Now available — no waitlist
Your cloud runs itself. You still decide what it’s allowed to do.
Noctrel is an AI engineer that lives inside your infrastructure. It watches, diagnoses, and proposes the exact command it wants to run — then waits for a human to say yes.
Free to start. Pro plan coming soon.
Why teams let it near production
- Outbound
- Connection model
The agent dials out. No inbound port, no firewall change, no SSH key handed over.
- 0
- Commands that run without a human sign-off
It can draft a new one-off command when nothing fits — but AI-authored or not, nothing runs until someone approves it.
- 692
- Tests in CI
Every approval, risk-classification, and execution path runs on each commit.
- 100%
- Actions audited
Append-only, org-scoped, exportable — the same table the product runs on.
The product
It reasons about your servers. It stops before it touches them.
Ask in plain language. It reads live state, works out what’s wrong, and comes back with one specific command and the reason it wants to run it — flagged if it needs root, flagged if it’s risky.
A real capture of the running product. The command is written, the risk is classified, root is declared — and it is still waiting.
How it works
Four things stand between the model and your machines.
You define the vocabulary
Your team writes the catalogue: restart nginx, check disk, roll back the deploy. Each entry is an exact command, marked for whether it needs approval and whether it needs root. If nothing fits, the AI can draft a one-off — but an AI-authored command always starts locked, no matter how routine it looks, until a human reviews it.
One gate, and every path goes through it
Approve, deny, elevate, resume, manual trigger, API token — every route that can put a command on a machine calls the same function. That is the difference between a policy and a promise: a Member blocked at Approve cannot get root by clicking something else.
Risk is decided by code, not by the model
Before anything reaches a human, the command text is matched against known-dangerous shapes — destructive deletes, piped remote scripts, chained downloads, command substitution. The model's opinion of its own safety is never the deciding vote.
Everything that happened, still there
Every observation, proposal, approval, denial and result is appended and never edited — scoped to the organisation that owns it, filterable by date and type, exportable as CSV or JSON. When someone asks what changed at 03:00, there is an answer.
Security
The questions a security review opens with.
Nothing on this list is on a roadmap. Each one is shipped, and each one has tests that fail the build if it regresses.
Read our full self-assessment against the NIST Cybersecurity Framework →Two-factor authentication
TOTP with any authenticator app, plus single-use backup codes claimed atomically. Re-enrolling on an account that already has 2FA on requires the password.
Credentials encrypted at rest
Your AI provider key is encrypted before it reaches the database and is never sent to an agent — it is only ever used server-side to call the provider you chose.
Scoped, expiring API tokens
Read-only or full access, and an expiry chosen at creation. “Never” is a deliberate selection, not what you get by leaving a field blank.
SSRF-guarded webhooks
Destination URLs are resolved and checked against the whole private, loopback and link-local space — including cloud metadata addresses — before anything is delivered.
Rate limits on anything costly
Every route that spends model budget, sends mail, fires an outbound request or mints a credential is throttled — including the ones that only looked harmless in review.
Segregation of duties
Turn on admin-only approval for risk-flagged actions and it holds on every path at once, because every path asks the same function.
Free to start · Pro plan coming soon
Put an engineer on every server. Keep the last word.
Create an account and pair your first agent in a few minutes — no waitlist, nothing to wait on.