A single, auditable pattern powers every action Kllyroo can take on your infrastructure: an admin clicks approve, the action is queued to the specific server it applies to, and the agent carries it out on its next check-in. Nothing runs without that click — ever.
An agent that can autonomously block an IP or push its own update is powerful — and also a single false-positive away from blocking a real customer, or a single bug away from bricking a fleet of agents at once. Kllyroo deliberately doesn't take that trade. Every state-changing action starts with a person looking at the actual evidence and clicking a button. The system automates everything after that click: queuing, delivery, execution, and reporting back — not the decision itself.
Block this IP from a security alert, or click Update Agent next to a version badge — the click itself is the approval, made in context.
A row is written to a shared commands table, scoped to the exact server the action applies to — not broadcast fleet-wide.
No separate push channel or open inbound port — the agent asks "anything pending for me?" as part of the same poll it already performs, and executes what it finds.
Success or failure is written back through a lightweight reporting endpoint, so the admin sees the outcome — not just that a click happened.
The dashboard shows a "vX.Y available" badge when a server's live agent version is behind. Clicking Update Agent queues the update through the same mechanism above. On the agent side, the download and verification step is kept strictly separate from the actual file swap — and the file swap itself is deliberately the very last statement the script executes, after everything else for that run has already completed and reported back.
That ordering is what makes it safe for a running bash script to overwrite its own file: nothing after the swap depends on the old file contents still being there, because there is nothing after it. A backup of the previous version is kept in case a rollback is ever needed.
Covered in full on the Security Detection page — the "Block this IP" button on an alert uses this exact mechanism. It's the same queue, the same per-server scoping, the same reporting-back — just a different command.
Offices in India and the US — reach out and we'll get back to you.