Self-hosted · Open source · No per-node pricing
Query driver, CUDA, NCCL, and package versions across every node in seconds. Self-hosted, open source, no per-node pricing.
Trusted by teams running osquery at scale, including TikTok and Maersk.
One control plane
Use the GUI, work from the CLI, or connect your own MCP adapter. Every interface reaches the same live host state.
Fleet health
$ osctrl-cli --api shellconnected to osctrl-api ............ authenticatedactive environment ................. production $ statsnodes enrolled ...................... 18,420nodes active ........................ 18,307nodes inactive ...................... 113queries running ..................... 3carves in progress .................. 1 $ use nodescontext ............................. nodes$ list inactiveHOSTNAME PLATFORM LAST SEENedge-proxy-07 linux 18m agofinance-mbp-214 darwin 31m agolab-win-22 windows 44m ago✓ 113 inactive nodes ready to filter, query, or inspectShow inactive Linux nodes in production.
GET /api/v1/nodes/production/inactive
Authorization: Bearer ••••••••
filter.platform = linux113 inactive nodes returned inside the production environment boundary.
From first node to full fleet
Add live host state without replacing the monitoring stack you already trust.
Deployment
One binary or docker compose up. Runs in your environment.
osquery agent, one enrollment secret per environment. Works on existing nodes and bakes into your image for new ones.
Ad hoc queries for right now, scheduled queries for continuous state.
A complementary layer
DCGM reports utilization, thermals, and hardware health. Prometheus tracks your metrics. osctrl answers a different question: what is actually installed and running on the host.
No overlap, no replacement. Most teams run all three.
Ephemeral infrastructure
Rental nodes are ephemeral. Node identity survives reprovisioning, and state history outlives the machine, so you can investigate a node you destroyed weeks ago.
Fail-slow investigation
Fail-slow nodes stay up, emit no error, and slow the entire synchronous job.
osctrl surfaces the host-side causes: unscheduled background processes, CPU contention, traffic on the wrong interface, and file descriptor leaks.
Tenant boundaries
Separate environments, enrollment, and data per tenant. Queries scoped to one customer's nodes cannot reach another's.
Available as a shared control plane or fully isolated per-tenant instances.
Deliberate constraint
No remote shell, no command execution on tenant workloads, no writes. osctrl reads host state and nothing else.
Open source economics
Open source and self-hosted. Telemetry never leaves your infrastructure. Adding nodes doesn't change your costs.
Comparison
● Yes ◐ Partial ○ No
| Capability | osctrl | Fleet | DCGM + Prometheus | EDR (Falcon, S1) | Wiz |
|---|---|---|---|---|---|
| Live query across cluster | ● | ● | ○ | ◐ | ○ |
| Driver / CUDA / package inventory | ● | ◐ | ◐ | ◐ | ○ |
| GPU utilization + thermals | ○ | ○ | ● | ○ | ○ |
| Built-in tenant separation | ● | ○ | ○ | ○ | ○ |
| History after node destroyed | ● | ◐ | ◐ | ◐ | ○ |
| Self-hosted | ● | ● | ● | ○ | ○ |
| Per-node pricing | none | per host | none | per endpoint | per workload |
| Read-only agent | ● | ◐ | ● | ○ | n/a |
Fleet covers similar ground and does it well, but was built for corporate laptops, prices per host, and doesn't model tenants.
DCGM + Prometheus own performance telemetry. Keep them.
EDR bills per endpoint and sends telemetry to a vendor cloud.
Wiz reads your control plane configuration. osctrl reads the machine.
Clear boundaries
Clear boundaries make the decision easier.
DCGM covers utilization and thermals.
osctrl sees the host, not GPU memory.
It surfaces host state. Pipeline skew and fabric contention are elsewhere.
No rules engine, no verdicts.
Start here
docker compose up, enroll your first node, run your first query. No demo request required.