How the agent works

The AegisOne agent is a compiled Go binary with no runtime dependencies. There is no interpreter to install, no framework to keep current, and no separate update channel for a language runtime. This matters most on the machines you least want to touch: appliances, long-lived servers, and anything with a change-control process attached.

Builds ship for four targets: Windows, Linux, macOS on Apple Silicon (arm64) and macOS on Intel (amd64). Pick the architecture deliberately on macOS. An Intel build will run on Apple Silicon under translation, but you gain nothing from it and lose the ability to reason cleanly about what is deployed where.

Connectivity is outbound only. The agent establishes and maintains a connection to the platform; the platform never initiates a connection to the endpoint. In practice this means you do not open inbound firewall ports, do not publish endpoints to the internet, and do not need a VPN for the platform to reach a machine. Remote terminal sessions travel over that same outbound channel rather than a separate inbound path.

The network requirement is therefore simple: the endpoint needs outbound HTTPS to your console host, and it needs to be able to keep a WebSocket connection open. Proxies that terminate or aggressively time out long-lived connections are the most common cause of agents that enrol successfully and then appear intermittently offline.

The agent collects hardware inventory, installed software inventory, warranty information where the platform exposes it, patch position, health and internet reachability. It executes instructions dispatched from the platform — patch scan, patch install and uninstall, compliance scan, remediation actions, and terminal sessions — and writes every one of those to the action log.

It does not execute arbitrary code you author, because there is no script library in the product. The action surface is a fixed set, which is a meaningful security property and a real functional limitation depending on your perspective.