Evaluate it in a sandbox¶
You do not need an account, an enrollment code, or a network connection to see exactly what the Acutis Go agent does. Security teams evaluating it before a fleet rollout should start here.
The one command¶
This runs one full diagnostic cycle and prints the verdict to stdout, then exits. No backend call, no enrollment, no account, nothing sent anywhere. It is the fastest honest way to see the agent's complete behaviour and output.
You will see the verdict (network / machine / healthy), its confidence score, and every signal that produced it — the same evidence the dashboard would show.
Running it fully isolated¶
| What you want | Flag |
|---|---|
| One diagnostic cycle, print, exit — no network calls to us | -selftest |
| One telemetry sample then exit (instead of running continuously) | -once |
| Print the verdict + signals to stdout every cycle | -print |
| Turn off the background self-update check entirely | -no-auto-update |
| Skip TLS verification (dev / self-signed labs only) | -insecure |
-selftest makes no outbound connection to Acutis at all, so it works on an
air-gapped or fully firewalled host. If you want the agent running long-term but
never self-updating, add -no-auto-update and push versions through your own
tooling (PDQ, Intune, SCCM, GPO) instead.
What it will and will not do¶
The agent is observe-only by construction, not by promise:
- It opens no inbound port. There is no listener in the binary — nothing can connect to it. On-demand diagnostics arrive on the response to its own outbound telemetry call, never through an open socket.
- It holds no credentials and cannot read device configuration or change any setting. It measures and reports.
- Updates are pull-only: the agent checks on its own timer (default 6 h) and only ever installs a build whose SHA-256 matches the manifest it fetched over verified TLS. Nothing can be pushed to a machine — there is no channel for it.
- Its entire required network footprint is outbound HTTPS (TCP 443) to a single static endpoint. See the Network Communication Map in the security packet, or the allowlisting guide.
Verifying the build you downloaded¶
Every published build is code-signed — Authenticode on Windows, Developer-ID signed and Apple-notarized on macOS. Check it before you run it:
If your policy requires application allow-listing (WDAC/AppLocker), you can pin our signing certificate so only our signed builds are permitted to execute.
Questions a review usually asks¶
Can it be made to accept inbound connections by a future update? No. There is no listening socket in the code, so "accept inbound" is not a setting that could be flipped — it would require shipping a fundamentally different program. An update can only replace the agent's own executable, after the SHA-256 gate; it cannot modify your firewall or host configuration.
What if your download host were compromised? Two independent guards. Client-side, the agent refuses any update whose bytes do not match the SHA-256 it fetched over verified TLS. Server-side, the download host is integrity-monitored in real time — any change to a published installer outside a signed release is pulled from distribution within seconds and alerts us.
Can we deploy without ever talking to your cloud?
You can evaluate entirely offline with -selftest. Continuous operation does
require the agent to report to the dashboard — that is what produces the fleet
view — but you can pin the version with -no-auto-update and deploy it yourself.
Still need something? support@acutisgo.com — we are happy to walk a security team through the binary directly.