and suggestions.
Which payment methods do you accept?
International card in US dollars (automatic renewal), Bitcoin and USDT (paid monthly), and Mercado Pago in reais, by card, Pix or boleto. The annual plan has a 10% discount.
Can I limit what each technician sees?
Yes. Each technician's access can be limited to a company, site, department or machine. The rule applies to reading, writing and also to what the AI can see and propose.
Can I start self-hosted and move to Cloud later?
Yes. The self-hosted plan with support includes help migrating to Cloud.
I have more than 5,000 devices. Now what?
We prepare a proposal with capacity sized to your fleet. Write to contact@openrmm.io with the size of your fleet and your environment.