Skip to content
MisterShell

Fits the stack you already run.

Sign-in through your directory, AI through your own models, security signal in and audit out to your SIEM, and automation driven by your own tooling — MisterShell connects over the standards your teams already use.

SSO: LDAP/OIDC/SAML BYO LLM IDS & syslog SIEM & IaC
What a large-scale deployment looks like
Deploy Free Try Pro / Enterprise
Audit events ready to forward to a SIEM over syslog/CEF or webhook
Audit events, ready to forward to your SIEM over syslog/CEF or webhook
What it connects to

Integrations across the platform

Identity

  • LDAP, OIDC, and SAML single sign-on, with authenticator-app or email MFA for local and LDAP accounts
  • Directory-group to role mapping — OIDC and SAML can pull group membership from LDAP
  • Multiple providers, ordered on the login page
  • AI agent platforms sign in with tokens from your own OIDC provider (Pro)

AI / LLM providers

  • Anthropic, OpenAI, and Ollama (self-hosted)
  • Azure OpenAI, Google, Mistral, xAI, Cohere, OpenRouter, and AWS Bedrock
  • You own the provider account and billing

Security telemetry

  • Passive IDS sensors stream alerts from a versioned detection ruleset you assemble from curated sources (such as ET Open), custom rules, and per-signature overrides
  • Syslog collectors ingest device and server logs — sensors and collectors are licensed add-ons
  • Both attributed to the right resource and location

Automation & IaC

  • Outbound webhooks from playbooks
  • Built-in MCP server exposing typed tools
  • Official Terraform provider and REST API

SIEM & audit

  • Forward audit events via syslog/CEF or webhook — straight into Splunk HEC if that is your collector
  • Per-destination streams (Security, Policy, API, App, and AI) with severity filters
  • Test a destination before relying on it

Observability

  • Every Core serves Prometheus metrics at /metrics
  • Cluster, fleet, task, session, and dependency health
  • Scrape into Prometheus, Grafana Agent, or any OpenMetrics collector

Storage

  • Session recordings to a local, S3, or Azure Blob object store
  • Terminal, RDP, VNC, and web sessions all replayable
  • File-catalog stores: a local root store, with S3 or Azure Blob stores attached per location so residency follows your topology

The REST API and the built-in MCP server are documented in the API reference; the official Terraform provider is on the Terraform Registry.

Worker fleet across regions with live heartbeats
Workers, sensors, and proxies — remote components that check in over a single outbound connection.
Security audit log with filters
Audit events you can forward to your SIEM via syslog/CEF or webhook.
Per-user AI token-usage reporting across registered model providers
Bring your own LLM providers — usage tracked per user across the models you register.

Get in Touch

Want a guided demo, or a trial license to evaluate Pro or Enterprise on your own infrastructure? Tell us — we'd love to hear from you.