Local-LLM fleet monitoring

Ravn

Self-hosted self-healing for Linux fleets — deterministic detection, signed and auditable remediation, and AI that explains but never decides. Runs on hosts, Kubernetes, and air-gapped networks.

Self-hosted self-healing for Linux fleets — deterministic detection, signed and auditable remediation, and AI that explains but never decides.

Ravn watches your hosts and clusters — logs, services, network, access, config drift, updates — with fast, deterministic detection: rules you can read, not a statistical model you have to trust. When something breaks, Ravn matches it against pre-authored remediation templates; a human (or signed policy) approves; a tiny privileged actuator executes typed, whitelisted capabilities — every command Ed25519-signed, verified, and audited. A small local language model runs the last mile only: turning a flagged event into a clear explanation and a suggested next check.

It runs on standalone Linux hosts, on Kubernetes, and on fully air-gapped networks — inference is local and CPU-only, so nothing has to leave your infrastructure. The healing loop executes on Linux/NixOS hosts; the in-cluster Kubernetes executor has now landed and is pending k3d end-to-end verification before release — see the roadmap.

Named for the raven — Odin’s scouts that fly out across the world and return to tell him what they saw.

The idea in one line

The LLM is never in the detection or action hot path. Deterministic tooling decides whether something is wrong; signed templates and default-deny policy decide what runs; the model only writes the explanation. A slow or wrong model degrades the wording — never the alerting, never the fix.

What / How / When

What — three planes: edge agents (ravnd) with a privilege-separated actuator, a control plane (ravn-server) with policy and approvals, and a web portal with a remediation audit trail.
How — Rust agent + server sharing one type system, NATS transport, Postgres, a React portal with a React Flow topology view, local CPU inference via llama.cpp (a shared inference endpoint is supported too).
When — see the Roadmap, which says honestly what runs today and what is still in flight.

Get started

See it in action — the Showcase walks through the live portal and a real Kubernetes OOMKill, explained by the model.
Read the Architecture and Roadmap.
Come Get Involved — issues are organised by epic with good first issue labels.
Follow the devlog below for progress, decisions, and struggles.

Devlog

All posts →

Jun 21, 2026 Production hardening, and the bugs that only showed up when we combined the branches
M6 lands: durable audit, an in-cluster K8s executor, signing-key rotation, self-observability, air-gapped install — and four real bugs that no single PR review could have caught.
Jun 6, 2026 Watch it heal itself: a one-box, GPU-accelerated Ravn demo
A self-contained demo — a NixOS host, a k3d cluster, local LLM explanations, and live self-healing — plus the half-dozen real problems we hit getting it to run on one machine.
Jun 2, 2026 Hello from Ravn
Why we're building a fleet of small local-LLM agents to watch Linux servers — and building it in the open.