Meet Liam - the server and endpoint health monitor that runs on your laptop

Server and endpoint monitoring is one of those domains where the existing tools are excellent at detection and mediocre at the loop of understand → decide → act. They tell you something's wrong; you still need a human to look at the logs, correlate the signals, and decide whether to roll back, restart, page someone, or wait.

Liam is one of the 7 production-ready agent templates that ship with Avery NXR. He runs health-check shell commands every 30 minutes (configurable), correlates anomalies with your local SLM, auto-remediates known issues, and alerts you when human attention is actually needed. The shell commands run on your infrastructure. The correlation runs on your laptop. Nothing sensitive crosses to a cloud LLM.

What Liam actually does

Every 30 minutes (or whatever interval you configure):

• Liam runs the health-check shell commands you've defined — disk usage, memory pressure, process status, port checks, SSL certificate expiry, response time probes, log tail patterns, whatever you set up
• Compares the results against thresholds you've configured
• For anything anomalous, correlates with recent context — recent deploys, recent config changes, related service status
• If the anomaly matches a known issue pattern in his playbook, executes the documented remediation (restart a service, clear a cache, rotate a log)
• If the anomaly is novel, generates a structured assessment — what changed, what's affected, what to investigate first — and pages the on-call
• Logs every action to a structured audit trail

The whole loop typically runs in 30-90 seconds. Nothing about your infrastructure or your operational data crosses to a cloud LLM.

Why local matters in operational contexts

Server and endpoint data is uniquely sensitive. Logs often contain customer identifiers, sometimes secrets that should have been scrubbed but weren't, infrastructure topology that competitors would find useful, and operational signal that reveals your scale and reliability posture.

Most modern observability stacks pipe all of this to cloud-hosted backends, which is a different architecture from running AI on the same data. Adding cloud-LLM AI on top of an already-sensitive observability stack compounds the privacy posture in ways that some compliance teams object to.

Liam keeps the operational AI loop on your laptop. The shell commands run on your servers. The output stays in your environment. The LLM correlation runs locally. The audit trail is yours.

What's running under the hood

Liam's graph in Avery NXR:

Scheduled trigger (every 30 min)
  → Loop over check definitions:
       → Execute shell command (with guardrails)
       → Compare against thresholds
       → IF anomalous:
            → Correlate with recent context
            → Match against known patterns (local LLM + playbook KB)
            → IF known pattern:
                 → Execute remediation
                 → Log action
            → ELSE:
                 → Generate assessment
                 → Page on-call (PagerDuty / Opsgenie / Slack)
                 → Log assessment

The shell command execution is sandboxed. You define what Liam can and can't run via the guardrails — he can never execute arbitrary commands you didn't authorize.

What it costs

A cloud-LLM equivalent — sending logs and shell outputs to an LLM API for correlation and remediation suggestions — depends on the volume of anomalies. For a typical small infrastructure (a handful of services, moderate alert volume), it's $50-$200/month in API costs. For larger infrastructure with high alert volume, it's in the low thousands per month.

Liam runs on your local model. Cost per check cycle is electricity.

The compounding benefit

Once Liam is running, his playbook grows over time. Each novel issue you handle becomes documentation he can match against in the future. The first time you see a disk-full incident, you handle it manually and document the remediation. The second time, Liam catches it and remediates automatically.

This compounding is the whole point of AI in operations. The flat-cost economics of local execution make the compounding practical — you can keep adding playbook entries without each one adding to a per-call cloud LLM bill.

Try Liam in 5 minutes

If you've already got Avery NXR:

1. Open the Agents tab
2. Find Liam (LIAM · IT / OPS)
3. Click "Use this template"
4. Configure the shell commands you want him to run (he ships with a starter set)
5. Set the check interval (default 30 min)
6. Connect your alerting destination (PagerDuty, Opsgenie, Slack)
7. Optionally populate his remediation playbook with patterns you already know
8. Hit Run

The first check cycle runs immediately. Adjust thresholds and playbook entries as you see the output.

If you don't have Avery NXR yet, request access at avery.software. Free Desktop tier, no card required.