Most monitoring stacks start by installing an agent on every server. An agent is one more privileged process to patch, update and trust. LemonSees takes the opposite route: the SSH session is the agent, and nothing is installed on the servers it watches. These notes describe release v2.0.0.

Shape of the system

A Windows desktop app: Electron shell, React UI and a Node.js engine talking over WebSocket.
The engine binds to 127.0.0.1 only. There are no background services — closing the window stops everything.
One persistent, multiplexed SSH connection per host, with a separate channel per task.

Collecting without an agent

Metrics and traffic come from a single script per poll (/proc/stat, /proc/net/dev, free, df, docker), with deltas computed in one round-trip.
Process, persistence, connection and auth data (ps, ss, cron, systemd, auth.log) is parsed on the server and enriched with batch geo-IP.
Databases are reached through SSH port-forwards; SQLite files are streamed and opened locally with sql.js.

What the console does with it

EDR — live process table, persistence view (cron, services, timers, startup), risk-score posture and a configuration exposure scan with remediation guidance.
NDR — live traffic, top peers with geo-IP, established and listening sockets with the owning process.
Threat intel — top attackers, targeted usernames and IP investigation (geo, reverse DNS, WHOIS) run from the host.
SOAR & GRC — incident register with playbooks (including an automatic brute-force rule), CIS / NIST / ISO checks and exportable reports.

Trade-offs

No agent means nothing new to compromise on the server and nothing left behind. The cost is that monitoring only runs while the console is open, and everything depends on the SSH account you grant — give it the least privilege that still lets it read what you want watched.

Known limits

Saved SSH passwords are stored in plain text under %APPDATA%\LemonSees\config\. Use SSH keys; moving stored secrets into the OS credential store is the fix.
Outbound traffic is limited to optional geo-IP lookups for public attacker and peer IPs, which can be turned off in Settings.