MoxiVueLive, down to the app
Processor per core with clock and throttling, memory, disk, network, graphics, power and temperature, split by app. Which app made the fan loud, and how much battery it cost.
For Linux desktops, servers & Raspberry Pi · free
See inside every machine you run. Only you can read it.
MoxiVue shows what every app, connection and device on your network is doing, keeps a month of history, warns you before small problems become outages, and opens any of your machines from anywhere, end-to-end encrypted with keys that never leave your devices.
- Native codeWritten in Rust. No Python, one light agent per machine.
- End-to-end encryptedThe relay passes data it cannot read.
- No open portsMachines connect out, so it works behind NAT.
- Desktop or headlessThe same agent on laptops, servers and Raspberry Pi.
- No trackingNo usage statistics in the app, no cookies here.
How it works
Your machines talk to your devices. The relay only carries sealed envelopes.
Each machine records on its own disk. When you want to see it from somewhere else, it connects out to the relay, and everything it sends is encrypted first, with a key that only your devices hold.
Your machines
LaptopDesktop app
ServerHeadless package
Raspberry PiARM64, headless
Relay
Routes messages and stores encrypted history summaries.
Sees only ciphertext.
Holds no keysYour devices
Your phoneAny network
Your other machinesDashboards and terminal
A web browserThe relay's viewer page
Install
One package with apt or a .deb: the desktop app, or the headless agent for servers and Raspberry Pi.
Pair
Add each machine or phone with a one-time code or QR code, valid for 10 minutes. Nothing to open on your router.
Open from anywhere
Dashboards, history and, if you allow it, a terminal on any of your machines, from your desk or your phone.
What you get
Depth where it counts
Built by a network engineer: the readings a system administrator wants, plus the network detail most monitoring tools leave out. Start with the Basic view and switch to More or All when you want the detail behind it.
Network and topology
Every device around you by maker and type; the switch port and VLAN heard over LLDP and CDP; DNS, DHCP, routes, BGP and OSPF neighbours, and the path to the internet.
Wi-Fi and LTE/5G
The Wi-Fi link in detail, every roam between access points with the signal before and after, nearby networks, and mobile modems with operator, technology and signal.
Packet capture
Capture on an interface with a filter, read each packet decoded and in hex, and save a .pcap for Wireshark. The administrator password is asked for every capture.
System health
SMART drive health checked hourly, pressure stall time, sensors and fans, Docker and Podman containers, virtual machines, services and startup apps.
A month of history
Every reading kept for 30 days by default, per-app use in 30-minute blocks. Click any moment to see which app was busy, then export it as CSV.
Alerts that find you
Heat, full disks, failing drives, unusual activity, new devices and data caps, to the desktop, ntfy, Telegram, email, SMS or WhatsApp, with a repeat interval so they never turn into noise.
A terminal, on your terms
A shell on any of your machines through the relay, encrypted per session. Off until switched on at that machine, with an "ask me each time" prompt, and never as root.
All your machines, one window
Machines on your network over read-only sharing, the rest through the relay, all of them on your phone. A Prometheus /metrics endpoint feeds Grafana.
Network-grade depth
Know which switch port you are plugged into
MoxiVue listens, and never sends, for what the network announces about itself. Together with the neighbour table and a polite scan that runs only when you ask, it draws a map of every network the machine joins.
- LLDP and CDP from switches and access points: system name, port, VLAN and management address.
- Spanning tree, DHCP offers, IPv6 router adverts, mDNS, SSDP and NetBIOS, heard on the wire.
- Routing daemons such as FRR, BIRD and keepalived, with BGP and OSPF neighbour states.
- Path to the internet hop by hop, the traffic mix, and new-device alerts on networks you know.
Private by architecture
Built so that we cannot read your data
This is not a promise in a policy. It is how the system is designed: readings stay on each machine unless you switch on sharing or the relay, and anything that crosses the relay is encrypted before it leaves your device.
- Keys made on your devices. The account key is copied only to devices you pair, inside an encrypted pairing message. Each device signs in with its own Ed25519 key that never leaves it.
- AES-256-GCM on everything the relay routes or stores, bound to its purpose and to the devices at both ends, so it cannot be replayed or redirected.
- Fresh keys for every terminal session. Not even your other devices can read it.
- Packet capture never leaves the machine's own window, and the read-only helper accepts no input.
- Signed packages. The apt signing key is kept offline, never on the download server.
The relay can see
- Account and device numbers, device types
- When devices are online, their IP addresses
- Message sizes and timing
- That a terminal session is open, and for how long
The relay cannot see
- Device names
- Readings, processes, networks, devices around you
- History summaries (stored, but encrypted)
- Anything typed or shown in a terminal
The relay cannot quietly add a device. Your account's membership is a log signed by your own devices. Each device shows the account's fingerprint, so you can compare them, and you can rotate the account key whenever a device leaves.
Why MoxiVue
One tool where you would usually need several
System monitor, network map, packet capture, remote shell and alerting, in one native app that keeps your data yours.
| Task | The usual way | With MoxiVue |
|---|---|---|
| Remote access | Open a port, set up a VPN, or manage SSH keys | Machines connect out to an end-to-end encrypted relay. Nothing to open on the router. |
| Remote monitoring | Readings sent to a service that can read them | The relay stores only ciphertext and never has the keys. |
| Per-app network and energy | Hidden by most operating systems | Per app, live and for the last 30 days. |
| Switch port and VLAN | Locked inside vendor tools or a cable trace | Heard over LLDP and CDP and shown in Topology. |
| Packets | A separate capture tool on each machine | A Capture tab that saves a .pcap for Wireshark. |
| Servers | A different agent, or nothing at all | The same agent as a headless package with a command line. |
| Alerts | One more red number | "Not normal for this machine at this hour of the week", after a week of learning. |
Also in every install
Faults, keys you can verify, and more
An alarm list for everything that is wrong, a relay you can check up on, and the small things that make remote work easier.
Faults tab
Everything wrong in one place, telecom-alarm style: severity, first and last seen, count. Checks every 30 seconds for stalled recording, full disks, drive health, failed services, kernel errors, link, gateway and DNS problems, Wi-Fi roam storms and more. Acknowledge with a note, mute or clear.
Signed membership
The list of devices on your account is a log signed by your devices, so the relay cannot add a device or swap a key without your devices noticing.
Fingerprints you can compare
The account and every device show a key fingerprint. Compare them on two devices to confirm that nothing extra has joined.
Roles and key rotation
Give each device a role: owner, admin, operator or viewer. Rotate the account key to re-key your devices and drop removed ones.
Sign in with a confirmed email
A code sent to your address confirms it. Signing in proves who you are; it never gives us any key that can read your data.
Time zones
Times are shown in the zone of the machine you are viewing, with the difference to yours, so remote logs line up.
Download
Get MoxiVue
Version 4.1.0. Free to use. Ubuntu 22.04 or newer (tested on 22.04, 24.04 and 26.04), on Intel/AMD and ARM64. Install the desktop package or the server package on a machine, not both.
Install with apt Recommended
Add the MoxiVue package source once; updates then arrive with your normal sudo apt upgrade. Packages and the source list are signed, and apt checks them with the key you add in the first line.
curl -fsSL https://get.moxivue.com/apt/moxivue-archive-keyring.gpg | sudo tee /usr/share/keyrings/moxivue-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/moxivue-archive-keyring.gpg] https://get.moxivue.com/apt stable main" | sudo tee /etc/apt/sources.list.d/moxivue.list
sudo apt update
sudo apt install moxivueOn servers install moxivue-headless instead. Intel/AMD and ARM64 (Raspberry Pi) are both served; apt picks the right one. More in the guide.
Linux desktopIntel/AMD 64-bit
SHA-256 7f08e5069bd9511584ab2e2e63c1d5d37aeadf98fa6f216f803c7030dc0dfb0b
Download .debLinux desktopARM64
SHA-256 6bc54a57148c6dafe003182ff6b8cd3e5185dcfc29a6fbfeb86ea48217f9bf31
Download .debLinux server (headless)Intel/AMD 64-bit
SHA-256 dccaaf72dad0440f623020dda27dd103ad7796bc4c121c5227ca884f7cd02796
Download .debLinux server (headless)ARM64, including Raspberry Pi
SHA-256 56b71d9075a66628c3fd1a112244a4cae99be7484b60f3b63fbbe61c8d70b63f
Download .debDesktop
sudo apt install ./moxivue_4.1.0_amd64.debOr the arm64 file. Type ./ before the file name. Then open MoxiVue from your applications; the agent keeps recording after you close the window.
Server
sudo apt install ./moxivue-headless_4.1.0_amd64.deb
sudo moxivue service enable --user <name>
moxivue join <code>Use the arm64 file on ARM machines. <name> is the account the agent runs as (never root); the pairing code comes from Settings → Relay → Add a device on one of your connected machines, or moxivue pair. More in the guide.
All checksums: SHA256SUMS. The signing key's fingerprint is on the security page. Everything is free to use. macOS and Windows are being rebuilt on the same core and are not available yet.
On the roadmap
Coming next
What we plan to build next, in no fixed order and without dates. None of this is available yet.
Built for service providers
Many customers in one place: tenants, sites and groups, with roles per person, and each customer's data encrypted under its own key.
Direct connections
Machines talk to each other directly when they can, with the relay as the fallback, still end-to-end encrypted.
Run your own relay
The relay on your own server, so not even connection metadata touches infrastructure we run.
Hardware security keys
YubiKey and other FIDO2 keys for signing in and touch-to-approve on powerful actions.
Remote desktop
See or control a machine's screen, end-to-end encrypted, with the same approval rules as the terminal.
Network gear
Switches, routers and access points over SSH and SNMP, with any change shown and approved by a person first.
Patching
Operating system and app updates with approval, maintenance windows and reports.
Bring your own AI
Your provider or a local model, with your own key. It can propose actions; a person confirms them.
Mobile apps, macOS and Windows
Native iOS and Android apps, and macOS and Windows rebuilt on the same core as Linux.
Questions
Frequently asked
Is MoxiVue free?
Yes. MoxiVue is free to use today, desktop and server packages alike.
Can anyone at MoxiVue see my readings?
No. Readings stay on each machine unless you switch on sharing or the relay. Through the relay, everything is encrypted with a key only your devices hold: the relay can see which of your devices are online and how much data moves, but not their names, readings, history or terminal sessions. The details are on the security page.
Do I need to open ports or set up a VPN?
No. Each machine connects out to the relay, so nothing is opened on your router. On your own network you can also switch on read-only sharing over HTTPS and add machines by link.
Will it slow my machine down?
The recorder reads what the system already counts. With the default reading every 5 seconds it uses a small fraction of one processor core, and a longer interval makes it lighter still.
What does it run on?
Ubuntu 22.04 or newer, tested on 22.04, 24.04 and 26.04, on Intel/AMD (amd64) and ARM64, including Raspberry Pi. There is a desktop package with a window and tray icon, and a headless package for servers. macOS and Windows are being rebuilt on the same core.
Do I need an account?
Not for one machine or your own network. To use the relay you sign in with a confirmed email address, and while the relay is in testing a new relay account needs an invite code. Signing in never gives us any key that can read your data.
Does it work with Prometheus and Grafana?
Yes. With sharing on, each machine serves its readings at /metrics in Prometheus format, protected by the same access key. The guide has a sample scrape job.
Can I run my own relay?
Not yet. A self-hosted relay is on the roadmap.
Your machines, in full detail. Your keys, only.
Install it on one machine in a minute, then add the rest.