FlowRMM

Getting Started

Get Started with FlowRMM Remote Console

This walkthrough follows Acme MSP helping a user at Acme Corp / Acme HQ — the same enroll → remote → approve path fits internal IT and small teams. You will enroll acme-wks-01 (or a macOS stand-in like acme-mac-01), open Remote Console, and practice the approve-and-run path before scaling further.

FlowRMM Remote Console is built for safe, accountable remote operations. Enroll endpoints, connect remotely, use the interactive console, copy files, run approved work, and review the audit history: all without claiming to be a complete RMM on day one.

The platform has two primary components:

  1. Portal server: Bun-based operator UI and API (flowrmm-web)
  2. C# agent: lightweight endpoint service (Windows, macOS, Linux)

Full monitoring, alerts, Azure Graph onboarding, and advanced governance are future RMM modules. See Product core vs modules.

First Remote Console session (~30 minutes)

Use this checklist for an Acme MSP tenant:

  1. Portal health: GET /healthz and GET /readyz return OK on your deployed FQDN.
  2. Installers: Open Installers, mint an enrollment token, and copy the bootstrap script for one test endpoint.
  3. Enroll: Run the bootstrap on a Windows, macOS, or Linux machine. Confirm the device appears under Endpoints.
  4. Create hierarchy: Open Clients or use /clients?create=1, create the Acme Corp, add a site, assign the enrolled endpoint, and confirm the client appears in the global scope switcher.
  5. Remote session: Open Remote on the endpoint. Verify viewer connects; arm control only when you intend to send input.
  6. Console: Open the interactive console tab and run a read-only command (for example hostname).
  7. Actions / HITL: Queue a medium- or high-risk action and approve it on Actions. Confirm audit records appear on the Audit tab.
  8. MCP (optional): Connect an MCP client per Agent Execution & Control and queue an approved action. Ask is deferred on remote_console until an LLM backend is production-ready.

Success for a pilot week: enrolled endpoints stay current, operators can remote/console without bypassing approvals, and audit covers sessions plus actions.

Enrolling endpoints

  1. Open Installers.
  2. Download the agent for the target OS (Windows MSI, macOS pkg, or Linux zip) or copy the PowerShell/bootstrap script.
  3. Run enrollment on the endpoint with a valid enrollment token.
  4. Confirm the device under Endpoints: primary inventory for Remote Console.

Enrollment security, rate limits, and token rotation: Installers & Enrollment Security.

Core operator workflows (Remote Console)

Endpoints inventory

Endpoints is the primary entry. Search, filter, open the agent drawer, and launch remote or console sessions from each row.

Remote control and console

WebRTC via /signal with /video JPEG fallback. Session workspace: /remote/:agentId.

Actions and human approval (HITL)

Risky commands and agentic workflows land on Actions for approval. Every dispatch is audited.

Details: Operator Actions & HITL Guardrails.

Runbooks

Runbooks (automation.use) covers scripts, linear flows, and package deploy steps included during the pilot. SMTP alert steps and monitoring remediation require the RMM module.

Ask and MCP

  • Ask: deferred on remote_console (ask.use off). Re-enable when LLM_URL is configured and product turns the entitlement back on.
  • /api/v1/mcp: fleet automation for Cursor, Claude Desktop, and custom agents (Agent Execution & Control)

Alert-related MCP tools require monitoring.use or alerts.use.

Audit

The Audit tab on Actions lists remote sessions, control events, and operator actions (remote.audit.read).

Explore the guides

Core (Remote Console)

For API contracts and deployment, see API Reference and Deployment in the docs sidebar.

Related guides

Want hands-on help evaluating Cohort 01? Book a demo or apply for Cohort 01.

All docsBook a DemoApply for Cohort 01