vm-vitals
open source · read every line

what it sends.

Every 30 seconds the agent POSTs one JSON document to vm-vitals.vercel.app/api/ingest. Run vm-vitals once on the box to print that exact document. The full list of fields is in types.go.

sent

  • Hostname, OS, architecture, kernel or macOS version, uptime, agent version.
  • CPU percent and core count. Load averages. Memory and swap totals and usage.
  • Per-disk mount point, filesystem type, size and usage. tmpfs, overlay and friends are skipped, except when one of them is the root.
  • Network bytes per second in and out, summed across non-loopback interfaces, plus totals since boot.
  • Top 8 processes by CPU: pid, executable name, CPU percent, memory percent, resident memory.
  • Linux only: the kernel OOM kill counter and, when the journal is readable, "Killed process N (name)" fragments.
  • Which of a fixed list of CLIs are on PATH (claude, codex, gemini, grok, aider, node, python3, docker, gcloud, tailscale and a few more), their path, and the first line of their --version output.
  • Running agent jobs: tool name, pid, CPU, memory, how long it has run. Helper child processes are folded into their parent.

never sent, never read

  • File contents. The agent reads /proc and asks ps, sysctl, vm_stat and netstat for numbers. The only directory it lists is /Volumes on macOS, to find mounted disks.
  • Keystrokes, the clipboard, the screen, prompts or chat logs.
  • Environment variables. The agent reads PATH and HOME and nothing else, and probes tools with a minimal environment.
  • Command-line arguments. It keeps the basename of argv[0] and argv[1] to spot node cli.js style launches and drops the rest before storing anything.
  • API keys, tokens, git remotes, usernames, IP addresses, open ports or connections.

on the server

  • Samples are kept 7 days. The latest full report is kept per machine. Alerts and incidents stay until you delete the machine.
  • Machine tokens are stored hashed. Pair tokens expire after 24 hours.
  • A machine is private to the browser that paired it until you flip on sharing. The public page shows the same numbers, so don't share if your hostname is a secret.

Spot something that contradicts this page? That's a bug. Please report it privately.