p PatchFirst

Free · one server · no account needed

See which stacks need attention

Run one command or paste anonymized JSON for your server rating, verdict, and a risk summary by stack.

Checking now

  • Ubuntu
  • Debian
  • Alpine
  • RHEL
  • Rocky Linux
  • AlmaLinux
  • openSUSE / SUSE
  • Docker
  • Kubernetes
  • PHP
  • Composer
  • Python
  • Node.js
  • nginx
  • Apache
  • MySQL
  • MariaDB
  • PostgreSQL
  • Redis

Coming soon

  • Windows Server
  • Java / Maven
  • Go
  • Ruby
  • .NET
  • Rust

Run this on your server

No AI. No third-party services.

The agent collects only an anonymized list of software and versions and sends it to PatchFirst — nowhere else. The analysis is an exact match against vulnerability databases, with no neural networks.

curl -fsSL https://patchfirst.dev/check.sh | sh

Python is optional. You need curl and sh; Python 3.8+ with cryptography uses the zipapp, otherwise Linux x86_64 uses a binary. Its SHA-256 is checked against the same HTTPS service: this checks integrity and is not an independent signature. No root access required.

Preview data before sending

The command above runs a normal check. With any launch method, --json shows anonymized JSON without sending it:

curl -fsSL https://patchfirst.dev/check.sh | sh -s -- --json

Alternatively, download the zipapp and run it manually with Python 3.8+. Install python3-cryptography to encrypt names. The same flag previews the data:

curl -fsSLo psr-agent.pyz https://patchfirst.dev/agent/psr-agent.pyz &&
python3 psr-agent.pyz check --json

After reviewing the JSON, send the data and get a report link:

python3 psr-agent.pyz check --api https://patchfirst.dev
Check another server over SSH

Ready-to-run binaries are available only for Linux x86_64 (use the musl variant on Alpine). Download the appropriate variant using the “Binary without Python” instructions. The target Linux server only needs sh; anonymization and encryption run on your machine.

TMPDIR="$HOME" ./psr-agent check --ssh user@host --ssh-opt StrictHostKeyChecking=accept-new --api https://patchfirst.dev

On macOS and other systems, use the .pyz: you need Python 3.8+, cryptography to encrypt names, and an SSH client. Download the agent and run the check:

curl --retry 3 -fsSLo psr-agent.pyz https://patchfirst.dev/agent/psr-agent.pyz &&
python3 psr-agent.pyz check --ssh user@host --ssh-opt StrictHostKeyChecking=accept-new --api https://patchfirst.dev

StrictHostKeyChecking=accept-new saves the key on the first connection and rejects changed keys. Verify the server fingerprint separately before connecting for the first time.

Start monitoring →Download a sample report (PDF)