Free forever · you bring the server
Run your servers from your phone.
rootmote is a secure mobile control plane for the servers you already run. Infrastructure changes wait for biometric approval on your phone.
$ curl -fsSL https://raw.githubusercontent.com/rockclaver/rootmote-agent/main/scripts/install.sh | sudo bash
Biometric gate
Infrastructure changes wait for your fingerprint. Decline is one tap.
Loopback-only agent
The agent listens on 127.0.0.1 only. The one way in is your SSH tunnel.
No accounts
You bring the server. Data stays on your servers and your phone.
Readable source
A single Go binary you can read before piping anything into sudo.
What you can do
The server actions you SSH in for, safely one screen away
Check the box, restart the service, free the disk, review the deploy. The jobs you'd open a laptop for, done through one gated control plane.
Fleet
Every server on one screen: live CPU, RAM and storage sparklines, health states, agent versions.
Docker
Restart a container, tail its logs, check its stats. Images, volumes and networks, with compose groupings intact.
Services & processes
systemd and launchd services, processes, firewall and web servers. Restart the stuck one, not just watch it.
Storage reclaim
Find what eats your disk (old images, logs, caches) and clean it up through guarded, reviewable actions.
Security audit
Host hardening findings with severities: open ports, missing firewalls, risky defaults. Each carries an AI-proposed fix.
AI sessions
Claude Code and Codex run on the box, rendered as a typed transcript with diffs, plans and tool calls.
Gated control
Nothing mutates without your fingerprint
Runbooks, services, firewall, storage: every infrastructure change stops at an approval sheet. You see what will run, where, and as whom. Then you decide.
- 01
See the exact command
The approval sheet shows the full command or script in plain shell, including when it runs as root. No summaries, no paraphrase.
- 02
Know the risk and the target
Risk level and target machine sit on the same sheet, so you know what runs where before you decide.
- 03
Approve or decline
Your fingerprint runs it; decline is one tap. Nothing executes while the sheet waits.
- 04
Everything is logged
Every approval and decline lands in the audit log, tied to a confirmation token on the agent.
Security audit
Findings first, fixes one tap later
Audit the host, read the evidence, fix what matters, without leaving the approval gate.
Severity, evidence, recommendation
Each finding carries a severity, the evidence behind it (the open port, the missing rule, the risky default) and a concrete recommendation.
Fix with AI, still gated
One tap turns a finding into a runbook. The runbook still passes through the biometric approval gate: exact script, risk level, target machine.
Security model
Mechanisms, not adjectives
Every claim below names a shipped mechanism in the app or the agent. Nothing more.
Loopback-only agent
rootmote-agent refuses to start on anything but a loopback address. It's reached exclusively through the SSH tunnel your phone opens, authenticated by your own key.
Pairing key
A 32-byte pairing key, exposed only over the SSH channel. Every connection must present it, compared in constant time. On by default.
Host keys pinned
The app pins each server's host-key fingerprint on first connect and hard-fails if it ever changes. A changed key is an error, never a silent reconnect.
Gated mutations
Biometric approval on your phone, a confirmation token, and an audit log. Enforced on the agent, not just in the UI.
Install
One command on the server
The on-server companion is rootmote-agent, a single Go binary that binds only to loopback.
$ curl -fsSL https://raw.githubusercontent.com/rockclaver/rootmote-agent/main/scripts/install.sh | sudo bash$ curl -fsSL https://raw.githubusercontent.com/rockclaver/rootmote-agent/main/scripts/install-macos.sh | bash$ curl -fsSL https://raw.githubusercontent.com/rockclaver/rootmote-agent/main/scripts/install.sh -o rootmote-install.shRead the script, then run sudo bash rootmote-install.sh, or review the whole agent on GitHub.
FAQ
Questions
The short version: it's free, your data stays on your server, and you can read every line the agent runs.
Is it really free?+
Yes. rootmote is free; you bring the server. There are no accounts with us, no tiers, no billing.
How does rootmote connect to my server?+
Over SSH, with your own key. The on-server agent listens only on 127.0.0.1:7676; the app opens an SSH tunnel to reach it, so nothing new is exposed to the internet. Away from home, use a private overlay network like Tailscale. Public port-forwarded SSH is not the recommended default.
Are my SSH keys stored anywhere?+
Only on your phone. The app connects over SSH you configure, using keys stored on your device. The push relay never receives your SSH keys or server credentials.
Can rootmote run commands without me?+
Reads, yes: metrics, container states and service status refresh on their own. Infrastructure changes, never: runbooks, service, firewall and storage actions wait for biometric approval on your phone, carry a confirmation token, and are written to the audit log. AI coding sessions are the one thing you can loosen; see the next answer.
Can AI modify my production server?+
Only as far as you allow. By default, sessions run in a gated mode: the CLI requests approval when an action needs it, and every tool call and diff streams back to your phone so you can see exactly what changed. An explicit per-session full-access mode (“yolo”) removes those approvals. Don’t enable it on a box you aren’t willing to let the agent change. Infrastructure runbooks always pass the biometric gate, regardless of session mode.
Where does my data live?+
On your server. The on-server companion binds only to 127.0.0.1 and is reached exclusively through your SSH tunnel. Push notifications flow through a relay so agents need no per-install Firebase project.
Which AI CLIs are supported?+
Claude Code and Codex, driven over their native machine protocols and rendered as one normalized transcript. A raw terminal fallback covers flows the structured protocols don't.
Does it work with a Mac?+
Yes. A per-user LaunchAgent install covers coding sessions, project operations and read-only infrastructure views on macOS. Linux-only controls like ufw rule edits are reported as unavailable.
Can I read the agent's source?+
The on-server companion, rootmote-agent, is a single Go binary you can review before piping anything into sudo.
Free forever · you bring the server
Your servers. Your rules. Your pocket.
Or start on the server: install rootmote-agent