Every device	One device, every module	Installs across the fleet

Lightweight native agents collect data on-device with osquery, bash, and pwsh — with deep support for the Munki and Cimian software deployment tools — and POST a unified JSON payload to the API. Everything downstream is a reader: heavy lifting happens at the endpoint, not in the cloud.

• Cross-platform — native agents for macOS (Swift) and Windows (C#/.NET)
• Eleven modules — hardware, network, security, applications, installs, inventory, system, management, peripherals, identity, profiles
• Real-time dashboard — Next.js frontend with live fleet overview, device drill-down, and posture views
• Native apps — the same fleet views as a SwiftUI app on the Mac and a WPF app on Windows, each also able to read the local agent's cache with no API
• REST API — FastAPI backend with a published OpenAPI spec, versioned endpoints, rate limiting, and pagination
• Command line — reportmateutil, one binary with a command for every API route, printing the API's JSON unchanged
• Multi-cloud — Terraform modules for Azure and AWS, or self-host on any infrastructure
• Scriptable — reportmateutil gives scripts and coding agents the whole API from the terminal

Collection → Transmission → Ingestion → Storage → Display

flowchart LR
  A["Mac agent<br/>Swift"] -->|POST /api/v1/events| API
  B["Windows agent<br/>C#"] -->|POST /api/v1/events| API
  API["FastAPI"] --- DB[("PostgreSQL<br/>one JSONB row per device per module")]
  API -->|Web PubSub / SignalR| W["Web dashboard"]
  API --> M["ReportMate for Mac"]
  API --> N["ReportMate for Windows"]
  API --> C["reportmateutil"]
  API -.-> P["MCP server (beta)"]

One binary with a command for every API route, printing the API's JSON unchanged. It ships inside both native apps and as standalone tarballs on its releases.

reportmateutil devices --limit 20
reportmateutil device SERIAL --module installs
reportmateutil events failures --hours 24

Setup, credentials and every command: reportmate-cli.

Run the whole stack on one machine with Docker Compose. Clone the self-hosted repository and copy the environment template:

git clone https://github.com/reportmate/selfhosted-docker-reportmate
cd selfhosted-docker-reportmate
cp .env.example .env

Set DB_PASSWORD, API_INTERNAL_SECRET, REPORTMATE_PASSPHRASE and NEXTAUTH_SECRET in .env, then start it:

docker compose up -d

The dashboard is at http://localhost:3000 in demo mode and the API at http://localhost:8000. Point an agent at the API with the passphrase you set. For production, deploy with the Azure or AWS Terraform module, or bake the appliance image.

Public repositories build unsigned artifacts on every push and publish them as GitHub release assets on a version tag: the agents' packages, the apps' bundles and installers, and the CLI's tarballs. Signing, notarization and deployment to endpoints happen downstream, in whatever management pipeline runs a fleet, against a pinned release. No signing identity or fleet configuration lives in these repositories.

ReportMate reports on a fleet that something else provisions and manages. BootstrapMate provisions new Macs and PCs and can post each run's summary to ReportMate, and the agents read deep detail from Munki and Cimian, the tools that keep software current afterwards.

ReportMate is open source. The server (API and web dashboard) and the CLI are AGPL-3.0; the endpoint agents, native apps, Terraform modules, and deployment tooling are MIT. A separate commercial license is available for organizations whose policies do not permit AGPL.

Self-host the whole stack for free, or pick a managed plan and we'll run it for you.

See CONTRIBUTING.md. Contributions are accepted under the project CLA with a DCO sign-off (git commit -s).