45dgof8
🛡

nomad

See every autonomous agent on your machine.
Catch them before they disappear.

Get Started See Features
3
Layers Scanned
30s
Default Interval
<5MB
Footprint
0
Cloud Required
Linux-first · macOS drift detection works too · Security hardening is Linux-only
Why This Exists

Something new is happening on your machine — and on every machine connected to the internet.

AI agents are no longer just chatbots. They are programs that act on their own. They spin up Docker containers, open ports, start services, run tasks, then shut down and vanish. Minutes later, they appear somewhere else — different name, same behavior.

This is not a hypothetical. It is happening right now, on systems running tools like AutoGPT, CrewAI, LangChain, and custom-built agent frameworks. Some are harmless experiments. Some are not.

An agent can spin up a container, run code inside it, expose a port to the internet, serve a task for five minutes, then kill it and move on. By the time you notice, it is gone — and a new one has appeared somewhere else on your system.

If you are not looking, you will never see it happen.

nomad is the thing that looks. It scans your machine every 30 seconds, fingerprints every process and container, scores each one for agent-like behavior, and tells you — instantly — when something is drifting.

Live Output
What nomad sees when it catches a drifter
nomad scan — 07:22:35 UTC
────────────────────────────────────────────────── Containers: 3 Services: 41 Processes: 392 🟢 New containers: autogpt-executor-42 🚨 DRIFTERS DETECTED: 1 🟡 container autogpt-executor-42 score=0.60 [alive] reason: agent name patterns: executor, autogpt evidence: Ports: 0.0.0.0:8888->8080/tcp evidence: Running agent container on host Mode: monitoring (dry-run)
System Security Pro
nomad watches for agents. sec-toolkit hardens your system.

Detecting agents is only half the battle. If your system has open ports, missing firewalls, weak kernel settings, or no auto-updates — it's already exposed.

nomad Pro integrates with sec-toolkit.sh — a hardened Linux security baseline that checks UFW, AppArmor, sysctl, SSH, and auto-updates. Run nomad security and get a single posture score alongside your drift detection. Includes harden, verify, scan, and firewall setup.

Free tier includes read-only security posture check. Full sec-toolkit integration (harden, verify, scan, fw) requires Pro.

Before installing anything, back up your system.
Timeshift makes system snapshots that take seconds to create and minutes to restore.

sudo apt install timeshift — then create a snapshot before you harden.

Features
Everything you need to catch the drifters
🔍
Multi-Layer Scanning
Scans Docker containers, systemd services, and all running processes in a single pass. No agent to install — reads what the OS already knows.
🧬
Behavioral Fingerprinting
Scores every entity on agent naming patterns, API keys in command lines, ephemeral lifetimes, volatile states, and exposed ports.
🔄
Migration Detection
When something dies and a near-clone spawns elsewhere — same image, same ports, same user — nomad flags the migration with similarity scores.
📱
Telegram Alerts Pro
Instant push notifications with drift scores, evidence, and migration paths. Set up in under 2 minutes with the interactive wizard.
🌐
Web Dashboard Pro
Dark-themed real-time dashboard showing drifters, migrations, and system state. Auto-refreshes every 10 seconds.
🛑
Optional Blocking Pro
Enable block mode to automatically kill high-confidence drifters (>0.85 score). Dry-run by default — your choice.
🛡️
Security Posture Pro
Full sec-toolkit.sh integration — harden, verify, scan, and firewall setup. Free tier includes read-only posture check.
How It Works
From scan to alert in 4 steps
01
Scan
Reads Docker, systemd, and process tables via native APIs. No polling overhead — just a fast snapshot.
02
Diff
Compares against the previous snapshot. New containers? Gone services? Spawned processes? Flagged instantly.
03
Fingerprint
Every entity gets a drift score (0–1) based on name patterns, API exposure, lifetime, and resource usage. Known infrastructure is excluded.
04
Alert Pro
High-confidence drifters trigger Telegram alerts with full evidence. Optionally block them automatically. Free tier logs to file.
Drift Scoring
How nomad decides what's a threat
0.0 – 0.4 Known infrastructure SAFE
0.4 – 0.6 Unlikely agent — logged WATCH
0.6 – 0.8 Suspicious activity SUSPICIOUS
0.8 – 1.0 High confidence drifter ALERT
Pricing
Start free. Upgrade when you need more.
Starter
Free
forever
  • Single machine scanning
  • Docker + systemd + processes
  • CLI + fingerprint mode
  • Security posture check
  • File-based alert logs
  • Community support
Download Free
Team
$49/mo
up to 10 machines
  • Everything in Pro
  • Multi-machine dashboard
  • Custom agent patterns
  • Webhook integrations
  • Audit log export
  • Dedicated support
Contact Sales
Get Started
Running in under 60 seconds
terminal
# Back up your system first (recommended) $ sudo apt install timeshift $ sudo timeshift --create --comments "before nomad" # Clone and install $ git clone https://github.com/45dgof8/nomad.git $ cd nomad && bash install.sh # Run your first scan $ python3 cli.py scan # Check system security posture $ python3 cli.py security # Start continuous monitoring $ python3 cli.py watch # Open the dashboard $ python3 dashboard.py → http://localhost:5010
Stop Guessing. Start Detecting.

Your infrastructure is already running agents. nomad tells you which ones.

Get nomad Free