How Portainer-AiSecure works
The architecture and platform detail behind the Portainer-AiSecure product page, for your security architects and engineers.
A coordinator in your core, an agent in every segment
Portainer-AiSecure has two parts. The coordinator is a central MisterShell deployment in your core. The agents run at the edge, one in each network segment. The coordinator directs the agents, and the agents carry out the work from inside the segment they sit in.
The coordinator
A central MisterShell deployment in your core. It connects to your model and directs the agents.
The agents
Run at the edge, one per network segment. Each runs simulated attacks on the network-attached devices and applications in its segment, and listens to the network to hunt systems that are already compromised.
Your model
An enterprise self-hosted, open-weight LLM that you run. It coordinates and creates the attacks, and it is unrestricted for authorized security testing. Portainer can recommend a model if you need one.
MisterShell is the platform underneath
Portainer-AiSecure is built on MisterShell, a self-hosted privileged access and fleet intelligence platform. The rest of this page describes what the platform does: sessions, policy, inventory, monitoring, and audit.
Connect
Shells, SQL, RDP, VNC, and web apps, in the browser or from your own SSH client, recorded for replay.
Govern
A policy firewall on every session and every command.
Inventory
Locations and resources, identified and kept up to date.
Monitor
Dashboards, a map, live health, trends, and an event feed.
Detect and collect
Passive IDS sensors and searchable device syslog, as licensed add-ons.
Track
Configuration drift, down to individual elements.
Automate
Event-driven playbooks built in a visual studio, with human approval steps.
Report
On demand or scheduled, with AI executive summaries.
Ask
An opt-in AI assistant in chat, in sessions, and in playbooks.
Every kind of session, from one place
From the location tree, Connect opens the right session type for each resource. Each session runs through a worker in the resource’s location, so there is no direct network path from the workstation to the device.
SSH and console
Network devices, Linux hosts, and Windows hosts.
Cloud and Kubernetes
Pre-authenticated aws, az, and kubectl shells signed in on your behalf.
Database
PostgreSQL, MySQL, MariaDB, SQL Server, and ClickHouse.
Remote desktop
Windows over RDP, any desktop over VNC.
Web application
Admin consoles and portals over HTTPS, in a headless browser.
Record and replay
Terminal timeline or visual replay, set per Recording Policy.
The built-in SSH gateway gives a text UI, direct connections for ssh, sftp, scp, WinSCP, and FileZilla, and SFTP access to catalog files, all under the same policies and recording. Any interactive session can be shared with teammates or account-less external guests, observed read-only, terminated, or held behind human approval before access.
Seven policy engines, first match wins
Each engine is an independent, ordered decision chain over its own stream. Rules are evaluated top to bottom and the first match decides. A Notify action raises an automation event, and decisions feed the Policy Log, the compliance heatmap, and your SIEM.
| Policy | On a match it can |
|---|---|
| Session | Accept or deny a session or a command |
| Recording | Record or skip, and pick the store and retention |
| File Transfer | Accept or deny a file copy |
| Fact | Pass or fail a compliance rule |
| Config | Bind templates to render and push |
| IDS | Notify, log, or suppress an alert |
| Syslog | Log, notify, forward, or discard |
A firewall for sessions and commands
Session Policy is checked twice, when the session opens and again on every command, at the worker. With no matching Accept rule the answer is deny. Command lines are split on chaining operators and every piece must be accepted, so a rule that allows ls * does not let ls; rm -rf / through. The whole line is blocked and the session stays open.
Three cooperating tiers
The core server is the control plane and system of record. Remote components (workers, IDS sensors, and session proxies) sit close to your resources and dial out to the core. People, scripts, and AI agents reach the same instance through four access surfaces: the web UI, the SSH gateway, a REST API, and an MCP endpoint.
Workers
Per site, region, or segment, routed by location. Stateless, with an optional syslog collector, and an embedded worker ships inside the core.
IDS sensors
Passively watch network traffic and stream alerts, routed by IDS Policy.
Proxies
A public bridge so external guests can join a session without ever reaching the core.
All remote components share one model: one outbound connection, token-based enrollment, and live status on the Fabric page.
Four topologies, and what you run yourself
MisterShell makes its own application tier highly available. In every multi-core topology you operate, and make highly available, the load balancer or GSLB, the database, the app-state store, and the object store.
| Topology | Cores | Regions | In-region HA | Geographic | External services you run |
|---|---|---|---|---|---|
| All in One | 1 | 1 | No | No | None, everything embedded |
| HA Cluster | 3 or more | 1 | Yes | No | Database, app-state store, load balancer, object store |
| Distributed | 1 per region | 2 or more | No | Yes | Central database, app-state store, GSLB, object store |
| Distributed with HA | 3+ per region | 2 or more | Yes | Yes | Central database, app-state store, GSLB, object store |
Lose a core, keep the workspace
Workers are covered too. Several workers can serve one location, new sessions go to the online worker with the fewest active tasks, and a lost worker means new sessions go to its peers. Because workers are stateless, adding capacity is registering another one. Take and verify a database backup before any upgrade.
Your infrastructure, your data, your rules
Self-hosted
You choose where data lives. Licensing is offline and never phones home.
Identity and RBAC
Local, LDAP, OIDC, and SAML sign-in, MFA, and roles scoped per location and feature.
Credentials
An encrypted vault, or HashiCorp Vault, OpenBao, AWS Secrets Manager, or Azure Key Vault read at connection time.
No exposed resources
Workers dial out, and guests connect only to a proxy.
Recorded evidence
Session replay, the policy log, approvals, and security audit trails, each kept as its own trail.
Log forwarding
Send MisterShell’s own audit events to syslog (RFC 3164, RFC 5424, CEF), your SIEM, or a webhook (JSON, Splunk HEC).
Every recording, whether terminal, RDP, VNC, or web, is SHA-256 hashed at capture, the hash is stored apart from the recording, and it is checked on replay. SSH host keys are strictly verified by default, for live sessions and background checks alike, and any change needs explicit acceptance.
An optional AI assistant for operators
The platform also includes an optional AI assistant. You register the model providers you want, you own the account and the billing, and nothing is sent to a provider until you invoke an agent. Attack coordination is described above and uses your self-hosted model.
Agents
A model, a prompt, and an allowed tool list. Built-in agents cover config analysis, session assistance, summaries, and chat, and you can create your own.
Tools and skills
Read inventory, changes, and events, and run read-only diagnostics, with more than 100 built-in skills.
Surfaces
Chat, Quick Assist, in-session help, Run Agent in playbooks, and an MCP endpoint for your own agents, opened with a personal API key.
Guardrails and audit
Limits on what can be injected into sessions per resource type, usage attributed per user, and a unified AI audit trail.
Built to be audited
MisterShell publishes a control mapping that speeds up evidence gathering for your security, compliance, and audit teams. It is a mapping to help you answer auditor questions and agree scope, and the full version is at mistershell.com/compliance.
| Domain | MisterShell capability | Example controls |
|---|---|---|
| Identity and access | SSO and MFA, location-scoped RBAC, approvals, session ACLs | CC6.1, A.5.15, AC-3 |
| Logging and audit | Policy log, approvals timeline, recordings, SIEM export | CC7.2, A.8.15, AU-2 |
| Crypto and data | Self-hosted, encrypted secrets, recordings in your object store | CC6.7, A.8.24, SC-28 |
| Segmentation | Outbound-only workers, File Transfer Policy, passive IDS | CC6.6, A.8.22, SC-7 |
| Availability | Active/active core mesh, replicated recordings, backups | A1.2, A.8.14, CP-10 |
| Change tracking | Snapshots, structured diffs, changelog, approved push | CC8.1, A.8.32, CM-3 |
| Operational state | Fact Policy checks and the compliance heatmap | CC4.1, A.8.9, CA-7 |
| AI governance | User-scoped AI, tool limits, unified AI audit trail | ISO/IEC 42001, AI RMF |
Sample control IDs shown as SOC 2, ISO/IEC 27001 Annex A, and NIST 800-53. MisterShell covers its own application tier; you run the load balancer, database, cache, and object store. It is not a full change-management system and does not ship canned CIS or PCI baseline suites.
Portainer-AiSecure technical questions
Which model directs the attacks?
An enterprise self-hosted, open-weight LLM that you run, unrestricted for authorized security testing. Portainer can recommend a model if you need one.
Do my managed resources need to be exposed to the network?
No. MisterShell workers sit close to your resources and dial out to the core over one authenticated channel. External guests connect only to a proxy.
Can my team use its own SSH client?
Yes. The SSH gateway in the core accepts ssh, sftp, scp, WinSCP, and FileZilla connections, and applies the same policies and recording as browser sessions.
Is the AI assistant required?
No. The assistant is optional, runs on model providers you register, and nothing is sent to a provider until you invoke an agent. You can use a local model through Ollama.
What do I have to run myself?
In All in One, nothing, because everything is embedded. In any multi-core topology you operate the load balancer or GSLB, the database, the app-state store, and the object store, and you make them highly available.
Which compliance frameworks does it map to?
The published MisterShell control mapping references SOC 2, ISO/IEC 27001:2022 Annex A, NIST SP 800-53 Rev 5, PCI DSS v4.0, and CIS Controls v8, plus IEC 62443 for OT and ISO/IEC 42001 and NIST AI RMF for AI governance. It is a mapping to speed up evidence gathering, and you agree scope with your auditor.
See it run against a network like yours
We will walk you through Portainer-AiSecure and show how the variant that fits your estate is deployed.