AI & agents
NeoMG · AI agent for servers
AI agent that runs and watches servers 24/7: real-time Telegram alerts, plain-language answers, actions only after confirmation, and a web panel for the whole IT team.
By the numbers
The challenge
A production server hosting dozens of sites, Node apps and databases needed constant monitoring, but a small team can't watch logs all day, and giving an AI free access to a server is an unacceptable risk.
What I built
- Two-brain architecture: a deterministic watcher with no AI that checks everything every 60 seconds at zero token cost, and an AI analyst that investigates and explains.
- Checks for site uptime, CPU, RAM, disks, PostgreSQL and MySQL connections, SSH brute force, anomalous traffic, new ports, file integrity, SSL certificates and backups.
- MiniMax-M3 agent with about 20 typed tools: status, alerts, per-site logs, HTTP probes and a server-specific knowledge base.
- Telegram bot for the admin (/status, /alerts, /sites, /traffic, /block…) and a web IT Panel fed by NeoMG: server health, Node apps, databases, email, team and access.
- Operates Cloudflare, the firewall, databases, Keycloak, GitHub, Coolify and daily backups to Google Drive.
- Safety first: the AI only reads and proposes; every action arrives with a single-use confirmation button, fixed commands, secrets the model never sees and prompt-injection defenses.
- Learns from every incident: it proposes a lesson (cause, signal, fix) that, once approved, becomes knowledge or a new check.
Outcome
In production: the IT team sees the whole infrastructure in one panel, gets every incident on Telegram within seconds and resolves it with one tap, without handing control to the AI.
Modules
Watcher (no AI)
Dependency-free Python service running deterministic threshold checks every 60 s, with daily and weekly digests.
Analyst (AI)
Tool-using agent looping up to 8 rounds, read-only commands from a fixed allowlist and a Markdown knowledge base.
Telegram alerts
Real-time notices for outages, resource spikes, attacks and backups, with buttons to confirm or dismiss each proposed action.
IT Panel · Overview
Live CPU, RAM and disks, PostgreSQL connections by origin, failing sites, active alerts, databases and members per team.
Node apps (Passenger)
Each Node API's processes with RAM, CPU, uptime, restarts, boot failures and dropped requests per hour.
Email as a service
Each internal app registers and gets its own API key (hash only stored), with daily quota, limits and sending stats. Not reachable from the internet.
Access & team
Self-service connection approval, database requests, single sign-on (Keycloak), invitations and teams with permissions, all validated and logged by NeoMG.
Standards & quality
The same panel publishes the Development Standard and project and code-quality tracking.
Backups & limits
Daily backup to Google Drive, AI query and token caps, and the service constrained in CPU and memory.
Screenshots
