What NODE64 does

An overview in five minutes – and what NODE64 deliberately does not do.

NODE64 watches your systems for security problems and tells you what to do about them. A small agent collects information about your device at regular intervals and sends it to the platform, where the actual work happens: comparison against vulnerability databases, checks against curated catalogs, rating, prioritisation.

The difference to a scanner: NODE64 does not just tell you that something is open. It tells you why that is a problem in your situation – or why it is not – and how to fix it.

How it works #

You connect a device. One command, a one-time token, done. The agent runs as a service, in a container or in an LXC.
The agent collects. Installed packages, running services, listening ports, accounts, containers, firewall rules, checksums of important files. It judges nothing – it measures.
The server evaluates. Package versions against known vulnerabilities, configuration against hardening catalogs, changes against the previous state.
You see findings. Each with a rationale, a rating and concrete commands to fix it.
NODE64 checks back. On the next run: is it really fixed? Then the finding is closed. Is it back? Then it is reopened.

What NODE64 does not do #

This matters as much as the list above.

NODE64 never runs anything on your device. The agent is a collector, not an executor. There is no command channel through which the platform could start something on your system. Remediation commands come to you as text – you run them.
The agent does not send file contents. It computes checksums. The server knows that /etc/ssh/sshd_config changed, not what is in it. The only exception is a small number of explicitly requested configuration outputs, all listed in the data manifest.
No passwords, no keys, no content. SSH keys are transmitted as fingerprints only.
No port scanning from outside. By default NODE64 measures nothing actively against your systems. If you want it, you can order a measurement from outside – against your own, proven targets.
No substitute for a virus scanner. NODE64 detects traces of malware and the telltale signs of a ransomware infection – a ransom note, mass-encrypted files, a rootkit anchor, a program running from a temporary directory. It is a second line of defence that often finds what a signature scanner misses. But it is not a virus scanner: no signature database, no real-time guard. Run both side by side, not one instead of the other.

NODE64 reads – and never intervenes. The agent looks at your system and reports what it finds. It changes nothing: no file, no setting, no service. Even when it detects a ransomware infection in progress, it deletes nothing, moves nothing and cuts no connection – it tells you what is happening and what would need doing. What happens to your system is yours to decide, and yours alone. This is not a setting that could be flipped; it is built into the agent: there is simply no path through which the platform could change anything on your device.

All verifiable. node64-agent show prints exactly what would be uploaded – before it is uploaded. Not a description of it, but the data itself.

What you need #

A Linux system with internet access. Debian, Ubuntu, Alpine, Arch, OpenWrt, Proxmox, a Raspberry Pi – the agent runs on x86-64, ARM64, ARMv7, ARMv6, i386, RISC-V and MIPS64.
No open port. The agent contacts the server, not the other way round. NAT and firewall stay as they are.
A NODE64 account. The free one is enough to try it out.

Where to go next #

Getting started – account, first device, first report.
Install the agent – every path in detail.
What data is collected – the complete list.