Security
The agent runs on your servers, so it is built to earn that.
Outbound-only, no attack surface
The gpr agent opens no listening port and accepts no remote commands — ever. It only makes outbound HTTPS requests to the control plane, so there is nothing new to attack on your server.
Least data, never your logs
It reports host metrics, process and dependency liveness, and a bounded (≤32 KB) slice of error context attached to an incident — never your logs wholesale. Cost and exposure scale with incidents, not log volume.
Secrets are protected
Agent tokens are stored only as hashes; alert-channel secrets are encrypted at rest with a key held in platform secrets. Captured output is redacted before it is ever buffered or sent.
Bounded and memory-safe
Every buffer, queue, and log ring is capped, so the agent can't fill your disk or exhaust memory (ceiling ~20 MB RSS, ~1% CPU). It is written in Rust with unsafe banned in our own code.
Open source, stable contract
The agent is open source (MIT) — read exactly what runs on your server. The wire protocol is documented and versioned; v1 never breaks, so an agent a year stale keeps working.
It never changes your job
gpr run passes the wrapped command's exit code through unchanged, including signal termination. Wrapping a job to monitor it never alters its behavior.