This monitoring agent is built to receive no commands — by design

A monitoring platform has made it a core architectural principle that its agent accepts zero inbound commands, meaning the vendor cannot remotely execute code, push updates, or trigger actions on client systems. The agent only opens an outbound connection to stream metrics, with no command channel or callable endpoints on the client's server. The decision was motivated by high-profile supply-chain attacks, most notably a July 2021 breach of a remote monitoring platform that compromised an estimated 800 to 1,500 businesses through roughly 60 managed service providers in a single weekend. The developers argue that any tool capable of acting across many servers is, by definition, a single point of failure that multiplies the blast radius of any compromise. As a trade-off, the platform forgoes convenience features customers often request, treating the inability to act on client infrastructure as a security guarantee rather than a gap.