Think of it as the office
Console
An app on your computer. The AI works here, and so do you. Console holds the keys that sign every change, and they never leave your machine.
SI · Supervised Intelligence
AI does the work.
Your team holds the keys.
Supervised Intelligence for IT: the AI diagnoses and drafts the fix, a person you trust signs it, and every computer checks that signature before anything runs. Remote shell, patching, file transfer and remote desktop are at hand too.
We're letting teams in gradually. Work email addresses get priority.
Built inside a working MSP and in daily production across its client businesses.
How it works, in plain words
AI that diagnoses, patches and supports. A person signs off on every change.
You don't need to be an engineer to follow it. There are three pieces, and each has one job.
Think of it as the courier
Your proxy
Your company's dedicated proxy service, which we run for you. It carries signed instructions to your computers and keeps the records. It can deliver a command, but it can't sign one.
Think of it as the guard at the door
The agent
A small program on each computer you look after. It checks the signature on every instruction and refuses anything that isn't signed by one of your people.
One fix, start to finish
-
A printer stops working
The AI reads that computer's logs and finds the print service has crashed.
-
It proposes the fix
"Restart the print service on FRONT-DESK-02." Nothing has run yet.
-
You say Aye
Console signs that one command for that one computer, and the proxy delivers it.
-
The agent checks, then runs
Right signature, right computer, still fresh: it runs once, and the whole thing is in the audit trail.
Getting started
We start your dedicated proxy service.
Install Console: your signing keys are created on your computer and never leave it.
Send the install link to put the agent on each computer. Agents connect out, so there's nothing to open on your firewall and no VPN.
Three pieces
Your Console. Your proxy. Your agents.
Console is where you and the AI work. The proxy is your company's dedicated proxy service in the cloud. The agent runs on every computer you look after.
Your desk
AyeLoop ConsoleOn your computer. Your signing keys are created and kept here.
AI assistantReads logs, inventory and docs. It can only look until you say Aye.
Add a Console for each technician. Each one has its own keys.
The AI runs inside Console, on your own Claude, Codex or Grok subscription.
AyeLoop cloud
Your dedicated proxyYour company's dedicated proxy service. It delivers signed commands and keeps your inventory and audit trail.
It holds no signing keys, so neither the proxy nor AyeLoop staff can run a command on their own.
Computers you look after
- Client A · office12 PCs and a file server, with the AyeLoop agent on each.
- Client B · remote staffLaptops at home and on the road.
- Your own officeWorkstations and a domain controller.
Every agent checks your signature before it runs anything. Agents connect out to your proxy, so there are no ports to open and no VPN.
For MSPs
Every client, one Console, and your team holds the keys.
Built inside a working MSP. Priced per endpoint, like you bill: no per-technician fees and no add-on charge for remote desktop.
Hard client isolation
Tag every endpoint with its client. Scope each technician and AI session to specific clients. Isolation is enforced by policy on the proxy, not left to a prompt or a naming convention.
AI does the level-1 legwork
Triage, log digging, drafting the script. AI works from each client's docs and inventory, so your techs review fixes instead of hunting for them.
One tool on the bench
Remote shell, on-demand remote desktop, patching, inventory, file transfer, event logs, client docs and credentials all live in one Console.
Unlimited technicians and clients
Per-client docs and credentials, in the same app you work in, and a real answer to your clients' security questionnaires.
For IT teams
Least-privilege remote IT without slowing the team down.
Give everyone the access they need, and no more. Flat monthly tiers for one organization.
Propose and approve
Helpdesk staff and AI assistants get read access plus the ability to propose. Admins approve the exact command before it runs. Each grant works once, then expires.
Domain controllers stay human-gated
Diagnose servers and DCs with read-only event logs and inventory. Any change needs a signature from an admin you trust, checked on the server itself.
Evidence, not screenshots
Every proposal, approval and command is logged with the technician's name and the target machine. That makes audits, cyber-insurance renewals and incident reviews faster.
Your own proxy, not a shared cloud
Each customer gets a dedicated, isolated proxy. Agents connect outbound only. Signing keys stay in Console on your admins' machines.
The AI
AI does the legwork. You still say Aye.
Console runs Claude, Codex or Grok on your own subscription. The assistant reads inventory, event logs and the client's docs, researches the problem, then drafts the fix. Before it runs, a technician sees the exact command and target.
- Read-only by default. Changes always wait for a grant.
- Credentials never enter the chat or the transcript.
- Each session is scoped to one client's machines and docs.
- Grants expire within minutes and work only once.
Zero-trust by design
A server that never has to be trusted.
In most remote-management tools the server holds all the power: whatever it sends, every endpoint runs. AyeLoop splits that power. The server relays commands, keeps inventory and records the audit trail, but it holds no signing keys. Every command sent to an agent is signed in your Console, even reading a file or checking system info, and the agent checks the signature before it does anything.
Typical RMM
The server holds the power. Whatever it sends, every endpoint runs.
AyeLoop
Your Console holds the power. Agents check its signature on every command, reads included. AyeLoop staff can't sign either.
What needs a signature
Signed in your Console
- Run commands and scripts
- Read, search or download files
- Upload or change files
- System info and event logs
- Install patches
- Turn remote desktop on or off
- Use stored credentials
- Agent updates
The AI's read-only checks use a read-only key you approve once. Anything that changes a computer waits for a technician's Aye.
Sent by the agent on its own
- Inventory
- Patch status
- Regular check-ins
The only things that travel without a signature are the reports agents send up on their own: inventory, patch status and regular check-ins.
Product
Everything your techs reach for, in one agent and one app.
One lightweight agent per endpoint. It connects outbound only, so no inbound firewall ports need opening. One Console app for your team.
Remote shell
PowerShell, cmd and bash on any endpoint. Signed, time-boxed and audited.
Remote desktop
On-demand helpdesk sessions to the user's screen on Windows. Turned on per session with a one-time password that expires.
Patch management
Windows Update inventory, a patch score per machine, and installs that run in your maintenance windows, with no surprise reboots.
Inventory
Hardware and software for every endpoint, grouped by client or site.
File transfer
Large, resumable, checksum-verified transfers. They go straight to the endpoint when the network allows.
Event logs
Query Windows event logs across machines, including domain controllers, without opening RDP.
Client docs
Documentation spaces per client, encrypted in Console before they sync, so the server stores only ciphertext.
Password manager built in
Link 1Password vaults to clients. The credential is fetched at approval time and sealed to the endpoint. The AI never sees it.
Tray chat and tickets
An optional tray icon lets users chat with your team or open a ticket, and each ticket includes the device's details.
SSH jump
Reach switches, firewalls and hypervisors through an agent on the same network.
Signed agent updates
Roll agent updates out in rings. Agents verify each update's signature before installing it.
Audit trail
Every proposal, grant and command, with the operator, the machine and the time.
Agents for Windows, Windows Server, Linux and pfSense/FreeBSD. macOS is on the roadmap.
Pricing
A dedicated proxy for every customer. Straightforward pricing.
Every plan includes your own isolated cloud proxy, Console, the agent, remote desktop, patching, docs and AI sessions (you bring your own AI subscription).
For MSPs
Per endpoint, with unlimited technicians and clients.
MSP Partner
$2 / endpoint / mo
$200 / mo minimum
- Unlimited technicians
- Unlimited clients, isolated by tag and scope
- Every feature included
- Guided onboarding and migration help
MSP Volume
1,000+ endpoints
Volume per-endpoint pricing
- Everything in Partner
- Larger dedicated proxy
- Staged migration plan
- Priority support
For IT departments
Flat monthly tiers for one organization.
Starter
$99 / mo
- Up to 50 endpoints
- 3 admins
- Every feature included
Team
$249 / mo
- Up to 150 endpoints
- 10 admins
- Every feature included
Organization
$1.75 / endpoint / mo
- 150+ endpoints
- Unlimited admins
- Larger dedicated proxy
- Priority support
Prices are in USD. We're opening AyeLoop to teams gradually: join the waitlist and we'll email you when there's a place for you.
Questions
What IT buyers ask us.
Is this an RMM?
Yes. It covers remote shell, remote desktop, patching, inventory, file transfer and event logs. The difference is that every command to an agent is signed in your Console, and the agent checks that signature itself. The server never gets to decide on its own.
Does the server have to be trusted?
No, and that's the point of the design. The proxy relays commands and stores inventory and the audit log, but it holds no signing keys. Agents only accept commands signed with keys created in your Console.
Can AyeLoop staff run commands on my machines?
No. We host and operate your dedicated proxy, but we can't sign as you. Every command needs a key from your Console, and changes need one of your technicians.
Can I run it alongside my current RMM?
Yes. The AyeLoop agent installs next to your existing tools, so you can move clients or departments over at your own pace.
Do I have to use AI?
No. AyeLoop is a complete remote-management tool without AI. If you do turn on AI sessions, they use your own Claude, Codex or Grok subscription and can't change anything without a technician's approval.
Where do credentials and keys live?
Signing keys live in the Console vault on the technician's machine. Credentials stay in your password manager until someone approves a command that needs them. They are then sealed to that one endpoint for that one command.
What do I install on endpoints?
The AyeLoop agent. It runs as a service, connects outbound to your dedicated proxy, and runs a command only when it carries a valid signature from your Console. It's authorized remote management that you control. It is not a hidden backdoor.
Join the waitlist
Your own dedicated proxy, set up for you.
We're letting teams in gradually. Join the waitlist and we'll email you when there's a place for you; we then set up your dedicated proxy for you. Work email addresses get priority.