Skip to content
Sencai.docs

Fleet agent

The Sencai fleet agent is a small binary you install on a server - bare metal, a cloud VM (including ones Sencai didn’t provision), or an on-premise machine. Once enrolled, it reports back to Sencai and lets you monitor, patch, and operate that server from one place, without you having to SSH in and check each machine by hand. Kubernetes clusters are monitored by a related but separate in-cluster agent - see Kubernetes clusters.

This page is an overview of the agent itself. The rest of this section covers each capability in depth - install steps live in Enrollment.

What it does

Section titled “What it does”
  • Monitoring - a heartbeat with basic host metrics every 30 seconds, so you always know whether a host is reachable - see Monitoring
  • Software inventory - a periodic scan of installed packages, flagging end-of-life software - see Software inventory
  • Patch status - a periodic scan of outdated packages - see Patch management
  • Security scanning - CIS-style hardening checks and a score
  • Remote execution - whitelisted commands and pre-approved runbooks dispatched to one or more agents - see Remote execution
  • Quarantine - isolate a compromised host at the network level with one action - see Quarantine
  • Custom probes - your own allow-listed checks, run fleet-wide on a schedule - see Agent policies

Capabilities are opt-in per agent: a newly enrolled agent starts with monitoring only, and an organization admin grants the rest from Fleet → Agents. If something you expect the agent to report isn’t showing up, check whether the corresponding capability has actually been granted.

The agent runs on Linux (amd64 or arm64).

What it sends back, and how often

Section titled “What it sends back, and how often”
  • A heartbeat with CPU, memory, and disk usage every 30 seconds - this is what powers the connected/disconnected status you see in the app
  • A software inventory scan roughly every 24 hours, once the inventory capability is granted
  • A patch scan roughly every 24 hours, once the patch capability is granted
  • A CIS hardening scan roughly every 24 hours, once the CIS capability is granted
  • Custom probe results, on whatever schedule you configure per probe

Nothing beyond what’s described here and elsewhere in this section is collected - the agent doesn’t ship file contents or application logs unless you explicitly enable log shipping.

Resource footprint

Section titled “Resource footprint”

The agent is a single, small binary running as a background service, started automatically on boot. It reconnects on its own, with backoff, after a network interruption - you don’t need to restart it manually if a host briefly loses connectivity.

Security posture

Section titled “Security posture”
  • Outbound-only control connection. The agent initiates its connection to Sencai; you don’t need to open an inbound port on the host for monitoring, patch scanning, inventory, or command dispatch to work.
  • Certificate-based identity. Enrollment exchanges a one-time token for a client certificate the agent then uses to authenticate every later connection - see Enrollment for how that exchange itself is protected.
  • Deny-by-default capabilities. Every capability beyond basic monitoring has to be explicitly granted per agent, and the agent enforces that allow-list itself, not just the platform side.
  • Remote execution is narrowly scoped. Ad-hoc commands and runbook actions run against a fixed, reviewable set of allowed actions - see Remote execution for exactly what that means in practice.

What’s next

Section titled “What’s next”