Local-first and agentless

vops keeps the authority to operate infrastructure on the user’s machine. That is more than an installation detail: it defines where credentials live, where plans are approved and where operational history belongs.

The workstation is the control plane

Local state lives under ~/.config/vops/ by default. It includes provider configuration, the host inventory, cached provider data, plans and operational records. SSH private keys remain local; importing an existing key records its path rather than copying the private material.

The local dashboard follows the same boundary. vops ui starts a service bound to 127.0.0.1, protects the browser session with a one-time token and uses assets bundled with the CLI rather than a CDN.

vops does not require a vops account and does not send operational telemetry, prompts, infrastructure metadata or credentials to a vops service.

What reaches a managed server

Host and application operations use SSH. vops may place the artifacts required by the requested job, including:

• application containers and service definitions;
• configuration and secret files with restrictive permissions;
• firewall or ingress configuration;
• health-check and backup scripts;
• narrowly scoped scheduled tasks chosen by the user.

It does not install a permanent vops controller, database, scheduler or management cluster on the server. The application consumes the server’s resources; vops does not reserve a platform runtime.

Note

“Agentless” means no persistent vops control plane on the managed host. It does not mean a server can run no services, containers, backup jobs or optional operational scripts.

The explicit hosted exception

vops watch can relay notifications while the workstation is asleep. That feature is opt-in because an outside service is required to probe a public URL or send a notification to a phone. Connecting the relay is an explicit vops watch login step.

The rest of the product does not silently turn that connection into a remote control plane.

Why this boundary matters

Local ownership narrows the blast radius:

• a provider token does not need to cross a hosted vops service;
• revoking or locking the local keyring removes the active credential path;
• an agent session can receive scoped operations without receiving the secret that powers them;
• removing vops does not strand a management runtime on every VPS.

It also creates a practical limitation: cloud-hosted development agents cannot reach a loopback-only MCP endpoint unless the user deliberately creates a bridge. The local MVP does not create an internet-facing bridge automatically.