Patchby NimboxSRE
For MSPs and systems teams

Your agents patch.
You sign.

Patch detects which CVEs actually affect each server for each client, lets your AI agents prepare the patch and verifies it worked. Nothing runs without a signature.

Patch prepares patches with your AI agents and verifies they work. Nothing runs without a signature.

Start freeBook a demo
No card required · Up to 5 free servers · No open ports
new_vulnerabilities → CVE-2026-31431 critical · kernel · 7 servers
4 not exposed: module not loaded
patch_plan → prepare_job → 3 servers · canary: web-01
submit_signed_job · signed In progress
get_job → 3 patched and verified · CVE no longer detected · no services down Verified
Illustrative example · agent key approved by a person
CVE-2026-31431 · 3 of 7 exposed
✓ 3 verified Verified
View full activity
new_vulnerabilities → CVE-2026-31431 critical · kernel · 7 servers
4 not exposed: module not loaded
patch_plan → prepare_job → 3 servers · canary: web-01
submit_signed_job · signed In progress
get_job → 3 patched and verified · CVE no longer detected · no services down Verified
Illustrative example · agent key approved by a person
359 of 545

CVEs ruled out by real exposure

Minutes

from patch to verification

0

open ports on your servers

The problem

Exploits do not wait for Monday.

AI has accelerated the discovery and exploitation of flaws. Kernel, OpenSSH, glibc or sudo: public exploits arrive in days, not months. An MSP with 30 clients and 800 servers cannot keep up manually or with scattered scripts.

  • Tools that are not multi-tenant.
  • Alerts that do not explain whether a CVE really affects you.
  • No mitigation while a patch is unavailable.
  • No check that the patch actually worked.
From CVE to applied and verified patch across your entire client portfolio, in minutes, with your signature and no open ports
Agents

Your agent watches and prepares. You decide how much it can do.

Connect any MCP-compatible agent with a token

Look

Query the fleet, vulnerabilities and jobs.

Propose

Leave proposals for a person to sign.

With your approval

Patch

Prepare and submit jobs signed with its own key.

How to connect

mcp add patch https://patch.nimboxsre.com/mcp --header "Authorization: Bearer pmk_…"
Verification✓ Verified
  • CVE-2026-31431 no longer detected
  • No newly failed services
  • Rebooted with kernel 6.8.0-149
DetectMatchExposureProposeSignApplyVerifyReport

Your agent watches and prepares 24/7. Three token permission levels: read only; read and propose; read, propose and patch. You approve the agent’s key. The central server never signs anything.

Real tools. Traceable work.
new_vulnerabilities

What is new since yesterday, who is affected and the verdict per server: affected, unaffected or mitigated.

get_vulnerability

Real exposure and context: who can attack, under which conditions and whether public exploits exist.

security_findings

Beyond CVEs: exposed databases, Redis or Docker API; unsupported software, failed services, broken repositories and pending reboots.

patch_plan

Separates servers with a patch, those with mitigation only and those not exploitable.

prepare_job → signature → submit_signed_job

Prepare, sign with an approved key and submit. Canary first, reboot only when needed.

get_job

Per-server results and follow-up verification.

add_vulnerability_note

Record research and decisions so nobody repeats the work.

propose_job

Without patching permission, leave a proposal for a person to sign.

How it works

Eight steps. No leap of faith.

  1. 01

    Detect

    A lightweight agent sends packages, running kernel, loaded modules, services, ports, containers and pending reboots. Outbound connection only.

  2. 02

    Match

    Match each package against public databases, CISA’s known exploited vulnerabilities catalogue and exploitation probability (EPSS).

  3. 03

    Exposure

    Patch AI judges each CVE using server facts. An unloaded module or a service that is not running changes the urgency.

  4. 04

    Propose

    Propose the version to update or a mitigation: sysctl, module blocking or package hold. A closed action catalogue, never arbitrary commands.

  5. 05

    Sign

    A person signs in the browser or an agent uses its approved key. Every server checks the signature before execution.

  6. 06

    Apply

    Pre-change snapshots on Contabo, Hetzner, OVH, Proxmox and VMware. Maintenance windows and waves: if the canary fails, the rest do not receive it.

  7. 07

    Verify

    Check CVEs, services and ports before and after. Wait for startup after reboots. Verdict: verified, applied with warnings or unverified.

  8. 08

    Report

    Monthly client reports: patched CVEs, what does not affect them and why, updates and posture. With the MSP’s brand.

Secure by design

No signature, no execution.

AI prepares. Authorisation stays with you.

Verifiable signatures

Every job has an ed25519 signature using the company key or an agent key you approved. Each server verifies it. Neither a compromised central server nor another client’s technician can execute anything.

Your key, in your browser

Generated in the browser and never leaves it. Only a password-encrypted copy is stored.

No arbitrary commands

Update, install an exact version, hold, sysctl, block modules, restart services, checks and conditional reboot. There is no “run command”.

No entry points

Encrypted outbound connection. AI drafts and proposes; execution requires a signature.

Real isolation

One database per client. Snapshot provider credentials are encrypted at rest.

Complete audit trail

Who proposed, who signed, what ran, the result and verification.

Built for MSPs

Your portfolio. Your brand. Your business.

Platform → MSP → clients. No mixed data or duplicated work.

True multi-tenancy

Each client has its own dashboard and admin or read-only users. Your team sees everything.

One pool, many companies

Allocate fixed server reservations per client or let them use spare capacity.

White label and custom domain

Logo, name and colour on the dashboard, login and reports. su-empresa.patchsre.com or patch.su-empresa.com with a certificate: add a CNAME and it is active in minutes. Available as extras.

Reports ready to send

Monthly reports for every client, with your brand and evidence of completed work.

Security centre

✓ Verified
96/100Security posture
3Verified
3Exposed
359Not exploitable
0Failed services
0Pending reboots

Vulnerabilities

  • CriticalCVE-2026-31431web-01
  • Highdb-prodnot affected: module not loaded
Illustrative example
ACME · Managed services

Monthly report

Acme Logistics

Patching, exposure and verification evidence. Ready for your client.

Illustrative example

Your Linux, covered. amd64 and arm64.

DebianUbuntuRHELAlmaLinuxRockyOracle LinuxCentOSFedoraArchAlpineopenSUSE
Pricing

Wholesale pricing. Your margin.

Per server, per month, excluding VAT. We only invoice the MSP; you resell at your own price.

Free

Start getting to know Patch.

€0
  • ✓ Up to 5 servers
  • ✓ 1 company
  • ✓ No AI
Request free access
For MSPs

MSP

Daily work across your entire portfolio.

€1.50/ server / month
  • ✓ Unlimited clients
  • ✓ AI with included allowance
  • ✓ MCP agents, verification and reports

Minimum 50 servers.

The first 10 clients are included.
Monthly estimate€150
Final amount and extras confirmed at checkout.

MSP Pro

For large-scale operations.

€1/ server / month
  • ✓ From 1000 servers
  • ✓ White label included
  • ✓ SSO and priority support
Let’s talk
Extras: White label · Custom domainContact us →

Secure card or SEPA payment · VAT invoice · Cancel anytime from your client portal

FAQ

The important questions.

Can AI execute anything on my servers?

Never on its own or without a signature. An agent can only submit jobs with patching permission and a key you approved. Each server verifies the signature.

What if a patch breaks something?

Verification detects it. A pre-change snapshot lets you roll back, and “Undo” reinstalls the previous versions.

Does it open ports on my servers?

No. The agent only establishes an encrypted outbound connection.

Can my clients see other clients?

No. Data is isolated with one database per client. The MSP team can oversee its whole portfolio.

Does it work without AI?

Yes. The Free plan works without AI; you can manage patching with human signatures.

Which agents can I connect?

Any MCP-compatible agent: a coding assistant, automation orchestrator or your own agent. It connects using a token with defined permissions.

What if there is no patch yet?

Patch proposes mitigation from its closed catalogue and keeps the CVE under review.

Can I use my own brand and domain?

Yes. White label and custom domain are available as extras. MSP Pro includes white label.

Where is the data stored?

On servers in Europe. Each client’s data is isolated.

Leave patching to your agents.

Keep decisions in your hands. Start with 5 free servers.

Start freeBook a demo