SkaiBridge puts a secure relay agent on every server you own and connects them to AI-powered automation. No VPN. No credential sprawl. No compromises.
Traditional approaches to AI infrastructure access involve sharing SSH keys, exposing management APIs, or piping everything through third-party clouds. SkaiBridge solves the trust problem without the risk.
Agents authenticate via HMAC-SHA256. No SSH keys, no API tokens, no passwords leave your network. The control plane never holds your secrets.
Strict tenant isolation at every layer - database, API, and agent key namespacing. One control plane, many customers, zero crossover.
Every command passes through a profile-gated allowlist before execution. Standard, power-user, and unrestricted profiles. Destructive commands are always blocked.
Native agents for Linux and Windows Server. Linux agents run bash. Windows agents run PowerShell with WinRM support for remote hosts.
Agents heartbeat to the control plane and self-update their executor via Gitea. If a process dies, PM2 or node-windows respawns it automatically. Command allowlists stay current the same way - edit the policy once centrally, and every agent picks it up within 24 hours with no one touching a host by hand.
Every command, every agent, every tenant - logged. Per-agent audit logs locally and surfaced in the central dashboard for compliance and forensics.
SkaiBridge isn't married to one AI vendor. Point it at Claude, GPT, Gemini, Grok, or a fully local open-weight model - the relay, the guardrails, and the audit trail work identically no matter which model is doing the reasoning.
Insight doesn't reason from a blank slate. Before it writes a diagnosis, it checks your fleet's own detection history for real past occurrences of the same problem, and for patterns mined nightly from your own incidents - "X happens, Y follows 67% of the time within 72 hours." Every fact it's handed actually happened on your infrastructure. Nothing is shared across tenants, and nothing is invented to fill a gap.
The model reasons over your logs - it doesn't get to freelance. Even where automated response is enabled, execution runs through a fixed, human-approved template against a narrow allowlist you control, never a command the AI wrote itself. Anything outside that allowlist stops for a human to approve before it touches a system.
The agent on your servers only reads, unless you opt in to a specific remediation. Every command it runs is checked against an allowlist you control and recorded with who ran it. The agent is never published: it can only be downloaded with your own install token or agent key.
Every automated response starts as a template you author, see previewed exactly as it will run, and dry-run before it ever touches a live host. There's no path from "AI noticed a problem" straight to "AI changed something."
Agents keep a rolling history of what they're actually talking to on the network. When something breaks, SkaiBridge diffs current connections against that recent history to surface which dependency just disappeared - so an investigation starts from a short list of likely culprits instead of a blank slate, cutting time to root cause.
Push your fleet's key health metrics into Grafana Cloud, or any OTLP-compatible backend you already run, over the standard OpenTelemetry Protocol. Destinations and credentials are configured per tenant, encrypted at rest, and gated off by default - nothing leaves your control plane until you turn it on. No agent changes, no new infrastructure on your side: it reads from data SkaiBridge already centralizes and speaks the same open standard your existing observability stack does. The default export covers host basics, certificates, backups, mail, Docker, virtualization storage and database health.
Docker hosts report container counts, per-container CPU and restarts, images, volumes and reclaimable disk space on every check. Podman hosts get the same, plus checks for the failures Podman is known for: containers on a shared network that can no longer resolve each other by name, a firewall reload that silently cuts container networking, containers that will not come back after a reboot, and containers running out of memory against their limit. VMware vCenter, Proxmox VE and Microsoft Hyper-V each get their own section in Fleet Metrics, shown only when you actually run that platform, so a fleet with no hypervisors never sees an empty panel. Hyper-V is an optional module.
Open Grafana from the SkaiBridge dashboard and you are already signed in, in a Grafana space that belongs to your organization alone, with a fleet dashboard ready and your servers' metrics read straight from SkaiBridge. Nothing to export, no Grafana accounts to manage, and no way to see another customer's data. Already run your own Grafana? Point the Grafana buttons at it instead.
Cluster health seen from the Kubernetes API: nodes not ready or under pressure, pods crash-looping, failing to pull images or stuck pending, workloads below their desired replicas, failed jobs, and storage claims that never bind. Diagnostics such as kubectl describe and get run from the collector with a read-only account, never on your nodes. Nothing in your cluster is changed.
Every model call SkaiBridge makes on your behalf - token counts, latency, model identity, success or failure - exports as a standards-based OTLP trace. Each span carries the official OpenTelemetry GenAI attributes alongside an OpenInference-compatible attribute set, and is aligned with OpenLLMetry's own semantic conventions, so it shows up correctly in the LLM observability tooling you already run, not just SkaiBridge's own dashboard. Prompts and completions are never included, by design - only the metadata leaves your control plane, over the same per-tenant, encrypted, gated-off-by-default destination as your fleet metrics.
Detections open a ticket automatically - in Relay Labs' own support queue by default, or in your own ITSM instead, configured per tenant through a provider-routed architecture built to support more than one destination. ServiceNow is live today, and BMC Remedy / Helix ITSM, Jira Service Management, Zendesk, Freshservice and ManageEngine ServiceDesk Plus are available in beta. ServiceNow: SkaiBridge creates, closes, reopens, and annotates incidents with the credential encrypted per tenant and every write verified against what ServiceNow actually saved, not just an HTTP 200. SkaiBridge also polls your instance for changes made there directly: closing a ticket in ServiceNow closes the matching event back in SkaiBridge, and work notes, comments and assignment changes made in ServiceNow appear on the event, naming who made them. Further ITSM platforms can be added on that same architecture.
Send detections, audit events and fleet metrics straight into Splunk (HEC), any syslog collector over TLS, or an HTTPS endpoint as newline-delimited JSON - or pull them yourself from a read API. Destinations and credentials are set per tenant, encrypted at rest, and off until you turn them on.
Every metric alerts across four levels - warning, minor, major and critical - with sensible defaults you can override per metric family or per host. Leave them static, or let SkaiBridge learn each host's normal range and alert on deviation from its own baseline. A built-in re-arm keeps a metric hovering at the line from spamming you.
Point SkaiBridge at a URL and it checks it on a schedule - status, response time, page content and certificate days left - from the control plane, or from an external probe outside your network for addresses the control plane cannot reach. It opens a detection when an endpoint keeps failing and closes it, ticket included, when the endpoint recovers. Same event lifecycle, same ticketing, same dashboard as everything else.
Fleet health, events and incidents with mean time to resolution, remediation, change and audit, and security posture reports render as PDF, HTML or CSV and go out on a schedule to whoever needs them - no one has to log in to pull them. Build your own custom reports too: pick the metrics, the servers and the date range, save it, and schedule it like any other report.
Dashboard accounts can require TOTP-based two-factor authentication with one-time recovery codes, and repeated bad attempts lock an account automatically. Standard authenticator apps, no extra service to run.
Beyond the built-in checks, your team can author its own - a shell or PowerShell check that's reviewed and approved before it ever runs, then scheduled like any native metric. Route the alerts wherever you need: your ITSM, your SIEM, email, or a signed webhook into your own tooling.
Every event lists suggested diagnostics that run on the affected server with one click - read-only, with the output kept on the event and in its ticket. When something needs fixing, such as starting or restarting a service, a process or a container, request the fix from the same screen: a second person approves it, and it runs once, on that one server, signed for that exact command. A one-person team can approve its own fix with password and authenticator code, and every outcome is audited. Fixes you trust can also run automatically, after preview, dry run and approval.
Install the agent and disk, memory, CPU, network, certificates, backups, patches and uptime report immediately on Linux and Windows, with nothing to configure. Databases, directory and mail, virtualization and container platforms are discovered and checked automatically. More than 70 metric families ship with sensible alert levels you can change, and add-ons extend the same views to Kubernetes, Hyper-V, security detection and automated remediation.
Closed events can be archived to your own S3-compatible bucket or SFTP server and removed from SkaiBridge - by hand whenever you choose, or automatically after 90 days, or the period you set, once you opt in. Nothing is deleted until its archive copy has been stored and checked, and every run is audited.
Start with VFR for monitoring and automation. Upgrade to AutoPilot when you are ready to put AI in the loop.
Pricing announced at GA. Early access customers receive founding rate lock.
The SkaiBridge Gateway is a self-hosted inference appliance that runs the AI reasoning layer entirely inside your network - connected or fully air-gapped. Built for regulated, classified, or security-conscious environments where sending logs and infrastructure data to SkaiBridge Control Plane isn't an option.
In air-gapped mode, nothing leaves your network - not prompts, not logs, not infrastructure data. Model and configuration updates move by signed, checksummed bundle instead of a live connection.
Run connected, with the gateway pulling signed updates over the network, or fully air-gapped, importing the same signed bundles by physical media. Mode switching is a deliberate, audited action - never a silent toggle.
The Gateway runs Mistral, an Apache-2.0-licensed model from a French company with no adversarial-government ties - not a black-box API call to a vendor you're asked to trust blind.
Every model and configuration update ships as an Ed25519-signed bundle with atomic apply and rollback. If a bundle doesn't verify, it doesn't install - proven in production, not just on paper.
Allowlist enforcement, rate limiting, and full audit logging run on the gateway itself - the exact same trust model as cloud-connected SkaiBridge, just with nothing leaving the building.
GPU-tier appliances pair with a CPU-tier standby for automatic failover, health-checked at the inference engine itself - not just a ping. Dual-GPU HA is available for workloads that can't tolerate degraded throughput.
Relay Labs supplies the Gateway appliance - the server hardware, the GPUs and the VM image - sized to your fleet and concurrency needs. Talk to us and we'll help you pick the right tier.
One command and a single-use install token deploy a SkaiBridge agent on any server; unused tokens can be revoked at any time. The agent registers with your organization and starts reporting immediately over a single outbound HTTPS connection, so no inbound firewall rule is needed.
Commands are gated by profile - standard, power-user, or unrestricted. Destructive operations are always blocked. You control exactly what the agent can and cannot execute.
With SkaiBridge AutoPilot, AI models communicate through the relay. Natural language becomes allowlist-validated shell commands with every token tracked and every action audited.
Fleet health, agent heartbeats, command history, and token consumption in real time. Multi-tenant - each customer sees only their own infrastructure.
Relay Labs LLC was founded by a team of systems architects and systems engineers with deep roots in managed cloud, enterprise data center operations, and large-scale systems engineering.
SkaiBridge is the product we wished existed when we were managing hundreds of servers and needed AI tooling that could actually touch the infrastructure - safely, auditably, and without handing over the keys to the kingdom.
We operate our own managed cloud at CyrusOne DUR1 in Durham, NC. SkaiBridge runs in production on our own servers before we ever ask you to trust it with yours.
SkaiBridge is in active development and accepting early access requests. Founding customers get a rate lock, direct engineering access, and input on the roadmap.