Fleet deployment · installation guide
Stand up the fleet. Enrol your estate.
Install the Secronyx fleet server, enrol your hosts as dial-in members that open no inbound ports, and connect a client that can query the whole estate from one authenticated endpoint. Four steps, read-only throughout.
What you'll build
Three roles, one authenticated door.
Callers authenticate once, at the fleet server. Members dial out to it and answer over that connection, so no endpoint exposes an inbound port. Every host still runs read-only and enforces its own scopes.
One host runs secronyx --fleet-proxy. It serves callers on :8443 and the dial-in hub on :9443, fans each call out and aggregates the replies.
Each host runs secronyx --fleet-connect as a fleet-only member. No listener. Licensed, and answering only over its outbound socket.
Claude Code or any MCP client points at the fleet server and calls fleet_run or fleet_ask across the estate.
Members: secronyx --fleet-connect · per-host agent key · licensed · scoped · no inbound port
00 · Before you start
What you'll need.
Network and ports
| Port | Direction | Source | Purpose |
|---|---|---|---|
:8443/tcp | inbound to fleet server | operator CIDR | MCP for callers (mTLS or fleet API key) |
:9443/tcp | inbound to fleet server | each member's address | dial-in hub (per-host agent key) |
:9443/tcp | outbound from each member | member to fleet server | the one connection a member needs |
| none | inbound to members | none | members expose no inbound port |
Step 1 · every host and the server
Install and verify the binary.
Put a verified binary and a licence on every host, including the one that will be the fleet server. Verify the checksum and signature before you run it.
# 1 · download the binary and its proofs curl -fLO https://secronyx.com/downloads/latest/secronyx-linux-amd64 curl -fLO https://secronyx.com/downloads/latest/secronyx-linux-amd64.cosign.bundle curl -fLO https://secronyx.com/downloads/latest/SHA256SUMS # 2 · verify the checksum and the cosign signature sha256sum -c SHA256SUMS --ignore-missing cosign verify-blob --bundle secronyx-linux-amd64.cosign.bundle secronyx-linux-amd64 # 3 · install the binary and the licence sudo install -m 0755 secronyx-linux-amd64 /usr/local/bin/secronyx sudo mkdir -p /etc/secronyx && sudo cp your.license /etc/secronyx/license # 4 · confirm it runs (--version works with or without a licence) secronyx --version
Default licence paths
| OS | Binary | Licence (default path) |
|---|---|---|
| Linux | /usr/local/bin/secronyx | /etc/secronyx/license |
| macOS | /opt/secronyx/bin/secronyx | /Library/Application Support/Secronyx/license |
| Windows | C:\Program Files\Secronyx\secronyx.exe | C:\ProgramData\Secronyx\license |
Step 2 · the fleet server
Configure and run the fleet server.
On the proxy host, create the keys that callers and members will use, declare the inventory, then start the server listening for callers on :8443 and dial-in members on :9443.
# caller key: the fleet scope plus the tool scopes they may use secronyx apikey create --file callers.json \ --name soc-analyst --scopes fleet,core,triage,logs,security # one dial-in agent key per host, named after the host secronyx apikey create --file agent-keys.json --name web-1 # prints msk_… secronyx apikey create --file agent-keys.json --name dc-1
{
"version": 1,
"defaults": { "tags": { "env": "prod" } },
"hosts": [
{ "name": "web-1", "os": "linux", "tags": { "role": "web" } },
{ "name": "dc-1", "os": "windows", "tags": { "role": "dc" } }
]
}
secronyx --fleet-proxy --fleet-inventory /etc/secronyx/fleet-inventory.json \ --transport http --listen 0.0.0.0:8443 --server-url https://fleet.example.com:8443 \ --tls-cert /etc/secronyx/tls.crt --tls-key /etc/secronyx/tls.key \ --api-keys-file /etc/secronyx/callers.json \ --fleet-agent-listen 0.0.0.0:9443 \ --fleet-agent-tls-cert /etc/secronyx/tls.crt --fleet-agent-tls-key /etc/secronyx/tls.key \ --fleet-agent-api-keys-file /etc/secronyx/agent-keys.json \ --audit-output /var/log/secronyx/fleet-proxy-audit.jsonl --enable-sensitive
Step 3 · each host
Enrol each host as a dial-in member.
On every host, drop in its agent key (printed in step 2a) and its licence, then start the member. It opens one outbound websocket to the fleet server and serves its tools over it. There's no inbound port and nothing to firewall.
# place this host's agent key (the msk_… printed for it) and its licence
printf '%s' "msk_…" | sudo tee /etc/secronyx/fleet-agent-key >/dev/null
secronyx --fleet-connect wss://fleet.example.com:9443/fleet/connect \
--fleet-name web-1 --fleet-tags env=prod,os=linux,role=web \
--fleet-key-file /etc/secronyx/fleet-agent-key \
--license-file /etc/secronyx/license \
--audit-output /var/log/secronyx/audit.jsonl
Run it as a service
# /etc/systemd/system/secronyx.service
[Service]
ExecStart=/usr/local/bin/secronyx \
--fleet-connect wss://fleet.example.com:9443/fleet/connect \
--fleet-name web-1 \
--fleet-key-file /etc/secronyx/fleet-agent-key \
--license-file /etc/secronyx/license
Restart=always
systemctl enable --now secronyx
# SYSTEM, at startup (PowerShell)
$a = New-ScheduledTaskAction `
-Execute "C:\Program Files\Secronyx\secronyx.exe" `
-Argument "--fleet-connect wss://fleet.example.com:9443/fleet/connect --fleet-name dc-1 --fleet-key-file C:\ProgramData\Secronyx\fleet-agent-key"
Register-ScheduledTask Secronyx -Action $a `
-Trigger (New-ScheduledTaskTrigger -AtStartup) -User SYSTEM
# /Library/LaunchDaemons/com.secronyx.plist
ProgramArguments:
/opt/secronyx/bin/secronyx
--fleet-connect wss://fleet.example.com:9443/fleet/connect
--fleet-name mac-1
--fleet-key-file /etc/secronyx/fleet-agent-key
--license-file /etc/secronyx/license
sudo launchctl load -w /Library/LaunchDaemons/com.secronyx.plist
Step 4 · the client
Connect your client and verify.
Point an MCP client at the fleet server, confirm your members are connected, then ask one question of the whole estate. Tool arguments are JSON. Leave out targets to reach every host, or filter by OS, tags or names.
// Claude Code, HTTP to the fleet server with a fleet API key
{ "mcpServers": { "fleet": {
"type": "http",
"url": "https://fleet.example.com:8443/",
"headers": { "X-API-Key": "msk_your_caller_key" } } } }
# who's connected? members that dialled in, with tags and reachability fleet_hosts { } # one read-only tool across hosts; leave out "targets" for all fleet_run { "tool": "get_os_info" } fleet_run { "tool": "get_os_info", "targets": { "os": ["windows"] } } # or ask in plain English and the proxy picks the tools fleet_ask { "prompt": "which hosts have Defender disabled?" }
Secure and operate
Allow :8443 from operator networks only and :9443 from member addresses only. Members need no inbound rule.
A caller can reach only the tools its key is scoped for, and each host enforces that again.
The proxy logs each fan-out, and every host logs the call under the proxy identity with the caller and run id.
One retry on transport failure. A host that fails three times is skipped for a minute (circuit_open).
secronyx apikey revoke --file … --id … cuts off a caller or member without a restart.
Keep licences current. Roll a new verified binary to your hosts and restart the service.
Ready to try it on your own estate?
Download Secronyx, read the full fleet reference, and email us for a licence. We'll get you set up with fleet mode included.