Vulnerability monitoring is now part of osctrl: opt-in software inventory from every enrolled node, matched continuously against OSV advisories, the CISA KEV catalog and, optionally, NVD CVEs, all inside your own deployment. The findings drive alerts, posture scores and patching priorities, making vulnerability management a continuous practice, which is a cornerstone for compliance.

The osctrl-mcp component extends osctrl's capabilities by exposing its read surface over the Model Context Protocol (MCP), enabling AI clients such as Claude Code or ChatGPT to inspect nodes, the osquery schema, and distributed query results through a permission-checked interface — read-only by default, with write tools gated behind an explicit switch.

The new osctrl frontend is a single-page application in React that communicates exclusively with osctrl-api. With it in place, osctrl-admin, the original web UI since 2019, has been deprecated and completely removed, collapsing the operator experience into a single, hardened API surface.

osquery and osctrl form a powerful security duo that enables organizations to query systems like databases, monitor infrastructure in real-time, and centrally manage distributed endpoints through a modular architecture with robust configuration, querying, and forensic capabilities.

The osctrl-api component extends osctrl's capabilities by providing a secure API that enables integration with other security tools, empowers automation, and allows engineering teams to build custom solutions around osquery fleet management.

osctrl is an open-source management solution for osquery that provides scalable TLS endpoint functionality with features for monitoring, configuration distribution, log collection, on-demand querying, and file carving.