Connections.
When you need more.
SSH access, manual installation and MCP client setup. For the usual installation, use the three-step quick start.
Network access
The installer selects port 8443, then 9443 or 10443 if occupied, and prints the exact panel URL. A free local port does not prove Internet reachability. Metric Owl uses TCP port 80 for certificate validation and renewal, while existing websites can keep using it for their own HTTP traffic; the selected panel port must also be reachable. Active UFW receives only the required installer-owned rules. Allow these ports separately in any cloud firewall or security group managed by your hosting provider.
A browser is all you need.
If your server administrator has enabled HTTPS access, open the panel address they provide, in the form https://YOUR_SERVER_IP:PORT/admin. Sign in with your existing username and password. Enter an authenticator code only if you have enabled two-factor authentication. It works from another computer or phone without installing Metric Owl there or keeping a terminal open.
The address belongs to your own installation. The application, dashboard, account and SQLite database run on your server. The product website has no shared login or dashboard. An HTTPS dashboard does not turn its URL into an MCP endpoint; AI clients still use the local or SSH connection below.
HTTPS browser access: an administrator enables the protected reverse-proxy mode once on the monitored server. Daily access then needs only your browser.
SSH access: the default private connection and setup fallback. The tunnel below forwards a browser connection; it does not install a local server on the computer you use to visit the panel.
The application and source are available on GitHub. The source remains under the project license; public availability does not mean an open-source license. The installer detects Ubuntu 22.04 / 24.04 / 26.04 LTS or Debian 12 / 13 locally. No OS inventory is uploaded. Read the validation limits; ARM64 and Windows server packages are not published.
Install once on your server
Enter the server address you use for SSH to prepare the first connection. The commands below update automatically. These fields stay in your browser and are not submitted to us.
Enter your server’s IPv4 address or hostname to prepare the commands.
Enter your server address above.Enter your existing SSH password if asked. Once connected, run the command below on the server. You do not need Node.js, Rust or MySQL. The default HTTPS panel uses the server’s public IPv4 address; no domain is required.
curl -fsSL https://raw.githubusercontent.com/SpeakQuery/metric-owl/v0.1.0-preview.7/scripts/bootstrap-linux.sh | sudo bashThe installer verifies the GitHub release, starts monitoring, and prepares HTTPS on your public IPv4 address at an available port from 8443, 9443 or 10443. No domain is required. Choose your administrator credentials first. The detected public IP is used automatically when unambiguous. Review the Let’s Encrypt terms and enter yes to accept. Existing hosted domains are not overwritten. Inspect the versioned script on GitHub →
Installation complete. Panel: https://your-panel.example.com/admin Open this address in your browser.
The standard installer asks for your administrator username and password, then prints your HTTPS panel address. Manual installations can use a one-time setup key instead; that key expires after 30 minutes. An upgrade preserves your existing account.
Using local-only mode or an SSH fallback?
Prefer private access only? Set GUARD_CONFIGURE_HTTPS=0 when running the installer. You can then use this private tunnel without exposing the panel publicly.
Enter your server address above.For the SSH option, run this tunnel command and keep the terminal open. A quiet terminal is normal. It carries the dashboard securely through your SSH connection.
This address means your computer. The SSH tunnel connects it to your server. Your server’s public IP is used in the command above.
The installer keeps the application listener on server port 4877, accessible only from that server. The guided installer configures public-IP HTTPS by default; the installer does not change your existing websites or certificates. If local port 14877 is busy, use 14878 in both the tunnel command and browser address.
3. Sign in to your dashboard
Use the username and password you chose in the installer. No setup key or QR code is needed for the guided installation. Optional two-factor authentication is available in Security & system; enabling it shows a locally generated QR code and recovery codes.
Manual installations without an installer-created account retain the one-time setup-key flow and authenticator enrollment. Existing accounts keep their MFA settings. A completed account never asks for the setup key again.
4. Start with the included rules
Monitoring starts automatically. Open the setup checklist to review the ready-made rule packs, notifications and connections. Adjust the presets when needed; you do not have to create every CPU, memory and disk rule yourself.
A critical CPU rule, for example, checks for usage above 90% during at least 80% of a three-minute window. Brief spikes and sustained pressure are handled separately.
5. Connect your AI client
In the dashboard, open Notifications & connections → MCP clients.
- Choose A remote server and enter the same server address, SSH username and port used above. The installer suggests these details when available.
- Choose Codex or Other MCP client, give the connection a name, and click Create connection.
- Click Copy configuration. Paste the complete block into your AI client’s MCP settings, then reconnect the client.
The app creates a separate private key file for each connection and fills in the exact command and path. You do not need to paste API keys into terminal commands or edit environment variables.
SSH key sign-in must already work from the computer running your AI client. An AI client cannot answer an interactive SSH password prompt. The connection wizard explains this requirement; it does not change your SSH access settings.
Already created a connection? Generate its SSH configuration here.
This optional helper is for the standard Linux installation. Get the connection ID from the configuration shown in your dashboard. This is a non-secret UUID, not an API key, setup key or password. The dashboard’s own generated configuration is the best choice for custom installation paths.
Enter your server address and an existing connection ID.No connection is created by this website. Create it in your dashboard first.
Try asking your connected agent:
- “Show a table of CPU usage over the last 24 hours.”
- “When did CPU and memory rise together?”
- “Explain the evidence for the most recent incident.”
MCP returns collected measurements and incident evidence. Your AI client interprets them. Only history collected after installation is available. The website and dashboard addresses are not HTTP MCP endpoints.
6. Choose email and optional AI
In connection settings, add and verify your email recipient, then choose report times and instant alerts. Use your own SMTP provider or an optional notification relay. No central relay or mail-server installation is required. Test the connection and recipient delivery separately; a provider accepting a message is not proof that it reached the inbox.
For optional incident analysis, choose your AI provider and model, add your API key, and click Test API connection. Monitoring and rule-based alerts work without AI. Provider charges and limits are separate.
Installing on your own Mac?
With a supplied Apple Silicon preview package installed locally, open http://127.0.0.1:4877/admin. No SSH tunnel is needed. In the MCP wizard, choose This computer.
Need a hand?
Contact services@metricowl.cloud. Never send passwords, setup keys, recovery codes or API keys in a support message.
Remove Metric Owl
Run sudo bash /usr/share/doc/server-guard/uninstall-linux.sh on your server. Your account and history are retained.
The uninstaller stops the service and removes installer-owned HTTPS configuration, its renewal timer and its recorded firewall rules. Existing websites are preserved. Certificate files are retained for reinstallation. Older or operator-managed HTTPS configurations stop for review.
Before separately deleting retained data, confirm the service has stopped and archive the complete /var/lib/server-guard directory into a private, root-only backup outside your web directories. Include SQLite/WAL files and master.key, preserve permissions, and verify an independent restore. The backup contains authentication and integration secrets. Certificate files in /etc/metric-owl/acme can be backed up separately. The uninstaller does not erase either directory.