Agents
Monitor the things the public internet can't reach.
A check from the public internet only sees what the public internet can see. CuliPulse agents run inside your network — on a server, a VM, a container — so you can watch private databases, internal APIs, LAN devices, and anything else that never sees a public IP. No VPN tunnels. No firewall holes. Just a small process that calls home.
No credit card · free plan forever
The things cloud monitors miss
Private databases, internal APIs, LAN devices — watched from inside.
A public-internet monitor can only reach what's publicly routable. That leaves out your internal Postgres instance, the Redis cluster on your private subnet, the API gateway that only accepts traffic from within your VPC, and every router, switch, or device that sits behind a firewall. An agent on your network can reach all of them.
Watch MySQL, Postgres, Redis, MongoDB, and any other database that listens on a private IP — TCP connection or ICMP ping. No need to open them to the internet.
Monitor HTTP endpoints that only respond to traffic from inside your network — staging APIs, internal dashboards, health endpoints that aren't public-facing.
Ping routers, switches, and hardware devices on your local network. Get packet loss, RTT, and jitter — not just a red/green light.
Nothing opens inward
Outbound-only. No inbound firewall rules. No ports to open.
The agent connects out to CuliPulse over HTTPS, picks up its schedule, runs the checks, and sends results back — all over the same kind of outbound connection your browser uses. No inbound traffic. No listening port. Nothing for an attacker to probe from outside.
Outbound HTTPS only, so your firewall rules stay the same, and no port listening on the agent. Its token is shown once at enrollment, belongs to your account only, and you can revoke the agent from the console at any time.
Check results (up or down, timing, packet loss), a regular check-in with its version, architecture, capabilities and discovery settings, and discovery results only if you turn discovery on. Never the content of the responses it checks, and no credentials or other settings from the machine it runs on.
Run it anywhere
Docker, a one-liner, or Kubernetes — up in under a minute.
The agent is a single small binary — no runtime, no dependencies. Run it as a Docker container, a native systemd service (no Docker needed), or on Kubernetes — whichever fits your stack — on amd64 or arm64.
docker run -d --name culipulse-agent --restart=unless-stopped --network host --cap-add=NET_RAW \ -e CULIPULSE_API_URL=https://culipulse.dev \ -e CULIPULSE_AGENT_TOKEN=<your-token> \ ghcr.io/culipulse/agent:latest
Works with Docker Engine or Docker Desktop, and restarts automatically. With Docker Engine on Linux, --network host lets it check services on the same machine (like a database on 127.0.0.1), and NET_RAW is there for ping.
curl -fsSL https://culipulse.dev/install.sh \ | sudo CULIPULSE_API_URL=https://culipulse.dev CULIPULSE_AGENT_TOKEN=<your-token> sh
Installs the agent as a native systemd service — no Docker required. Downloads a small static binary (amd64/arm64), runs it under a dedicated user where the system allows, with raw-socket access for ICMP, and restarts automatically. The installer is tested on Ubuntu, Debian, Amazon Linux, Rocky and Alpine, and works on bare-metal or a VM. On a system without systemd (such as Alpine) it installs the binary and you run it under your own supervisor.
# The Connect screen generates the manifest for you.# Copy the YAML (Secret + Deployment), then apply:kubectl apply -f agent.yaml
The console's Connect screen generates a ready-to-use manifest (Secret + Deployment). Paste it into a file and apply it — or pipe it directly with kubectl apply -f -. It runs as a single agent per cluster.
Connected in seconds
Paste the token, run the command, watch it go green.
- Name it
Enroll an agent in the console: a name and a label for where it runs.
- Run the command
Copy the Docker, Linux or Kubernetes command with your token already filled in. The token is shown once — store it, or regenerate it later.
- Watch it go green
The agent checks in within seconds and lists what it can check (HTTP, TCP, ICMP, UDP). Monitors you assign are picked up on its next check-in — every 30 seconds by default — with no restart and no reload.
Real-world setup: monitoring internal services behind a firewall.
Your private network, finally watched.
Add an agent to any machine on your network, assign monitors to it, and get the same reliable alerts you'd expect for a public website — for every private service you depend on.