Rivet Documentation

Everything you need to install, configure, and use Rivet — your AI security agent.

01 — Installation

One command. Takes about 60 seconds on a fresh server.

ssh root@your-server-ipCopy

curl -fsSL https://rivet-security.com/install.sh | bash -s -- --key YOUR-LICENSE-KEYCopy

✅ Rivet installed successfully!
   Dashboard: http://your-server-ip:3000
   Engine:    running
   Responder: running
   Watching:  /var/log/auth.log

   Your server is now protected.

Open http://your-server-ip:3000 in your browser.

02 — First setup (3 minutes)

After installation, do these three things to get the most out of Rivet.

03 — Verify it works

Run this on your server to check that everything is running:

curl -s -H 'X-API-Key: YOUR-API-KEY' http://localhost:3000/healthCopy

You should see:

{"ok": true, "status": "running"}

Check the dashboard — go to Status. You should see:

04 — Dashboard: Status

The main view. Shows your server's security at a glance.

Engine panel (left)

Shows the Docker container running the detection engine: container name, image version, uptime, CPU, memory, restarts. If restarts > 0, something crashed — check Troubleshooting.

Responder panel (right)

Shows the host process that executes firewall rules: PID, user (root), which log file it's watching, how many nftables rules are active, memory usage.

Stats cards

Live SSH log stream

Real-time feed from /var/log/auth.log. Color codes:

05 — Dashboard: Alerts

History of all security events. Each alert shows:

The badge number on "Alerts" in the sidebar shows unread alerts since your last visit.

06 — Dashboard: Blocked IPs

All IPs currently blocked in your firewall. Each entry shows the IP address, when it was blocked, and how many failed attempts triggered the block.

Unblocking an IP

If you accidentally got blocked (or a client did), click the Unblock button next to the IP. The firewall rule is removed immediately.

07 — Dashboard: SSH Logs

Full scrolling view of your SSH authentication log. Updates every 3 seconds. Use this to see exactly who is trying to access your server and from where.

Each line shows: timestamp, source IP, username attempted, and result (success, fail, blocked).

08 — Dashboard: Settings

Notifications

Configure where Rivet sends alerts. You can enable multiple channels at once. See detailed setup guides: Slack, Discord, Email, Telegram.

Engine configuration

09 — Set up Slack alerts

10 — Set up Discord alerts

11 — Set up Email alerts

You need an SMTP server. Gmail, Outlook, or any SMTP provider works.

12 — Set up Telegram alerts

13 — REST API

Every request requires the X-API-Key header. Your API key was shown during installation.

Examples

# Check status
curl -H 'X-API-Key: YOUR-KEY' http://localhost:3000/health

# Get blocked IPs
curl -H 'X-API-Key: YOUR-KEY' http://localhost:3000/blocked-ips

# Unblock an IP
curl -X POST -H 'X-API-Key: YOUR-KEY' http://localhost:3000/unblock/185.220.101.42

# Get alerts from last 24h
curl -H 'X-API-Key: YOUR-KEY' http://localhost:3000/alerts?period=24hCopy

14 — Uninstall

If you need to remove Rivet from your server:

# Stop services
docker stop rivet-engine
systemctl stop rivet-responder

# Remove files
rm -rf /var/lib/rivet
rm /etc/systemd/system/rivet-responder.service

# Remove nftables rules
nft delete table inet rivet

# Remove Docker image
docker rmi rivet-engine:latestCopy

15 — Troubleshooting

Dashboard shows blank / black screen

Open browser dev tools (F12 → Console). If you see JavaScript errors, restart the engine:

cd /var/lib/rivet && docker compose up -d --buildCopy

Engine shows "stopped"

Check Docker logs:

docker logs rivet-engine --tail 50Copy

Common causes: port 3000 already in use, Docker out of disk space, corrupted database.

Responder shows "stopped"

systemctl status rivet-responder
journalctl -u rivet-responder --since "10 min ago"Copy

Common cause: responder needs root. Check it runs as root.

I blocked my own IP

Option 1: SSH from a different IP (phone hotspot) and unblock via dashboard.

Option 2: From another server or connection:

curl -X POST -H 'X-API-Key: YOUR-KEY' http://YOUR-SERVER:3000/unblock/YOUR.IPCopy

Option 3: If you have console access (Hetzner Cloud Console), log in and run:

nft delete element inet rivet blocked { YOUR.IP }Copy

Alerts not arriving

Check Settings → click "Send test alert" for your channel. If the test works but real alerts don't, the engine might not be detecting attacks yet — wait for real traffic or simulate:

# From a DIFFERENT server, try 15 fake logins (this will trigger a block)
for i in $(seq 1 15); do ssh fake@YOUR-SERVER-IP; doneCopy

Port 3000 not accessible from outside

Your cloud provider's firewall probably blocks it. Options:

1. Open port 3000 in your provider's firewall panel (Hetzner, DigitalOcean, AWS, etc.)

2. Use SSH tunnel (more secure): ssh -L 3000:localhost:3000 user@your-server then open http://localhost:3000

3. Set up Nginx reverse proxy with SSL (recommended for production).

16 — FAQ