Remote Control — Operator

Status	Name / ID	Client	Host	User	Version	Cert	OS	Uptime	Remote IP	Connected	Last seen

Agent

Sessions

User	State	Session	Client	Idle

Commands / audit

Time	Operator	Action	Status	Detail

Patching

No patch inventory.

Hardware / software

No host inventory yet (awaiting agent report).

Mount	Free	Total	FS

Name	Version	Publisher

Time	Operator	IP	Action	Agent	Status	Command / detail

Live	Agent	Client	Score	Compliance	Missing	Sec	Installed	Fails (30d)	Oldest debt	Last install	Reboot	Last scan

Agent patches

Missing / pending

KB	Title	Class	State	First seen

Install history

Date	KB	Title	Class	Result

Live	Host	Manufacturer	Model	Serial	CPU	RAM	Disk	Software #	Collected

Host inventory

Volumes

Mount	Free	Total	%	FS

Software

Name	Version	Publisher	Installed

Version	Channel	Platform	Size	SHA-256	Published	By	ID	Actions

Create deploy link

CapAdmin only. Install one-liners stay available on this list after create (copy anytime).

Client ID Label Channel Platform Mode Max uses TTL (seconds) Notes

Install one-liners include the path token and can be copied anytime (revoke/delete to disable a link).

Status	Client	Label	Platform	Channel / mode	Install one-liner	Uses	Created	Actions

Create site token

Per-client token for the generic agent installer: ayeloop-agent.exe install /SITE_TOKEN_FILE=<file> /quiet or with RC_SITE_TOKEN set (from RMM tools prefer these over /SITE_TOKEN=<token>, which shows in process lists and logs; Linux: RC_SITE_TOKEN=<token> sudo -E ./install.sh). The token is shown once; only a hash of its secret is stored. Rotating or revoking never affects agents that already enrolled.

Treat a site token like a password. Anyone who has it can enroll a machine into this client (by default agents are active immediately). If a token leaks: rotate or revoke it here, and review new agents. To limit the impact up front, use manual approval (an admin admits each new agent; pending agents get no remote access), a max enrollments cap, or an expiry for deployment-window tokens.

Agents pending approval

Site tokens

This is the signed command allowlist the agent trusts (A3 Ed25519 opk_* public keys from operators.v1.json), not proxy Bearer API keys. Bearer keys (name, caps, fingerprint — never the secret) are listed in Proxy API keys below. The UI shows the proxy’s verified in-memory copy — the browser does not fetch the allowlist URL (it 403s/CORS and would skip signature verify). Changing who is allowed still requires rc-optrust sign-allowlist + publish. Labels are a local overlay only and do not change what agents trust.

Label	key_id	Allowlist name	public_key	Actions	Clients	Roles	Revoked

Proxy API keys

Proxy Bearer operators (separate from A3 signing keys). Config keys come from deploy/gce/.secrets.env + operators: YAML (source: config) — edit YAML and redeploy to change them. UI keys live in proxy sqlite under data_dir (source: ui); a volume wipe drops UI keys, YAML keys remain. The secret is shown once at create and is never listed again. CapAdmin can edit a live UI key’s caps and client scope without rotating the secret — keep pasting the same key.

Name	Caps	Source	Fingerprint	Scopes	Revoked	Actions