For Linux desktops, servers & Raspberry Pi · free

See inside every machine you run. Only you can read it.

MoxiVue shows what every app, connection and device on your network is doing, keeps a month of history, warns you before small problems become outages, and opens any of your machines from anywhere, end-to-end encrypted with keys that never leave your devices.

Download free Install with apt Take the feature tour

Version 4.2.3 Ubuntu 22.04, 24.04 and 26.04 Intel/AMD and ARM64 Desktop app or headless server

Native codeWritten in Rust. No Python, one light agent per machine.
End-to-end encryptedThe relay passes data it cannot read.
No open portsMachines connect out, so it works behind NAT.
Desktop or headlessThe same agent on laptops, servers and Raspberry Pi.
No trackingNo usage statistics in the app, no cookies here.

How it works

Your machines talk to your devices. The relay only carries sealed envelopes.

Each machine records on its own disk. When you want to see it from somewhere else, it connects out to the relay, and everything it sends is encrypted first, with a key that only your devices hold.

Your machines

LaptopDesktop app

ServerHeadless package

Raspberry PiARM64, headless

Relay

Routes messages and stores encrypted history summaries.

Sees only ciphertext.

Holds no keys

Your devices

Your phoneAny network

Your other machinesDashboards and terminal

A web browserThe relay's viewer page

Install

One package with apt or a .deb: the desktop app, or the headless agent for servers and Raspberry Pi.

Pair

Add each machine or phone with a one-time code or QR code, valid for 10 minutes. Nothing to open on your router.

Open from anywhere

Dashboards, history and, if you allow it, a terminal on any of your machines, from your desk or your phone.

What you get

Depth where it counts

Built by a network engineer: the readings a system administrator wants, plus the network detail most monitoring tools leave out. Start with the Basic view and switch to More or All when you want the detail behind it.

Live, down to the app

Processor per core with clock and throttling, memory, disk, network, graphics, power and temperature, split by app. Which app made the fan loud, and how much battery it cost.

Network and topology

Every device around you by maker and type; the switch port and VLAN heard over LLDP and CDP; DNS, DHCP, routes, BGP and OSPF neighbours, and the path to the internet.

Wi-Fi and LTE/5G

The Wi-Fi link in detail, every roam between access points with the signal before and after, nearby networks, and mobile modems with operator, technology and signal.

Packet capture

Capture on an interface with a filter, read each packet decoded and in hex, and save a .pcap for Wireshark. The administrator password is asked for every capture.

System health

SMART drive health checked hourly, pressure stall time, sensors and fans, Docker and Podman containers, virtual machines, services and startup apps.

A month of history

Every reading kept for 30 days by default, per-app use in 30-minute blocks. Click any moment to see which app was busy, then export it as CSV.

Alerts that find you

Heat, full disks, failing drives, unusual activity, new devices and data caps, to the desktop, ntfy, Telegram, email, SMS or WhatsApp, with a repeat interval so they never turn into noise.

A terminal, on your terms

A shell on any of your machines through the relay, encrypted per session. Off until switched on at that machine, with an "ask me each time" prompt, and never as root.

All your machines, one window

Machines on your network over read-only sharing, the rest through the relay, all of them on your phone. A Prometheus /metrics endpoint feeds Grafana.

See every tab in the feature tour

Network-grade depth

Know which switch port you are plugged into

MoxiVue listens, and never sends, for what the network announces about itself. Together with the neighbour table and a polite scan that runs only when you ask, it draws a map of every network the machine joins.

LLDP and CDP from switches and access points: system name, port, VLAN and management address.
Spanning tree, DHCP offers, IPv6 router adverts, mDNS, SSDP and NetBIOS, heard on the wire.
Routing daemons such as FRR, BIRD and keepalived, with BGP and OSPF neighbour states.
Path to the internet hop by hop, the traffic mix, and new-device alerts on networks you know.

Private by architecture

Built so that we cannot read your data

This is not a promise in a policy. It is how the system is designed: readings stay on each machine unless you switch on sharing or the relay, and anything that crosses the relay is encrypted before it leaves your device.

Keys made on your devices. The account key is copied only to devices you pair, inside an encrypted pairing message. Each device signs in with its own Ed25519 key that never leaves it.
AES-256-GCM on everything the relay routes or stores, bound to its purpose and to the devices at both ends, so it cannot be replayed or redirected.
Fresh keys for every terminal session. Not even your other devices can read it.
Packet capture never leaves the machine's own window, and the read-only helper accepts no input.
Signed packages. The apt signing key is kept offline, never on the download server.

Read how the security works

The relay can see

Account and device numbers, device types
When devices are online, their IP addresses
Message sizes and timing
That a terminal session is open, and for how long

The relay cannot see

Device names
Readings, processes, networks, devices around you
History summaries (stored, but encrypted)
Anything typed or shown in a terminal

The relay cannot quietly add a device. Your account's membership is a log signed by your own devices. Each device shows the account's fingerprint, so you can compare them, and you can rotate the account key whenever a device leaves.

Why MoxiVue

One tool where you would usually need several

System monitor, network map, packet capture, remote shell and alerting, in one native app that keeps your data yours.

Task	The usual way	With MoxiVue
Remote access	Open a port, set up a VPN, or manage SSH keys	Machines connect out to an end-to-end encrypted relay. Nothing to open on the router.
Remote monitoring	Readings sent to a service that can read them	The relay stores only ciphertext and never has the keys.
Per-app network and energy	Hidden by most operating systems	Per app, live and for the last 30 days.
Switch port and VLAN	Locked inside vendor tools or a cable trace	Heard over LLDP and CDP and shown in Topology.
Packets	A separate capture tool on each machine	A Capture tab that saves a .pcap for Wireshark.
Servers	A different agent, or nothing at all	The same agent as a headless package with a command line.
Alerts	One more red number	"Not normal for this machine at this hour of the week", after a week of learning.

Also in every install

Faults, keys you can verify, and more

An alarm list for everything that is wrong, a relay you can check up on, and the small things that make remote work easier.

Faults tab

Everything wrong in one place, telecom-alarm style: severity, first and last seen, count. Checks every 30 seconds for stalled recording, full disks, drive health, failed services, kernel errors, link, gateway and DNS problems, Wi-Fi roam storms and more. Acknowledge with a note, mute or clear.

Signed membership

The list of devices on your account is a log signed by your devices, so the relay cannot add a device or swap a key without your devices noticing.

Fingerprints you can compare

The account and every device show a key fingerprint. Compare them on two devices to confirm that nothing extra has joined.

Roles and key rotation

Give each device a role: owner, admin, operator or viewer. Rotate the account key to re-key your devices and drop removed ones.

Sign in with a confirmed email

A code sent to your address confirms it. Signing in proves who you are; it never gives us any key that can read your data.

Time zones

Times are shown in the zone of the machine you are viewing, with the difference to yours, so remote logs line up.

Download

Get MoxiVue

Version 4.2.3. Free to use. Ubuntu 22.04 or newer (tested on 22.04, 24.04 and 26.04), on Intel/AMD and ARM64. Install the desktop package or the server package on a machine, not both.

Install with apt Recommended

Add the MoxiVue package source once; updates then arrive with your normal sudo apt upgrade. Packages and the source list are signed, and apt checks them with the key you add in the first line.

curl -fsSL https://get.moxivue.com/apt/moxivue-archive-keyring.gpg | sudo tee /usr/share/keyrings/moxivue-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/moxivue-archive-keyring.gpg] https://get.moxivue.com/apt stable main" | sudo tee /etc/apt/sources.list.d/moxivue.list
sudo apt update
sudo apt install moxivue

On servers install moxivue-headless instead. Intel/AMD and ARM64 (Raspberry Pi) are both served; apt picks the right one. More in the guide.

Linux desktopIntel/AMD 64-bitmoxivue_4.2.3_amd64.deb · 12.5 MB

SHA-256 dc3a0b579b2d9035e394b6e68b577b1b12fce8c254594bede885a1696bd6f070

Download .deb

Linux desktopARM64moxivue_4.2.3_arm64.deb · 10.9 MB

SHA-256 643a1525abb184baa0965cdf8cc3a8aa1533e8fbc35dd45ef38d59e5de29361e

Download .deb

Linux server (headless)Intel/AMD 64-bitmoxivue-headless_4.2.3_amd64.deb · 7.0 MB

SHA-256 83cf45ffc99194bf978c537b51fcaab5c4fb8f5c2fbef8f06b5f3c9812179742

Download .deb

Linux server (headless)ARM64, including Raspberry Pimoxivue-headless_4.2.3_arm64.deb · 6.1 MB

SHA-256 926c59c56de927c4d7008938340b578e2a89bf42ad9bc4888032598cd1382d1d

Download .deb

Desktop

sudo apt install ./moxivue_4.2.3_amd64.deb

Or the arm64 file. Type ./ before the file name. Then open MoxiVue from your applications; the agent keeps recording after you close the window.

Server

sudo apt install ./moxivue-headless_4.2.3_amd64.deb
sudo moxivue service enable --user <name>
moxivue join <code>

Use the arm64 file on ARM machines. <name> is the account the agent runs as (never root); the pairing code comes from Settings → Relay → Add a device on one of your connected machines, or moxivue pair. More in the guide.

All checksums: SHA256SUMS. The signing key's fingerprint is on the security page. Everything is free to use. macOS and Windows are being rebuilt on the same core and are not available yet.

On the roadmap

Coming next

What we plan to build next, in no fixed order and without dates. None of this is available yet.

Built for service providers

Many customers in one place: tenants, sites and groups, with roles per person, and each customer's data encrypted under its own key.

Direct connections

Machines talk to each other directly when they can, with the relay as the fallback, still end-to-end encrypted.

Run your own relay

The relay on your own server, so not even connection metadata touches infrastructure we run.

Hardware security keys

YubiKey and other FIDO2 keys for signing in and touch-to-approve on powerful actions.

Remote desktop

See or control a machine's screen, end-to-end encrypted, with the same approval rules as the terminal.

Network gear

Switches, routers and access points over SSH and SNMP, with any change shown and approved by a person first.

Patching

Operating system and app updates with approval, maintenance windows and reports.

Bring your own AI

Your provider or a local model, with your own key. It can propose actions; a person confirms them.

Mobile apps, macOS and Windows

Native iOS and Android apps, and macOS and Windows rebuilt on the same core as Linux.

Questions

Frequently asked

Is MoxiVue free?

Yes. MoxiVue is free to use today, desktop and server packages alike.

Can anyone at MoxiVue see my readings?

No. Readings stay on each machine unless you switch on sharing or the relay. Through the relay, everything is encrypted with a key only your devices hold: the relay can see which of your devices are online and how much data moves, but not their names, readings, history or terminal sessions. The details are on the security page.

Do I need to open ports or set up a VPN?

No. Each machine connects out to the relay, so nothing is opened on your router. On your own network you can also switch on read-only sharing over HTTPS and add machines by link.

Will it slow my machine down?

The recorder reads what the system already counts. With the default reading every 5 seconds it uses a small fraction of one processor core, and a longer interval makes it lighter still.

What does it run on?

Ubuntu 22.04 or newer, tested on 22.04, 24.04 and 26.04, on Intel/AMD (amd64) and ARM64, including Raspberry Pi. There is a desktop package with a window and tray icon, and a headless package for servers. macOS and Windows are being rebuilt on the same core.

Do I need an account?

Not for one machine or your own network. To use the relay you sign in with a confirmed email address, and while the relay is in testing a new relay account needs an invite code. Signing in never gives us any key that can read your data.

Does it work with Prometheus and Grafana?

Yes. With sharing on, each machine serves its readings at /metrics in Prometheus format, protected by the same access key. The guide has a sample scrape job.

Can I run my own relay?

Not yet. A self-hosted relay is on the roadmap.

Your machines, in full detail. Your keys, only.

Install it on one machine in a minute, then add the rest.

Download free Read the guide