ServiceRadar
Network Management, Security, and Observability
Open-source network operations
Discovery, telemetry, flow analytics, threat intelligence, and cameras in one place. Agents keep collecting when the link drops.
Demo login demo@serviceradar.cloud serviceradar
Most teams run separate products for discovery, monitoring, flow analysis, security posture, and cameras, then reconcile them by hand. ServiceRadar puts those jobs on one inventory, one query language, and one agent.
Agents and edge collectors keep a living inventory of devices, interfaces, services, and installed software from SNMP, LLDP, CDP, Proxmox, UniFi, and more.
ICMP and TCP checks from multiple vantage points, plus OTLP, syslog, GELF, SNMP traps, BMP, and NetFlow, sFlow, and IPFIX intake.
Attribute conversations to processes, containers, and Kubernetes workloads. Map public VIPs to Services. Enrich with ASN, GeoIP, prefix tags, and threat feeds.
Falco and Trivy findings, DNS RPZ hits, and vulnerability matches land as OCSF events next to the devices they belong to.
Any IP camera, with first-party plugins for UniFi Protect, Axis, and generic RTSP. Inventory, events, and live view sit next to the network the cameras run on, and WiFi survey workflows stay attached to site context.
SRQL spans inventory, telemetry, flows, and security findings. Saved queries drive alerts, dashboards, and which agents run which plugins.
Atlas draws every device in the inventory on one server-computed map and serves it as tiles. A query like the one below marks the matching devices in place instead of redrawing the map.
(VLAN 20 OR VLAN 30) AND unavailable EXCEPT tag maintenance=true
Core issues signed schedule leases. Agents keep executing them offline, write every record to disk before anything is acknowledged, and deliver over mTLS into NATS JetStream. An ack means the data is safe, and core can tell a late result from a sweep that never ran.
How durable edge records workWhich devices are exposed to this CVE right now? Which KEV-listed hosts talked to a threat indicator in the last 24 hours? Which vulnerable listening processes took inbound connections from the internet? Exposure joins package inventory, process ownership, host- and network-observed connections, and topology so each of those is one SRQL query, with provenance on every row. A connection the network saw but a fully covered host never reported gets flagged too.
Installed software is matched centrally against NVD, CISA KEV, and VulnCheck. Flows are checked against AlienVault OTX indicators. PowerDNS RPZ hits, Falco, and Trivy findings arrive as OCSF events you can query with SRQL.
Threat intelligence and software risk
Any IP camera runs through sandboxed plugins, with first-party integrations for UniFi Protect, Axis, and generic RTSP, and no inbound path into your network. Coming next: continuous recording to S3-compatible object storage or your own disks, segmented playback straight from S3, evidence holds and exports, and real-time AI object detection delivered to live viewers.
Camera and WiFi field operationsBuild panels in the product from SRQL queries, or ship a signed React package built with the Dashboard SDK. ServiceRadar provides the host shell, SRQL execution, Arrow-backed data frames, theming, and Mapbox and deck.gl maps, so a package only has to render the view.
Dashboard SDK and custom dashboards$ npm create @carverauto/dashboard@latest \
my-dashboard -- --template react-map
$ npm run dev # HMR harness
$ npm run validate # package contract
$ npx serviceradar-cli dashboard publishCustom checks and integrations compile to Wasm and run in a capability-based sandbox with no filesystem or raw socket access. Networking goes through an agent-side proxy with admin-approved allowlists, and every host call is logged. Write them in Go or Rust, sign them, and assign them to agents from the UI.
ServiceRadar has a built-in MCP server. Connect Claude Code, Codex, Cursor, or Grok, sign in through your own SSO with OAuth and PKCE, and the agent runs SRQL queries and device lookups as your user, under the same RBAC as the UI. Automation uses client-credential tokens scoped to read and MCP, which SSO-mandated organizations can switch off. Access tokens expire after an hour.
MCP integration guide$ claude mcp add --transport http --scope user \
--client-id serviceradar-mcp \
serviceradar https://<host>/mcp
$ claude mcp login serviceradarServiceRadar Cloud runs a StarRocks warehouse as the system of record for flows, metrics, logs, events, OTel traces, MTR, and BGP. Tables live in S3-compatible object storage and compute nodes cache the hot set, so storage grows without adding compute. Retention is per dataset, set in the UI. Self-hosted deployments run the same warehouse on local disks or S3.
ServiceRadar is Apache 2.0 licensed. Bring it up with Docker Compose in a few minutes or run the Helm chart on Kubernetes. Build images, plugins, and add-ons are signed, and an SBOM ships with every build.
Standard and Enterprise will cover managed web access, agent connectivity, dashboards, backups, and higher-volume collector ingress for teams that need it. Pricing, configuration, and signup live on the control plane at control.serviceradar.cloud.
Standard
Hosted web access, secure agent connectivity, OTLP intake, dashboards, backups, and day-to-day operational workflows. Dedicated high-volume collector ingress and Enterprise SSO are not included.
Enterprise
Adds Enterprise SSO and premium high-volume ingress for direct syslog, SNMP traps, NetFlow, sFlow, and BMP collectors, alongside everything in Standard.
After launch, use the control plane for pricing and account creation. This site stays focused on the product, the docs, and the open-source path.
ServiceRadar integrates with the platforms operations teams already run.
Walk through the live demo, or book a discovery call to talk through self-hosting, sizing, and what Cloud will cover.
We can't find the internet
Attempting to reconnect
Something went wrong
Attempting to reconnect
