Neuribrain WATCH

Turn raw VPS logs into understandable, evidence-backed incidents with GPT-5.6.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Neuribrain WATCH

Inspiration

Small VPS operators usually choose between raw web-server logs, complex enterprise observability stacks, and hosting dashboards that show charts without explaining what happened. We wanted the first screen to answer a simpler question: is my server healthy, and if not, what exactly should I look at?

What it does

Neuribrain WATCH passively reads a dedicated Nginx or Apache access log, keeps events and SQLite on the VPS, and turns traffic, errors, latency, threats, automation and new origins into understandable incident dossiers. The UI deliberately separates live health from historical incidents still awaiting acknowledgement, then provides a three-level drill-down from signal to root cause and supporting HTTP events.

Deterministic detection runs first. GPT-5.6 then receives only bounded, sanitized evidence and produces grounded facts, impact and recommendations. Point analysis requires the operator's own server-side OpenAI API key and an explicit cost confirmation.

How we built it

WATCH is a Node.js/Express application with SQLite, a responsive vanilla JavaScript dashboard, local geographic data, Nginx and Apache collectors, systemd hardening, pairing-code authentication, rate limiting, CSRF protection and a one-command Ubuntu/Debian installer.

Codex was the engineering control plane: it helped redesign the information architecture, isolate demo and production data paths, audit security boundaries, build regression tests, validate clean-VM installation on both Nginx and Apache, and prepare the release. GPT-5.6 is the reasoning layer inside the product.

Challenges

The hardest design problem was avoiding contradictions between fast-changing live metrics and asynchronous incident reports. We solved it by making each KPI show a short live window while keeping unacknowledged incidents as a separate durable state. Another challenge was making synthetic judging data honest: only ingestion is simulated; dashboards, queries, filters, incident calculations and navigation use the same production code paths.

Accomplishments

  • One-command installation with environment preflight and a visible pass/block report
  • Nginx and Apache support without Cloudflare as a requirement
  • Local-first storage and bounded evidence sent to GPT-5.6
  • Evidence-backed, acknowledgeable incident dossiers
  • Public synthetic demo plus a tested v0.19.0 release
  • 76 automated tests, clean build and zero npm audit findings at submission time

Try it

Public demo: https://neuribrain.com/watch/

Source and installation: https://github.com/patmail/neuribrain-watch

One-command install: curl -fsSL https://raw.githubusercontent.com/patmail/neuribrain-watch/main/install.sh | sudo bash

Honest limitations and what's next

The public demo uses synthetic events and preloaded reports. Free-form chat and scheduled reports are previews in v0.19.0. Execute actions demonstrates a guarded approval workflow but does not yet mutate a VPS. Next we will add a persistent Codex worker for scheduled reports, signed remediation plans with preview/approval/rollback, and longer clean-VM soak tests.

Built With

Share this project:

Updates