v0.4.2 · self-hosted

AI Security Agent for your VPS.
Install once. Sleep well.

Rivet tails /var/log/auth.log, detects brute-force in real time, and blocks attackers with nftables — then pings you on Slack, Discord, or any of nine channels.

One-time €49 Self-hosted No telemetry Works offline
Three jobs · one binary

Monitor. Detect. Block.

An always-on agent that does the boring security work so you don't have to babysit fail2ban configs at 2 AM.

Monitor

Tails /var/log/auth.log in real time. Streams events through a Docker engine with a host-side responder for nftables access.

inotify · sub-second latency

Detect

Pattern-matches SSH brute-force, scans, and anomalous traffic. Tunable threshold + window — defaults to 5 failures in 60 seconds.

5 attempts · 60s window

Block

Installs nftables rules instantly. Auto-unblock after 24h, or keep permanent. CIDR allowlist for your office and bastion hosts.

nftables · 24h TTL · allowlist
How it works

From log line to blocked IP in under a second.

Four steps. No agent fleet, no SaaS dependency, no log shipping off your box.

01

auth.log

/var/log/auth.log

02

Engine

pattern · threshold

03

Block

nftables rule

04

Alert

9 channels

Slack · Discord · Email · Telegram · Webhook · ntfy · Signal · WhatsApp · Pushover

Pricing

One price. Forever yours.

No seats, no MRR, no surprise renewals. Buy it once, run it on as many of your own VPS as you like.

Rivet · single license
49one-time
Lifetime updates · personal & commercial use
  • Real-time auth.log monitoring
  • Auto-block via nftables, with allowlist
  • 9 notification channels — Slack, Discord, Email, Telegram, Webhook, ntfy, Signal, WhatsApp, Pushover
  • Web console — Status, Alerts, Blocked IPs, Logs, Settings
  • REST API on port 3000, bearer-token auth
  • Run on unlimited VPS you personally administer
  • Email support · 30-day refund
Pay with Stripe · invoice on request
Install in 30 seconds

One command. SSH in. Run.

The installer pulls the engine container, sets up the host-side responder, opens the console on :3000, and prints your API token.

$ curl -fsSL https://rivet-security.com/install.sh | bash
Ubuntu 20.04+ / Debian 11+
x86_64 · arm64
Docker + nftables
auto-installed if missing
Web console at :3000
bearer token printed