Skip to content
SutaSutaSuta Docs

How Suta works

Suta has three parts: the Suta app at app.suta.dev, the Suta agent that runs on each device, and the Suta CLI on your computer. You, your team and your AI agents all go through the app, which decides what each of you can do.

Browserapp.suta.dev
Terminalsuta CLI
AI agentMCP connection
Suta appRoles · approvals · activity
Raspberry PiSuta agent
Raspberry PiSuta agent
Devices connect out to Suta. You never need to open a port on your network.

Workspaces

Section titled “Workspaces”

A workspace holds devices and the people who manage them. Everyone in a workspace has a role that controls what they can do. You can belong to more than one workspace and switch between them.

Devices and identity

Section titled “Devices and identity”

When the Suta agent first starts, it creates its own private key on the device. That key never leaves the device and is the device’s identity. Nothing customer-specific is baked into the Suta image, so you can clone a fresh card before its first boot to set up many devices.

The first workspace to claim a device owns it. After that, changing its network settings needs permission from that workspace. If you reflash the SD card, the device gets a new identity and you add it again.

Online means online

Section titled “Online means online”

The agent sends a signed heartbeat to Suta every few seconds. A device shows as Online only while those heartbeats keep arriving. If they stop for 30 seconds, it shows as Offline, and any measurements you see are labeled as the last values it reported. Suta never fills gaps with made-up numbers.

Off until you turn it on

Section titled “Off until you turn it on”

Features that reach into a device start switched off:

  • Monitoring collects metrics and logs only after someone turns it on for that device. See Monitor devices.
  • Remote access opens only for a time window you choose, such as one hour. Commands and terminals work only while the window is open. See Remote access.

Every action is checked and recorded

Section titled “Every action is checked and recorded”

Each request is checked against the person’s role, and for AI agents, against the access you approved for that agent. Commands and service restarts are recorded in the workspace activity, and terminal sessions are recorded in full. See Activity and recordings.