An AI that finds the problem before your client calls.
CmdNOC is a managed-services operations platform with an AI engine at the wheel — one that reads from real systems, says I don't know when it doesn't, and never writes without your confirmation.
150+ tools10 connected platforms3-layer auth34 confirmed write paths1 prime directive
Most managed-services tools start with a dashboard and bolt on an assistant. CmdNOC inverts that: the AI engine is the interface, the dashboards are what it reads to answer you, and every action that changes production state stops to ask first. It is operations as a conversation — with a clear record of who said what, who decided, and what it did.
— Built by an operating MSP for operating MSPs.
What the platform does
Three things, in order.
§ 01 · WATCHES
It watches everything at once.
Wireless health, switch and router state, security and intrusion events, endpoint alerts, mobile device posture, identity systems, mailbox anomalies, backup status. Every source pulled on its own cadence; every event archived; every change tracked back to a who and a when.
§ 02 · ANSWERS
It answers from real data.
You ask a question in plain language. Cora picks the right tool — out of more than 150 — calls it against the live system, reads the result, and answers. The answer is grounded in what just came back. There is no guessing about "what it probably is" and no my training data suggests. If she can't find it, she says so.
Every tool call is logged. Every answer can be traced to its evidence.
§ 03 · ACTS
It acts only when authorized.
Cora can draft an email, propose a calendar event, generate a firewall change, mark a ticket complete. None of it happens silently. Outbound mail lands as a draft in your real Drafts folder and only ships when you say send it. Calendar events display as a preview until you set confirm: true. Firewall blocks require a click in a confirmation modal that names the IP, the network, and the rollback path.
The credential layer enforces this independently. Cora's read keys cannot mutate production even if the model intends to. Write keys live behind separate, human-confirmed code paths.
Connected systems
Works with the tools you already run.
CmdNOC reads from the platforms you already operate — each pulled live on its own cadence, every event archived. No rip-and-replace.
Cisco Meraki WyeBot WiFi Datto RMM Datto SaaS Microsoft 365 Microsoft Entra ID Google Workspace IT Glue Autotask PSA JAMF Pro
Meet Cora
// the intelligence engine
Not a chatbot. Not autopilot. An intelligence engine.
Cora is the AI engine inside CmdNOC. She holds the rank of Number One under operator authority — empowered to recommend, obligated to be honest, restricted from writing without confirmation.
Where typical LLM assistants improvise, Cora is bounded by a tool surface. Every reply comes from a specific call against a specific system. Every recommendation comes with its evidence and its confidence rating attached.
150+production tools
10 connected platforms
34 write paths, every one human-confirmed
all logged
search_datto_alertsLive alert search across RMM — by description, device, severity, time window.
draft_my_mailComposes an Outlook draft. Never sends until you confirm.
run_dcdiagRuns domain controller diagnostics in parallel via the RMM queue. ~3 min.
create_incidentOpens an incident; joins seven data sources into one correlated timeline.
LIVE EXCERPT · 2026-05-23SESSION 4F12
captain ▸any blue screens across the campus this week?
Three BSOD events in the last 7 days:
LAB-04 2026-05-22 09:14 bugcheck 0x7E (driver fault)
FAC-12 2026-05-21 14:33 bugcheck 0xF4 (process death)
ADM-02 2026-05-19 11:02 bugcheck 0x124 (WHEA — hardware)
The WHEA on ADM-02 has happened twice this month — the prior was 2026-05-09. Hardware-class bugchecks rarely fix themselves. Want me to pull its alert history and the Datto inventory so we can decide on a replacement?
PRIME01DIRECTIVE
The Prime Directive · v1.0
Do no harm.Take your time.Tell the truth.
Every AI agent operating on this platform is bound by a published, versioned governance document. It says what is acceptable to do, what is acceptable to refuse, what requires human confirmation, and what must never happen. It is not a marketing statement. It is loaded into every session, every model, every time.
Established · May 8, 2026Authority · James RaffertyBinding on · Cora · Scotty · Makee
A wired-network O365 issue silently affecting 1,500 users — caught and fixed before a single complaint.
Performance telemetry from the wireless side showed pristine numbers. Wired-side Microsoft 365 wasn't so lucky. Cora correlated WyeBot pass-rate data with firewall configuration, identified a misconfiguration silently degrading O365 traffic for every wired device on campus, and recommended the corrective rule. The operator approved. The fix shipped before any user noticed.
1,500+ users affected0 tickets filed
Private K-12 · M365 Identity
An active password-spray campaign detected, classified, and surfaced — under a minute, no human in the loop.
The sign-in anomaly scheduler reads M365 activity logs on a tight cadence. A failed-then-succeeded sign-in pattern across multiple users from a foreign network triggered the post-spray-takeover classifier, opened a Bridge Report, escalated to Makee for second-opinion analysis, and alerted the operator — before the attacker could pivot.
< 60s detect → alert2 AI analysts in chain
Private K-12 · Wireless
Campus-wide wireless tuned for academic testing — without a site survey, without a downtime window.
Bluebook iPad testing day was approaching. Cora cross-referenced WyeBot channel utilization with Meraki AP placement, identified contention in Room 325, proposed a channel-plan and power adjustment per AP, and queued the changes for operator approval. The room passed Bluebook with margin.
100s access points0 downtime windows
Private K-12 · Security
An active threat actor detected and blocked at the perimeter in under sixty seconds.
IDS surfaced a brute-force pattern from an outside IP. Cora summarized the activity, identified the source, drafted a firewall block rule for the affected MX, and presented the operator with the proposed change — IP, network, rule position, rollback path — all on one screen. One click. Block in place.
< 60s detect → block1 human click
Compliance readiness
Know where you stand — before the audit.
PCI DSS 4.0 and the HIPAA Security Rule treat your technical controls as something to prove, not assert. We monitor those controls continuously, run authorized vulnerability assessments and penetration testing, and keep the evidence mapped and current — so when an assessor asks, the answer is already on file.
Readiness and evidence — not attestation. The formal sign-off stays with a certified ASV or QSA; we hand them a package that's already in order.
Four characters. One human. Three AI roles, each with a defined scope, a defined credential set, and a defined governance contract. Naming them is not whimsy — it is how authority and accountability are made legible.
001 · Captain
JR
James RaffertyCaptain · Owner · Operator
The design architect and creative mind behind CmdNOC, with 25+ years in managed services. He built the Control Center because the tooling he'd relied on for decades didn't trust its operators with real answers — and wouldn't admit when it didn't know. He runs it in production, approves every write, and holds the only break-glass keys.
002 · Cora
C
CoraNumber One · Intelligence Engine
The platform's primary AI. 150+ tools across every connected system. Empowered to recommend with calibrated confidence. Restricted from writing without explicit operator confirmation. Speaks plainly when she doesn't know. Her institutional memory is the Ship's Library — a curated knowledge base she searches on demand to ground answers in your own runbooks, notes, and history rather than generic advice. Every conversation and tool call is logged and archived.
003 · Scotty
S
ScottyDevelopment Engineer
The AI that maintains the Control Center itself. Operates directly on the codebase, snapshots before changes, verifies after, reports honestly when something breaks. Holds the same Prime Directive as Cora, applied to a different surface. And unlike a stock assistant that forgets between conversations, Scotty runs on a custom-engineered persistent memory system — a self-indexing, health-monitored knowledge base that carries every lesson and hard-won gotcha forward, so engineering context compounds across sessions instead of resetting to zero.
004 · Makee
M
MakeeSecond-Opinion Analyst
Quiet between reports. Watches the operational data and writes a digest twice each day — what changed, what's anomalous, what to look at first. Independent of Cora, by design. Named for the perceptive intermediary from Halo.
✦
Built on Anthropic Claude.
Cora, Scotty, and Makee are powered by the Claude model family from Anthropic. The Prime Directive is custom; the calibrated honesty and the willingness to say I don't know are not — they are values baked into the model itself, and they are why we chose it.
POWERED BY
Claude · Anthropic
Opus 5
✦
Contact the Bridge
If this looks like what your network has been missing.
CmdNOC isn't on a marketplace. It's an operations platform we run on our own clients first. If you want to see what an AI-governed NOC looks like on your stack — write to us.