Fortmend
See what changes.
Watch SSH activity, suspicious PHP files, and persistence changes. Match installed package versions to Ubuntu and Debian security advisories.
Built for Ubuntu & Debian · Developer preview
Your server. Under watch.
Your server. Under watch.
Security that stays with it.
An autonomous security engineer inside your Linux VM.
Find risks. Apply fixes. Check the results.
SELF-HOSTED / OPEN SOURCE / ALWAYS ON
The right place to start is inside.
Home: your VM.
Close to your software. Close to the evidence.
One continuous response loop, running on the machine you own.
Take the next step.
Apply security updates and quarantine detected PHP threats. Give Codex the tools to investigate incidents and repair your VM.
Check the work.
Recheck findings and service health after a response. Preserve evidence, keep an audit trail, and leave unresolved risks visible.
Beyond another alert.
Less chasing signals.
More closing the loop.
A finding should lead to an investigation.
A repair should lead to a check.
A queue of things to look into.
Different signals. Another manual investigation.
A path from evidence to response.
One local loop, with a record of what happened.
Collect and assess the evidenceOBSERVE
Apply a responseREPAIR
Recheck the finding and healthVERIFY
Illustrative workflow. Actual findings and outcomes depend on the machine and policy.
Understand the loop.
Different tools.
One watchkeeper.
Local monitoring, security updates, and AI investigation
work together without a central platform.
Start with local evidence.
Continuous sensors collect attack signals. Scheduled assessments compare installed source-package versions with official distro advisories, including backported fixes.
Attack signals
SSH journal activity, PHP threat indicators, and cron or systemd persistence changes.
Advisory sources
Official Debian security tracker and Canonical Ubuntu OVAL data.
Coverage stays visible
Unknown applicability and sensor gaps remain explicit instead of becoming a clean bill of health.
Security updates, with checks.
Use authenticated APT security origins to apply eligible updates. Record the update result, audit package state, and check configured services afterward.
Security-only origins
Keep update selection tied to the distro's authenticated security repositories.
Reboots are explicit
Automatic reboots are off by default. A pending reboot stays visible.
Failures stop the loop
Failed or interrupted updates leave a durable receipt and require acknowledgement before retrying.
Investigate. Repair. Look again.
Connect Codex with your ChatGPT account. Full-control mode gives it the VM's tools to investigate and repair, followed by independent checks of findings and service health.
Full root authority
The AI can run commands and change your VM. Review your policy and keep a recoverable backup.
Evidence before claims
Preserve incident evidence and record actions. A claimed repair still needs verification.
Unresolved means unresolved
Remaining findings or unknown coverage stay visible. No model can promise a vulnerability-free machine.
One machine. One command.
Give your VM a watchkeeper.
Run inside your Ubuntu or Debian VM.
The installer guides you through setup and Codex sign-in.
curl -fsSL https://fortmend.vercel.app/install.sh | sudo shRoot access is required. Full-control AI can change your VM; start with a recoverable machine and review your policy. Inspect the installer ↗
Fortmend is a developer preview for Ubuntu 24.04 and Debian 12 with systemd. Coverage depends on sensors and advisory data; successful checks cannot prove a machine is clean. Fleet coordination and container support are future work. See what we test.