CC
Cloud Castle
MSP operator console

Sign in

Only invited technicians can access device controls. Sessions use secure cookies + CSRF.

← Back to Cloud Castle · Invite-only accounts
CC
Accept invite
Create your operator account

Join your team

Set a password for the invited email. You will sign in after the account is created.

Already have an account? Sign in
Home
MSP operations at a glance
0

Needs attention

Managed assets

0 devices
0 selected

Device groups

Group endpoints by site · run playbooks against a set of devices

Clients

PSA customers · installers enroll into the selected client
Creating a client also creates a Primary site. Use Download agent to mint a one-click installer that auto-enrolls endpoints under that client.

Service tickets

Endpoint health

Score 0–100 · CPU · memory · storage · drive health

Custom monitors

Site policy · /v1/tenants/:id/monitors
Enabled def overrides builtin for that kind; disabled-only suppresses builtin

Site incidents

Multi-device outages · /v1/incidents

Monitoring alerts

Includes suppressed noise

Partner status

From device inventory.security · dry-run default · no force-enforce

EDR detections

Alerts with kind edr.* or Light-Defender source
Patch compliance API rollup loads with this view.

Patches & Windows updates

Pending updates (fleet)

Click a device for details

Device detail

Select a device
Select a devicePick a row on the left or from Overview to see pending and installed patches.
Safety: every install and update creates a system restore point / snapshot first, and a heartbeat-watchdog can auto-roll the binary back if a self-update fails to come back healthy.

Fleet protection & deployment

GET /v1/protection/status · combined Defender + RMM agent

Package downloads

Session-gated · Light-RMM agent + Light-Defender (EDR)
Sign in required. Packages load after session is ready…

Auto-update policy

Loading update policy…

Deployment & rollback

Select a device to install or roll back
Pick a deviceClick a row in the table to install Light-Defender / the RMM agent, or roll a machine back to its last restore point.

Playbook confidence

From /v1/playbooks/stats

Script library

Never autopilot
API: GET/POST /v1/scripts · versions never can_auto

Automation catalog

0

Scheduled jobs

Cron simplified: hourly · daily · HH:MM UTC
Scripts never autopilot — schedule is human path only

Software catalog

winget/choco allowlist · /v1/packages
Install/uninstall enqueues software-install / software-uninstall on the first online device (or pick a device id below). Unknown packages are denied by the API.

Work orders

Internal automation queue

Remediation jobs

Playbook runs on endpoints

Human queue

Click a row to open · Take → note → Resolve

Why a human was paged

Escalation reasons · derived from the queue

Confidence distribution

From case-file notes · else success-rate bars

Per-playbook success

From /v1/playbooks/stats · sorted by runs

Decision timelines

Pick a job to see why the AI did what it did

Explainability

Signal → triage → plan → action → verify → outcome
Select a jobClick a row on the left to open its decision timeline from the action journal.

Remote connect

Unattended host · vault credentials · deep-link client
Select a device Open Assets and click Remote, or pass #remote?device=<id>.

In-browser viewer

scaffold

Full browser remote desktop is reserved for a follow-on release. Use Launch client for technician desktop connect today.

remote-viewer-root · coming soon

Profile

Signed-in operator profile for this console.

Password

Other sessions for this account are signed out. This browser stays signed in.

Organizations

Loading memberships…

Team invites

Invite-only · open registration disabled in production
No invites loaded yet.

Automation policy

Loading tenant policy…

Console prefs (this browser)

Design tokens cascade from brand accent. SLA timers drive urgency on tickets (client-side countdown).

Effective policy inspector

    Window semantics: maintenance_window only suppresses alert noise during expected downtime. patch_window (when set) holds patch/reboot-class jobs until inside the window. Class A/B silent fixes still run anytime unless freeze is on. OS feature upgrades require allow_os_feature_upgrades + release_date + 28 days (policy.os_upgrade_delay_days) + patch window. 
    Platform details load here…

    Deploy endpoints

    Org install links · auto-enroll on install · optional for lab
    Production: pick a site/org → Generate install package → one-click command enrolls the device into that site automatically (token shown once). Lab / testing: leave site blank or type dev-site-token manually — generation is optional. 
    Select a site and generate a package, or enter a lab token and Refresh…