FlowRMM

Getting Started

Get Started with FlowRMM Remote Console

This walkthrough follows Acme MSP helping a user at Acme Corp / Acme HQ. The same enroll → remote → approve path fits internal IT and small teams. You will enroll acme-wks-01 (or a macOS stand-in like acme-mac-01), open Remote Console, and practice the approve-and-run path before scaling further.

FlowRMM Remote Console is built for safe, accountable remote operations. Enroll endpoints, connect remotely, use the interactive console, copy files, run approved work, and review the audit history: all without claiming to be a complete RMM on day one.

The platform has two primary components:

  1. Portal server: Bun-based operator UI and API (flowrmm-web)
  2. C# agent: lightweight endpoint service (Windows, macOS, Linux)

Full monitoring, alerts, Azure Graph onboarding, and advanced governance are future RMM modules. See Product core vs modules.

First Remote Console session (~30 minutes)

Use this checklist for an Acme MSP tenant:

  1. Portal health: GET /healthz and GET /readyz return OK on your deployed FQDN.
  2. Installers: Open Installers, mint an enrollment token, and copy the bootstrap script for one test endpoint.
  3. Enroll: Run the bootstrap on a Windows, macOS, or Linux machine. Confirm the device appears under Environment.
  4. Create hierarchy: Open Clients or use /clients?create=1, create the Acme Corp, add a site, assign the enrolled endpoint, and confirm the client appears in the global scope switcher.
  5. Remote session: Open Remote on the endpoint. Verify viewer connects; arm control only when you intend to send input.
  6. Console: Open the interactive console tab and run a read-only command (for example hostname).
  7. Actions / HITL: Run a safe information-gathering command, then queue a state-changing action and approve it on Actions. Confirm Scope, Impact, approval policy, and outcome on Activity.
  8. Environment graph (~60 seconds): On Clients, open Environment for that client: two devices at one site is enough. Hover a device, run a starter observe runbook against it, and Pin this to {hostname}? when it succeeds. A second device that ran or pinned the same runbook shares that node. Ask the AI plugin get_endpoint_impact for the same device and confirm the runbook is in neighborhood. Inspect play log ids match that neighborhood's activity and alert nodes. Do not auto-pin every completed run.
  9. MCP / AI plugin (optional): Download the FlowRMM AI plugin from Installers for Codex, Cursor, and other Agent Plugins clients, or connect ChatGPT Work directly to https://portal.example.com/api/v1/mcp, following Agent Execution & Control. Use browser OAuth and queue an approved action. Ask is deferred on remote_console until an LLM backend is production-ready.

Success for a pilot week: enrolled endpoints stay current, operators can remote/console without bypassing approvals, audit covers sessions plus actions, and the environment graph shows at least one runbook a human pinned to a device.

Enrolling endpoints

  1. Open Installers.
  2. Download the agent for the target OS (Windows MSI, macOS pkg, or Linux zip) or copy the PowerShell/bootstrap script.
  3. Run enrollment on the endpoint with a valid enrollment token.
  4. Confirm the device under Environment: the environment graph is the primary inventory for Remote Console.

Enrollment security, rate limits, and token rotation: Installers & Enrollment Security.

Core operator workflows (Remote Console)

Environment

Environment is the workspace nav for the enrolled device table at the current client, site, or tenant scope. /devices is that table (Devices and Software tabs). /devices/:id opens the endpoint drawer on the same page. /endpoints redirects to /devices. The environment graph stays under Clients. Installed software from the inventory snapshot hangs off the machines that have it on the graph; add lens=software (the Clients Software lens and “see across fleet” CTA do this).

Remote control and console

FlowLink WebTransport in the browser plus native QUIC on the endpoint, with versioned authority on /flowlink-control. Session workspace: /remote/:agentId.

Actions and human approval (HITL)

Structurally safe information gathering can run through a policy-authorized Action. Raw state changes and gated agentic workflows land on Actions for human approval unless a reviewed runbook explicitly permits bounded execution. Every dispatch is audited.

Details: Operator Actions & HITL Guardrails.

Runbooks

Runbooks (automation.use) is first-class workspace nav on entitled Remote Console. It covers scripts, linear flows, and package deploy steps included during the pilot. SMTP alert steps and monitoring remediation require the RMM module. After a runbook succeeds on a device, pin it onto that endpoint so the environment graph (lens=runbooks) and MCP get_endpoint_impact share the same neighborhood. The unlinked tenant library stays off the canvas.

Environment graph

Clients Environment draws the observe-only neighborhood for a managed client, or the tenant map from All clients. The canvas fills the workspace; collapse the Fleet rail to give the galaxy the remaining pane. The Legend overlays layer switches (people, software, runbooks, knowledge, activity, alerts) so the neighborhood stays on-screen. Endpoints are Mac, Windows PC, laptop, Linux, headless, server, or Cloud PC silhouettes; signed-in people share one person mark across machines; installed software from the inventory snapshot shares one node across machines. Linked knowledge pages hang off the endpoint, site, client, or runbook they document, with titles on the canvas at fitted or normal zoom: a runbook attached to a knowledge base shares that page on the same canvas (lens=knowledge). Hover a device, pin a proven runbook, then ask the AI plugin for neighborhood. Two devices that pinned or completed the same runbook share that node. Activity hangs off the computer it ran against; inspect names that machine and opens the exact action. SNMP/on-prem neighbors are not probed yet.

Ask and MCP

  • Ask: deferred on remote_console (ask.use off). Re-enable when LLM_URL is configured and product turns the entitlement back on.
  • /api/v1/mcp: fleet automation for Cursor, Claude Desktop, and custom agents (Agent Execution & Control)

Alert-related MCP tools require monitoring.use or alerts.use. On remote_console those features are a tenant Preview: an Admin enables them under Admin Hub → Preview features. They are not a separate SKU.

Audit

The Activity nav (/activity, legacy /audit) opens the same environment graph for the current portal scope (lens=activity), using operator work and monitors already on the map. /activity?list=1 keeps the remote-session cards and shaped timeline (GET /api/v1/audit/activity, remote.audit.read). /activity?list=1&focus=<agentId> is that computer's list. /actions?tab=audit still redirects to Activity so Actions stays the decision queue.

Explore the guides

Core (Remote Console)

For API contracts and deployment, see API Reference and Deployment in the docs sidebar.

Related guides

Want hands-on help evaluating Cohort 01? Book a demo or apply for Cohort 01.

All docsBook a DemoApply for Cohort 01