Umbra
Start free
← All docs

Internal agent (one-line install)

5 MB Go binary. Linux amd64/arm64, macOS Apple Silicon, Windows amd64. Outbound HTTPS only.

Last updated May 27, 2026

What it is

A small Go binary the customer installs on any host inside their network. It opens an outbound HTTPS connection to Umbra and waits for work: port-scan a subnet, HTTP-probe a service, relay AI exploit requests. Everything it discovers feeds the same dashboard pipeline as your external scans.

What it produces

  • A registered agents row in your workspace, with heartbeat-driven health state (healthy / stale / offline)
  • Hosts + services discovered by the agent, tagged discovered_via_agent_id so the UI can show the provenance
  • An audit trail of every action the agent took, on the customer’s network, on Umbra’s behalf

What to use it for

  • Internal networks (RFC1918) the cloud can’t dial directly
  • Customer / acquisition networks reachable only via VPN
  • Production environments where you don’t want a third party scanning from outside
  • DMZ probing where you want the scanner closer to the target

Why it matters

The most expensive blind spot for a security team is “everything inside the perimeter.” Without an internal agent, that’s a manual inventory you redo every quarter. With one, internal services flow into the same dashboard, get the same fingerprinting / CVE / AI-validation treatment, and appear under the same filters as external assets, distinguishable by one token (internal:true).

Why it’s valuable

  • 5 MB stripped Go binary. No runtime, no dependencies, no daemonisation framework. Drop it on the host, point it at Umbra, done.
  • Four platforms. linux amd64 / arm64, macOS Apple Silicon, windows amd64 (all cross-compiled in CI).
  • No inbound port. No firewall changes. No VPN. Outbound HTTPS to Umbra is the only requirement.
  • Tenant-scoped at enrollment. Compromised agent credential can act only on its own workspace’s surface, never another tenant’s.

How to use it

  1. Admin → Agents → Generate enrollment token. Pick a label, optional expiry. The plaintext is shown ONCE.
  2. Pick the OS from the dropdown (linux amd64 / arm64 / mac / windows).
  3. Copy the install command: a single curl line that downloads the binary, sets env vars, and runs the agent.
  4. Paste on the target host. Watch the agent appear in the Connected agents table within ~2 seconds, in the healthy state.

For long-lived deploys, wrap in systemd / docker / launchd. The agent is designed to run as a daemon and exits non-zero only if its credential is revoked.

Related: