MantisOps · Reference

System Requirements

Last updated October 2026 · Applies to the MantisOps agent and the MantisOps network probe

What a computer needs to run the agent (installed on each device you manage) and the probe (one per site, to scan and monitor the network). Memory and disk figures are for the MantisOps software itself, not for the rest of what the machine does. Add them to your own workload.

At a Glance

Windows

• Versions: 64-bit Windows 10, Windows 11, and Windows Server 2016 or later.
• Windows 10 1809 or later (and Server 2019 or later) is recommended. The full interactive terminal needs it. On older builds, including Server 2016, the terminal still works in a simpler mode.
• Windows PowerShell 5.1 (included with Windows) must be available. The install command uses it, and the agent runs many of its checks through it.
• Remote desktop does not need a graphics card. It works on virtual machines and on computers with software-only graphics.
• Install location: C:\Program Files\MantisOps (program and logs) and C:\ProgramData\MantisOps (configuration and device key).
• Security software: if you use application allow-listing or endpoint protection, see Detecting & Controlling the Agent for how to recognise and allow the agent.

macOS

• Versions: macOS 14 Sonoma or later, on Apple silicon or Intel. One universal package covers both.
• Install: as root or with sudo. The agent installs as /Applications/MantisAgent.app with a launch daemon that starts at boot.
• Privacy permissions (granted once, in System Settings or by an MDM profile): Screen Recording and Accessibility for remote desktop, and Full Disk Access for the file browser and patching. See macOS privacy permissions.
• Remote desktop shows the screen of the user who is logged in at the Mac. With nobody logged in there is no desktop to capture.
• Software updates: the agent installs updates that don't need the owner's password or a restart. See Features That Need More.

Linux

• Architectures: x86-64 (amd64) and ARM64 (aarch64). 32-bit ARM and 32-bit x86 are not supported.
• systemd is required. The agent installs as the systemd service mantis-agent.
• Any distribution: the agent is a single self-contained program with no distribution-specific libraries. The install command needs bash and curl and must run as root.
• Patching works with apt (Debian, Ubuntu), dnf and yum (RHEL, Fedora, CentOS and relatives) and zypper (SUSE).
• Remote desktop needs a logged-in graphical desktop session. On X11 the agent captures the screen directly. On Wayland it needs the grim screenshot tool, and keyboard and mouse control uses /dev/uinput. The xdotool and xclip tools improve hotkeys, typing and the clipboard. A server with no desktop has nothing to show; use the terminal there.
• Keep the system's standard certificate bundle (ca-certificates) installed so the agent can verify the MantisOps servers.

Network Probe

The probe is a separate program. It runs on an always-on computer inside the network you want to cover, such as a small VM or a spare server.

• Versions: Windows 10, Windows 11 and Windows Server 2016 or later (x64), or Linux on x86-64 or ARM64 with systemd. There is no macOS probe.
• Placement: the probe must be able to reach the devices you want to scan or monitor. Use one probe per site, or per routed segment it can't reach from elsewhere.
• Windows: no driver is needed. Port scans use TCP connect scanning. If Npcap is already installed, the probe detects it and uses faster SYN scanning. The probe never installs Npcap. Ping checks use Windows' own ICMP support, with nothing extra to install.
• Linux: the service created by the install command runs as root, which gives it the raw-socket permission (CAP_NET_RAW) that ICMP ping and SYN scanning use. If you run the probe as another user, grant it that capability. Without it the probe falls back to TCP connect scanning.
• IPv4: ICMP ping checks and local-network (ARP) discovery use IPv4 addresses.
• Ports the probe listens on (only if you send it that data; a port already in use is skipped): UDP 514 (syslog), UDP 162 (SNMP traps), and UDP 2055 (NetFlow), 4739 (IPFIX) and 6343 (sFlow) for flow data. Allow these on the probe host's own firewall only for the data you use. They are never needed from the internet. See the MantisNMS guide.
• Traffic to your devices depends on what you configure: ICMP, TCP and UDP checks, SNMP (UDP 161), HTTP and HTTPS, and so on.
• Files: Windows C:\Program Files\MantisOps\Probe (program, config.json, identity.json, probe-debug.log); Linux /usr/local/bin/mantis-probe with /etc/mantis-probe/config.json. The log rotates at 10 MB, keeping one older copy. See the probe install guide.

Network

The agent and the probe only make outbound connections. No inbound firewall rules or port forwarding are needed on the internet side.

Hosts to allow (TCP 443, outbound)

• DNS: these names must resolve from the device.
• Protocol: HTTPS with TLS 1.2 or later, and WebSocket upgrades on port 443.
• Proxies and inspection: exempt these hosts from TLS inspection and allow WebSocket upgrades. A broken WebSocket shows up as an agent or probe that enrolls but stays offline. The agent and probe do not read the Windows system proxy setting or proxy auto-config (PAC) files. If you must use a proxy, set the standard HTTPS_PROXY and NO_PROXY environment variables for the service, or allow the hosts above to connect directly, which is the most reliable choice.
• Clock: keep the device's clock roughly correct (a time service or domain time is enough). TLS certificate checks fail when the clock is far off.
• Remote desktop, optional: a remote session can connect directly (WebRTC over UDP, which uses public STUN servers to find a path). If UDP is blocked, the session relays over the TCP 443 connection instead, which works but can be slower.
• Optional internet look-ups: some Mantis360 probe scans (vulnerability and external web or domain assessments) also fetch public reference information over HTTPS (443) from internet services, and may return less detail if that traffic is blocked. The Mantis360 module of the agent also makes a short public IP look-up; if it is blocked, only the public IP field stays empty.

Bandwidth

An idle agent or probe sends small keep-alive and status messages and is light enough for ordinary office and branch connections. Remote desktop sessions and file transfers use more, but only while they are open. Downloads happen at install and update time: the Windows agent is about 20 MB, the Linux agent about 13 MB, and the Windows probe about 42 MB.

Features That Need More Than the Basics

Everything else works on any supported system. These features have extra requirements:

What Is Not Supported

• 32-bit operating systems (Windows x86, Linux x86 and 32-bit ARM).
• Windows 7, Windows 8 and 8.1, and Windows Server 2012 R2 or older. The current agent and probe are built for Windows 10 / Server 2016 and later.
• Windows on ARM. Only the x64 build is provided.
• macOS 13 Ventura and older. The agent package is built for macOS 14 and later.
• Linux without systemd (for example OpenRC, runit or SysV init), and other CPU architectures.
• A probe on macOS. Probes run on Windows and Linux only.

If your environment isn't covered here, contact support before deploying widely.