On this page

• Overview
• What is checked
• Vulnerabilities & CVEs
• How it works
• Public vs. private context
• Automated remediation
• PDF reports & scheduling

Overview

The Security Audit is a deterministic, skill-free scan that runs directly from the agent. No LLM calls, no guesswork: read-only check commands executed inside a Landlock sandbox, every finding evaluated against a strict rule set defined on the portal, and every installed package matched against the public vulnerability databases.

Unlike agentless scanners that ship a single profile for every server, ManageLM knows the context of each agent. A public, internet-facing box is held to a much stricter standard than an internal database server. Severity changes automatically, so your compliance score reflects actual risk. Not theoretical checklist items.

What gets checked

Each audit runs 28 checks on Linux and 23 on Windows, grouped into six categories. Findings are categorized, explained, and paired with a concrete remediation you can click to apply.

Vulnerabilities & CVEs

A perfectly hardened server running a vulnerable library is still a vulnerable server. So the same audit that grades your configuration also reads the package inventory the agent already collects, and matches every installed version against the public vulnerability databases. There is no second scanner to deploy, no separate schedule, and no second dashboard to check.

Matching is done against OSV.dev, the open vulnerability database that aggregates the distribution security trackers and the language ecosystems, and every match is then checked against CISA's Known Exploited Vulnerabilities catalog. Lookups are cached for 24 hours and shared across your whole fleet, so a hundred servers on the same release cost one query rather than a hundred.

21 ecosystems are covered out of the box: Debian, Ubuntu, Red Hat, Rocky Linux, AlmaLinux, SUSE, openSUSE, Mageia, Alpine, Chainguard and Wolfi, alongside PyPI, npm, Go, crates.io, Maven, NuGet, Packagist, RubyGems, Hex and Pub. Nothing to enable, nothing to subscribe to, no feed to keep up to date.

Each vulnerable package becomes a normal finding with a severity, an explanation, framework tags and the exact upgrade command for that host's package manager. Vulnerabilities with no upstream fix, typically an end-of-life release or a maintainer who never shipped a patch, are grouped into a single finding rather than flooding the report: the answer to those is a migration plan, not a package upgrade, and one line says so more usefully than forty.

How it works

1. Trigger
   From the Infrastructure page, the Compliance dashboard, or via an MCP call from Claude. No configuration needed, the agent is ready as soon as it is online.

2. Collect
   The portal sends deterministic check commands (defined in reports/security.json) over the existing WebSocket. The agent executes them inside a Landlock read-only sandbox. It cannot modify disk during an audit.

3. Evaluate
   The portal runs the raw output through 55 compliance rules and matches the package inventory against the vulnerability databases. Each rule produces a pass/fail with severity, framework tags (CIS, PCI-DSS, SOC 2), explanation, and remediation. A weighted score (0-100) is computed.

4. Report
   Findings appear in the audit modal and the Compliance dashboard. In-app notifications fire on completion, and drift alerts fire when a previously-passing rule starts failing.

Public vs. private context

ManageLM automatically classifies each agent as public (internet-reachable) or private (internal network) and adjusts severity accordingly. The same finding lands differently based on exposure:

This context-aware scoring means your compliance dashboard shows real risk, not inflated noise. A lab VM with a relaxed configuration won't drag down the score of your production fleet.

One-click automated remediation

Select one or more findings, click Remediate, and the agent applies the recommended fixes intelligently. Using its assigned Security & Hardening skill. Before every change, the agent:

• Backs up the original configuration file with a timestamped suffix.
• Applies the minimal change required by the remediation text.
• Validates the new config (e.g. sshd -t) before restarting the affected service.
• Rolls back automatically if validation fails.

PDF reports & scheduling

One Security button at the top of the Infrastructure page downloads a fleet-wide PDF report: summary bar with issue counts by severity, detailed findings with explanations and remediation, and a list of passed checks per server.

The Scheduled Tasks popover turns any scan into a recurring one (daily, weekly, or monthly) across every agent at once, so the reports you export always reflect fresh data.