{"slug": "show-hn-openrmm-open-source-rmm-where-the-ai-proposes-and-a-human-approves", "title": "Show HN: OpenRMM – open-source RMM where the AI proposes and a human approves", "summary": "OpenRMM, an open-source, self-hosted remote monitoring and management (RMM) platform, launched with a native AI assistant that proposes scripts and actions in plain language but requires human approval before anything runs on an endpoint. The project positions itself against closed-SaaS AI-copilot RMMs such as Atera, SuperOps, Acronis and Neo Agent by letting operators connect any OpenAI-compatible endpoint, including local models, so fleet data can stay on their own infrastructure. OpenRMM ships a single cross-platform Go agent for Windows, Linux and macOS, an MCP server with OAuth 2.1 and scoped revocable tokens, and an append-only audit trail backed by triggers, a non-owner database role and a hash chain.", "body_md": "An **open-source, self-hosted RMM** (Remote Monitoring & Management) with a\n**native AI assistant**: a modern console, a chat that connects to any AI model\nvia API (BYO-model, including local/private models), its own cross-platform\nagent, and pluggable remote access.\n\nAsk the assistant in plain language — *\"install 7-zip on the finance group\"*,\n*\"configure printer model X at IP Y on host Z\"*, *\"generate a report of offline\ndevices\"* — and it inspects the fleet, **proposes** the scripts/actions, and a\nhuman approves before anything runs on an endpoint.\n\nMost AI-copilot RMMs (Atera, SuperOps, Acronis, Neo Agent) are **closed SaaS**:\nthe fleet's data goes to the vendor's cloud and to the model the vendor picked.\nOpenRMM is an open-source, self-hosted RMM built around three choices:\n\n- **Any model** — any OpenAI-compatible endpoint, including a local one, so\ncommand data can stay on your own infrastructure.\n- **A human approves every action** — the AI reads and proposes; nothing runs on\nan endpoint until someone approves the job.\n- **Privacy first** — your server, your database, your audit trail.\n\n- **Own Go agent** — single cross-platform binary (Windows/Linux/macOS), no runtime;**self-updates** from the server (`make agent-dist` for development; signed,\nversioned release artifacts are required for production).\n- **AI chat with tool-calling** — the model reads fleet state and proposes actions.\n- **Guardrails by design** — AI never executes directly; every action is a job that\na human approves, with dry-run preview and an append-only audit log.\n- **Pluggable remote access** —`native` (built-in relay + media sidecar,\ntile-delta codec; Windows and Linux/Xorg including the login screen, and\nmacOS; file transfer, chat with the user, clipboard both ways, display\nselection, Ctrl+Alt+Del on Windows, and a notice of who else is connected),`terminal` (an**elevated** PTY/ConPTY shell in the browser, gated by`devices.terminal` ),`meshcentral` , and`rustdesk` (opens your own RustDesk\nclient on the device's id, read on demand; off by default) — all behind one\ninterface. Swap freely.\n- **BYO AI model** — any OpenAI-compatible endpoint (OpenAI, Ollama, vLLM, …).\n- **Classic RMM, too** — Client→Site→Agent hierarchy, RBAC users, script library,\nmonitoring checks + alerts, scheduled tasks, and inherited policies. The agent\ninstalls as a system service and reports rich inventory.\n- **Access control** — built-in`admin` /`tech` /`readonly` roles plus custom roles,\noptional**TOTP 2FA** ,**single sign-on** through any OpenID Connect provider\n(with MFA requirements checked on the provider's signed claims), and**per-user access scope** (Company/Site/Department/device) enforced on read,\nwrite, remote access, and the AI/MCP surface. AI/MCP\ntools are filtered by the caller's permissions and scope. AI reports stay in chat\nwith a client-side**CSV download** —\nnever written to an endpoint.\n- The built-in `readonly` role is not purely observational: it includes`devices.remote` (remote desktop), but not file transfer or terminal. Create a\ncustom role without`devices.remote` when screen access is not acceptable.\n- **MCP server** — connect external AI (Claude, ChatGPT, …) to manage the fleet,\nreusing the same permission-filtered tools and the same human-approval guardrail.\nSecured with scoped revocable tokens +`mcp.use` + an IP allowlist, or with the\nbuilt-in**OAuth 2.1** server so cloud connectors sign in natively (with an\napplications screen to approve and revoke them); deploy privately (Tailscale)\nor behind TLS.\n- **Alert email** — per-user subscriptions, a durable outbox with retries, and\nyour own SMTP relay (or an operator's shared service, to confirmed addresses only).\n- **Append-only audit trail** — triggers, a non-owner database role and a hash\nchain; searchable, exportable as CSV, and queryable by the assistant.\n- **Six languages** — the console is fully translated into English, Portuguese\n(Brazil), Spanish, German, Japanese and Simplified Chinese.\n\n```\n      bundled React UI ── REST/WS API ── AI chat (tool-calling loop)\n                               │\n                 ┌─────────────┼──────────────┐\n                 │             │              │\n            agent hub     job queue      remote relay\n              (WS)        (Postgres)    (native provider)\n                 │\n        ┌────────┴─────────┐\n        │   Go agent (endpoint)   │  +  remote client (native / MeshCentral)\n        └──────────────────┘\n```\n\nFull detail: [`docs/01-architecture.md`](https://github.com/openrmm-project/openrmm/blob/main/docs/01-architecture.md).\n\n**Self-host with the published images.** Use one Linux server, three DNS names and\nDocker Compose. Caddy obtains the certificates, and the release images come\nfrom `ghcr.io/openrmm-project`:\n\n```\ngit clone https://github.com/openrmm-project/openrmm.git && cd openrmm/deploy\ncp .env.example .env            # set the hostnames and the release key\nops/provision-secrets.sh\ndocker compose up -d\n```\n\n[deploy/QUICKSTART.md](https://github.com/openrmm-project/openrmm/blob/main/deploy/QUICKSTART.md) covers what to put in `.env`, the\nfirst administrator, adding devices and upgrades. The full runbook (backups,\npoint-in-time recovery, standby) is\n[deploy/README-production.md](https://github.com/openrmm-project/openrmm/blob/main/deploy/README-production.md).\n\n**Run from source (development):**\n\n```\ncp .env.example .env          # replace RMM_ADMIN_TOKEN with a generated value\ndocker compose up -d          # postgres + server\n# or run locally:\nexport RMM_ADMIN_TOKEN=\"$(openssl rand -hex 32)\"\nmake build && ./bin/rmm-server\n```\n\nCreate the first console user (the console signs in with a password or SSO, not with the admin token):\n\n```\ncurl -X POST localhost:3005/api/auth/bootstrap \\\n  -H \"Authorization: Bearer $RMM_ADMIN_TOKEN\" -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"admin\",\"password\":\"<12+ characters, an uppercase letter and a symbol>\"}'\n```\n\nThen enroll an agent:\n\n```\n# 1. create an enrollment token\ncurl -X POST localhost:3005/api/enroll-tokens \\\n  -H \"Authorization: Bearer $RMM_ADMIN_TOKEN\" -d '{\"uses\":1}'\n\n# 2. enroll once, then start the long-lived agent without the bootstrap token\n./bin/rmm-agent -server ws://localhost:3005/ws/agent -enroll-token <TOKEN> -enroll-only\n./bin/rmm-agent -server ws://localhost:3005/ws/agent\n```\n\nThe development Compose example uses its frontend/proxy on port `3005`; a directly-run server\nuses port `8080` instead.\n\nProduction is intentionally different: provision file-backed secrets with\n`deploy/ops/provision-secrets.sh`, terminate TLS at a trusted edge, and keep the\nthree published listeners bound to loopback. Agent installation requires HTTPS,\nOpenSSL 3, and `--update-public-key`/`-UpdatePublicKey`; insecure installation is\navailable only through explicit lab mode. See\n[`deploy/README-production.md`](https://github.com/openrmm-project/openrmm/blob/main/deploy/README-production.md).\n\nSee [`docs/02-getting-started.md`](https://github.com/openrmm-project/openrmm/blob/main/docs/02-getting-started.md) for the full walkthrough.\n\nRead it at **[docs.openrmm.io](https://docs.openrmm.io)**, with search and a sidebar by\ntopic. The site is built from the files below on every change to them.\n\n| Doc | Contents | \n|---|---|\n| [00-overview](https://github.com/openrmm-project/openrmm/blob/main/docs/00-overview.md) | Vision, scope, what's built vs planned | \n| [01-architecture](https://github.com/openrmm-project/openrmm/blob/main/docs/01-architecture.md) | Components, data flow, package layout | \n| [02-getting-started](https://github.com/openrmm-project/openrmm/blob/main/docs/02-getting-started.md) | Run the server, enroll an agent, run a job | \n| [03-database-schema](https://github.com/openrmm-project/openrmm/blob/main/docs/03-database-schema.md) | Tables and relationships | \n| [04-api-reference](https://github.com/openrmm-project/openrmm/blob/main/docs/04-api-reference.md) | Every REST endpoint | \n| [05-agent-protocol](https://github.com/openrmm-project/openrmm/blob/main/docs/05-agent-protocol.md) | The agent WebSocket protocol | \n| [06-ai-chat](https://github.com/openrmm-project/openrmm/blob/main/docs/06-ai-chat.md) | Tool-calling loop, tools, prompts | \n| [07-guardrails-security](https://github.com/openrmm-project/openrmm/blob/main/docs/07-guardrails-security.md) | Approval, audit, threat model | \n| [08-remote-access](https://github.com/openrmm-project/openrmm/blob/main/docs/08-remote-access.md) | The native (desktop + file transfer), terminal, and MeshCentral providers | \n| [09-roadmap](https://github.com/openrmm-project/openrmm/blob/main/docs/09-roadmap.md) | Phased plan toward a complete RMM | \n| [10-monitoring-policies](https://github.com/openrmm-project/openrmm/blob/main/docs/10-monitoring-policies.md) | Org hierarchy, RBAC, scripts, checks, tasks, policies, alerts | \n| [11-mcp](https://github.com/openrmm-project/openrmm/blob/main/docs/11-mcp.md) | MCP server — connect external AI (Claude, ChatGPT) securely | \n| [12-native-remote-fork](https://github.com/openrmm-project/openrmm/blob/main/docs/12-native-remote-fork.md) | Historical: the abandoned RustDesk-fork plan (superseded by the homegrown engine in 08) | \n| [13-security-rollout](https://github.com/openrmm-project/openrmm/blob/main/docs/13-security-rollout.md) | Release/signing gates, strict installers, TLS/secrets, enforcing CSP, remaining limits | \n| [14-frontend-design-brief](https://github.com/openrmm-project/openrmm/blob/main/docs/14-frontend-design-brief.md) | Frontend brief: product context, screens, design language, full API contract | \n| [15-reports](https://github.com/openrmm-project/openrmm/blob/main/docs/15-reports.md) | Fleet inventory reports (software/hardware/machines) by client/site/department, scoped, CSV export, AI tool | \n| [16-patch-management](https://github.com/openrmm-project/openrmm/blob/main/docs/16-patch-management.md) | Patch inventory, approval/classification, policies (windows/auto-approve), reboot orchestration, compliance | \n| [17-mcp-oauth](https://github.com/openrmm-project/openrmm/blob/main/docs/17-mcp-oauth.md) | MCP OAuth 2.1 — OpenRMM as its own Authorization Server so cloud clients (Claude web, ChatGPT) connect natively | \n| [18-update-signing-runbook](https://github.com/openrmm-project/openrmm/blob/main/docs/18-update-signing-runbook.md) | Operator playbook for signed auto-update: key custody, cutting a signed release, publishing to `/dl/` , and staged key rotation via the trusted key set (no reinstall) | \n| [19-production-readiness-plan](https://github.com/openrmm-project/openrmm/blob/main/docs/19-production-readiness-plan.md) | Prioritized remediation plan to reach production: go-live blockers, observability, HA, container scanning, defense-in-depth | \n| [20-email-notifications](https://github.com/openrmm-project/openrmm/blob/main/docs/20-email-notifications.md) | Alert email: scope-enforced recipients, transition-only sending, the durable outbox and retry policy, SMTP setup | \n| [21-single-sign-on](https://github.com/openrmm-project/openrmm/blob/main/docs/21-single-sign-on.md) | Single sign-on with an OpenID Connect provider: setup, MFA requirements, account linking, break-glass | \n\nFor production deployment, see [`deploy/README-production.md`](https://github.com/openrmm-project/openrmm/blob/main/deploy/README-production.md):\na **split-ingress topology** with loopback backend binds and source ACLs at the\ntrusted TLS edge. The supported deployment is one server replica; the in-memory\nagent hub, relay and scheduler are not distributed or HA.\n\nTo build the frontend: [`docs/14-frontend-design-brief.md`](https://github.com/openrmm-project/openrmm/blob/main/docs/14-frontend-design-brief.md).\n\nThe native remote engine is a homegrown implementation (CGO-free on Windows and\nLinux; macOS capture uses CGO) rather than a third-party fork. See\n[`docs/08-remote-access.md`](https://github.com/openrmm-project/openrmm/blob/main/docs/08-remote-access.md) for platform and maturity\nlimitations.\n\n- Discord: [https://discord.gg/VN2jYWuA8X](https://discord.gg/VN2jYWuA8X)\n- X: [@openrmm](https://x.com/openrmm)\n\nReport security issues privately, as described in [SECURITY.md](https://github.com/openrmm-project/openrmm/blob/main/SECURITY.md),\nnot in public channels.\n\nOpenRMM is licensed under the **GNU Affero General Public License v3.0**\n(AGPL-3.0-only); see [`LICENSE`](https://github.com/openrmm-project/openrmm/blob/main/LICENSE). The AGPL's network clause (section 13)\nmeans anyone who runs a modified version as a network service must offer that\nversion's source to its users.\n\nCopyright (C) 2026 Miquéias Gonçalves. Contributors retain copyright in their own\ncontributions and license them under the [CLA](https://github.com/openrmm-project/openrmm/blob/main/CLA.md). Third-party components\nand their licences are listed in [`THIRD_PARTY_NOTICES`](https://github.com/openrmm-project/openrmm/blob/main/THIRD_PARTY_NOTICES).\n\nThe AGPL is a real obligation, not a formality: if you modify OpenRMM and offer it to others over a network, you must offer them that modified source. That is fine for most self-hosted use, and deliberately awkward for building a closed product on top of it.\n\nIf you need to embed OpenRMM in something you do not want to publish, a separate\ncommercial licence is available — the same code, without the AGPL's source\nobligations. Write to [contact@openrmm.io](mailto:contact@openrmm.io).\n\nContributing is unaffected by that: you keep the copyright in your work. The\n[CLA](https://github.com/openrmm-project/openrmm/blob/main/CLA.md) grants a licence broad enough to cover both distributions, because\nthe alternative is a project that can never change its own terms. See\n[CONTRIBUTING](https://github.com/openrmm-project/openrmm/blob/main/CONTRIBUTING.md).\n\n\"OpenRMM\" and its logo are trademarks of Miquéias Gonçalves. The AGPL licenses\nthe code, not the name: a fork is welcome under a name of its own. See\n[TRADEMARKS](https://github.com/openrmm-project/openrmm/blob/main/TRADEMARKS.md).", "url": "https://wpnews.pro/news/show-hn-openrmm-open-source-rmm-where-the-ai-proposes-and-a-human-approves", "canonical_source": "https://github.com/openrmm-project/openrmm", "published_at": "2026-10-20 11:56:57+00:00", "updated_at": "2026-10-20 12:17:00.529668+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-products", "agent-protocols", "artificial-intelligence"], "entities": ["OpenRMM", "Atera", "SuperOps", "Acronis", "Neo Agent", "Ollama", "vLLM", "RustDesk"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-openrmm-open-source-rmm-where-the-ai-proposes-and-a-human-approves", "markdown": "https://wpnews.pro/news/show-hn-openrmm-open-source-rmm-where-the-ai-proposes-and-a-human-approves.md", "text": "https://wpnews.pro/news/show-hn-openrmm-open-source-rmm-where-the-ai-proposes-and-a-human-approves.txt", "jsonld": "https://wpnews.pro/news/show-hn-openrmm-open-source-rmm-where-the-ai-proposes-and-a-human-approves.jsonld"}}