v1.0.42 • Slack Socket Mode • Zero Inbound Ports

Control Your Home Network
From Any Slack Channel.

Turn Slack messages into real-time commands across your LAN. Works seamlessly behind NAT, firewalls, and CGNAT with zero open ports. Discover network devices, send Wake-on-LAN packets, manage Docker containers, and execute commands on remote Windows and Linux PCs via authenticated standalone agents.

Download Standalone Agent Try Interactive Simulator 5-Min Setup

bash — docker quick start

$docker run -d --net host --env-file .env lhotakj/cmdiqo-bot:latest

0 Ports

Inbound Open Ports

WSS TLS

Socket Mode Outbound

< 18 MB

Lightweight Agent RAM

Win & Linux

Signed Standalone Binaries

Core Capabilities

Engineered for Complete Network Autonomy

A lightweight, enterprise-grade architecture that bridges your Slack workspace to distributed machines without exposing a single open port.

Security

Socket Mode & Zero Open Ports

Outbound TLS WebSocket

Classic Slack bots require public HTTPS endpoints and port forwarding. Cmdiqo leverages Slack Socket Mode to establish a single encrypted outbound WebSocket connection. Works completely behind NAT, firewalls, and CGNAT with zero exposed ports.

Zero open inbound firewall ports
Works behind CGNAT, cellular, and hotel WiFi
TLS encryption handled directly by Slack Bolt

Zero-Install

Distributed Standalone Agents

Windows & Linux Binaries

Tiny standalone binaries compiled via PyInstaller and packed with UPX. Authenticode signed with digital certificates for Windows 10/11/Server and native systemd service packaging for Ubuntu, Debian, Fedora, and Raspberry Pi OS.

Authenticode code-signed Windows executables
One-command systemd and Windows Service installers
Persistent outbound WebSocket with HMAC auth

Extensible

YAML-Driven Extensibility

Shell & Python Backends

Add custom commands in seconds without writing bot code. Simply define command triggers, arguments, and regex captures in commands.yaml. Execute shell scripts with timeouts or invoke pure Python functions returning rich text.

Captured argument placeholders like {host} and {svc}
Configurable execution timeouts and working directories
Automatic slash command aliases like /home or /wol

Network

LAN Discovery & Wake-on-LAN

Network Surveillance

Keep complete visibility of your home network. Discover active devices via arp-scan with ip neigh fallback, map MAC vendors, ping IP addresses, and send Wake-on-LAN magic packets to wake sleeping PCs across subnets.

Instant ARP sweep of local subnet with MAC lookup
Wake-on-LAN magic packet injection
Live agent ping and connectivity checks

Containers

Docker & Container Ops

DevOps from your Phone

Control Docker containers running on any host from your mobile Slack app. Inspect running containers, inspect memory and CPU utilization stats, tail the last 50 lines of logs, and trigger compose restarts on demand.

Live docker ps and resource stats snapshots
Tail container logs straight into Slack threads
Automatic thread responses with clean formatting

Monitoring

Remote Host Telemetry

Uptime, RAM, Disk & Top

Query real-time hardware and OS metrics across your fleet. Inspect uptime, free RAM, drive space partitions, and top CPU-consuming processes on Windows and Linux machines without SSH or RDP overhead.

Instant RAM and storage utilization metrics
Cross-platform top CPU process identification
Safe remote system reboot and shutdown commands

Administration

System Services & Windows Updates

Systemd & Windows SCM

Manage system background daemons remotely. Query service states, restart failing services via systemd or Windows Service Control Manager, and query installed Windows Hotfix updates for security compliance.

Service status inspection and restart triggers
Windows SCM and Linux systemd unification
Installed Windows Update hotfix auditing

Guard

Parental & Distraction Guard

Hosts-Level Instant Shield

Enforce digital focus or bedtime rules in one message. Instantly block or restore YouTube, Roblox, Minecraft, and Discord at the OS hosts and DNS layer across child PCs, accompanied by automatic DNS resolver flushes.

One-tap block for YouTube, Roblox, Discord & Minecraft
Instant DNS resolver flushing (Windows & Linux)
Query live shield status without physical access

Interactive Terminal

Experience Cmdiqo Right in Your Browser

Click a quick command pill below or type your own slash command into the interactive Slack simulator. Experience how real-time Socket Mode acknowledgments and output blocks arrive in Slack channels.

Try a command:

#lan-control Socket Mode Active

Topic: Cmdiqo LAN Management Bot (v1.0.42) • Zero Inbound Ports

cmdiqo-botAPPToday at 12:00

Connected to Slack via Socket Mode • WebSocket Hub listening on ws://0.0.0.0:8765 (3 remote agents online).
Type a slash command or click one of the pills above to test remote network operations!

DEV

YouToday at 12:01

/lan devices list

cmdiqo-botAPPToday at 12:01

✅lan-devices-list • 4 active devices discovered on subnet:

IP ADDRESS     MAC ADDRESS        HOST NAME
192.168.1.1    aa:bb:cc:dd:ee:ff  router.home
192.168.1.10   22:33:44:55:66:77  nas.home
192.168.1.20   11:22:33:44:55:66  rpi4-server.home
192.168.1.55   88:99:aa:bb:cc:dd  workstation-win11.home

Zero-Trust Architecture

Decoupled Three-Tier Topology

Engineered specifically for home labs and distributed networks. Outbound WebSockets eliminate inbound firewall holes, dynamic DNS headaches, and reverse proxy vulnerabilities.

1. Slack Cloud Platform

User Interface & Notification Dispatch

Users interact seamlessly via Slack desktop, browser, or mobile apps. Slash commands and messages are queued through Slack's secure cloud infrastructure.

ProtocolWSS TLS 1.3

Port Exposure0 Ports

Client SupportiOS / Android / Desktop

2. cmdiqo-bot & WebSocket Hub

Socket Mode Dispatcher & Central Switch

Runs as a Docker container or Python service on your primary local server. Connects OUTBOUND to Slack via Socket Mode, parses YAML commands, checks user permissions, and dispatches tasks to remote agents.

Hub Port8765 (Local LAN)

Auth MethodHMAC SHA-256

Command EngineShell & Python

3. Distributed cmdiqo-agent Daemons

Lightweight Nodes on Managed Machines

Single-file binaries compiled with PyInstaller and packed with UPX. Each agent maintains a persistent outbound WebSocket to the Hub, executes commands safely, and streams stdout/stderr back.

Windows Binarycmdiqo-agent.exe (Signed)

Linux Binarycmdiqo-agent (systemd)

Memory Footprint< 18 MB RAM

⚡

End-to-End Command Dispatch Lifecycle

Slack User

Sends `/host PC-OLO win reboot` or `/home docker restart plex`.

Command is issued in Slack private or public channel.

Slack API

Pushes WebSocket event down the persistent Socket Mode stream.

Zero incoming NAT/firewall configuration required.

cmdiqo-bot

Validates user permissions, matches command regex, sanitizes parameters.

Instantly posts acknowledgment: '⏳ Running command on PC-OLO...'

WebSocket Hub

Generates unique UUID req_id, dispatches JSON payload to target agent.

Correlated across all logs via 8-char request hash.

cmdiqo-agent

Executes command via PowerShell or Bash subprocess with timeout protection.

Captures exit code, stdout, and stderr safely.

Hub & Bot

Receives JSON result, resolves future, posts thread reply in Slack with mrkdwn.

Thread reply formatted with ✅ status and clean preformatted block.

Sent by the agent immediately upon initiating an outbound connection to ws://<hub_ip>:8765 with Bearer token authentication:

{
  "type": "hello",
  "name": "PC-OLO",
  "version": "1.0.42",
  "platform": "windows"
}

Dispatched from Hub to the target agent. Correlated via 32-character UUID:

{
  "id": "a1b2c3d4e5f67890123456789abcdef0",
  "type": "exec",
  "kind": "ps1",
  "cmd": "Get-Service | Where-Object {$_.Status -ne 'Running'} | Format-Table -AutoSize",
  "cwd": null,
  "timeout": 180
}

Returned from agent to Hub upon subprocess completion:

{
  "id": "a1b2c3d4e5f67890123456789abcdef0",
  "type": "result",
  "ok": true,
  "code": 0,
  "output": "Status   Name      DisplayName\n------   ----      -----------\nStopped  ALG       Application Layer Gateway Service...",
  "error": null
}

Command Catalog

Built-In Operations & Custom Extensions

Explore default Slack commands for network administration, remote diagnostics, and container management. Extend effortlessly with your own custom shell scripts or Python functions in commands.yaml.

lan

Alias: lan devices list

/lan devices list

List all devices seen on local network via ARP broadcast scan

Simulated Output:

IP ADDRESS     MAC ADDRESS        HOST NAME
192.168.1.1    aa:bb:cc:dd:ee:ff  router.home
192.168.1.10   22:33:44:55:66:77  nas.home
192.168.1.20   11:22:33:44:55:66  rpi4-server.home
192.168.1.55   88:99:aa:bb:cc:dd  workstation-win11.home

lan

Alias: /wol 00:11:22:33:44:55

/lan wake 00:11:22:33:44:55

Send Wake-on-LAN magic packet to boot a sleeping PC or server

Simulated Output:

✨ Magic packet sent to 00:11:22:33:44:55 on port 9
(broadcast 255.255.255.255). Target device should boot shortly.

lan

/lan ping 192.168.1.1

Ping an IP or hostname from Hub container to verify latency

Simulated Output:

PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.421 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.389 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.405 ms
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max = 0.389/0.405/0.421 ms

lan

/lan agents list

List all connected remote agents, platform, version, and IP

Simulated Output:

CONNECTED AGENTS (3 online):
NAME          PLATFORM   IP             VERSION          CONNECTED
home-nas      linux      192.168.1.10   1.0.42           3d 14h 22m
PC-GAMING     windows    192.168.1.55   1.0.42           8h 12m 04s
rpi-sensor    linux      192.168.1.20   1.0.42           12d 02h 11m

system

Alias: /home uptime

/host home uptime

Check system uptime, boot time, and current load average

Simulated Output:

[home] Uptime: 45 days, 8 hours, 12 minutes
Boot time: 2026-08-11 14:22:18 UTC
Load Average: 0.18, 0.22, 0.19 (4 cores)

system

Alias: /home memory

/host home memory

Inspect RAM usage, free memory, and swap utilization

Simulated Output:

[home] MEMORY USAGE:
Total RAM:   31.2 GB
Used RAM:    12.4 GB (39.7%)
Available:   18.8 GB (60.3%)
Swap:        2.0 GB used of 8.0 GB

system

Alias: /home disk

/host home disk

Check disk partitions, mounts, and available storage space

Simulated Output:

[home] FILESYSTEM USAGE:
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p2  938G  312G  579G  36% /
/dev/sda1       7.3T  4.1T  2.9T  59% /data/storage
/dev/sdb1       3.6T  1.2T  2.3T  35% /mnt/backup

system

/host home top

Display top 10 CPU-consuming processes on remote host

Simulated Output:

[home] TOP CPU PROCESSES:
PID    USER       %CPU  %MEM  COMMAND
14202  docker     14.2  8.1   plex-transcoder
18911  root        3.8  2.4   containerd
2290   node        2.1  3.2   homebridge
841    systemd     0.4  0.2   systemd-journald

docker

Alias: /home docker ps

/host home docker ps

List all running and stopped Docker containers

Simulated Output:

CONTAINER ID   IMAGE                 STATUS         PORTS                     NAMES
b8f9e0a12c4d   plexinc/pms-docker    Up 14 days     0.0.0.0:32400->32400/tcp  plex
a1b2c3d4e5f6   homeassistant/home    Up 45 days     0.0.0.0:8123->8123/tcp    homeassistant
e7f8a9b0c1d2   portainer/portainer   Up 45 days     0.0.0.0:9443->9443/tcp    portainer
3c4d5e6f7a8b   pihole/pihole:latest  Up 45 days     0.0.0.0:53->53/udp        pihole

docker

Alias: /home docker restart plex

/host home docker restart plex

Restart Docker container or docker compose service

Simulated Output:

✅ [home] Container plex restarted successfully in 2.14s.
Status: Up 2 seconds (healthy)

docker

/host home docker stats

Snapshot of CPU, RAM, and network usage per container

Simulated Output:

NAME             CPU %   MEM USAGE / LIMIT     MEM %   NET I/O
plex             8.42%   1.41GiB / 31.24GiB    4.52%   142MB / 8.9GB
homeassistant    1.12%   485MiB / 31.24GiB     1.51%   45MB / 12MB
pihole           0.28%   128MiB / 31.24GiB     0.40%   89MB / 67MB

services

/host PC-OLO services

List active system daemons (systemd or Windows SCM)

Simulated Output:

[PC-OLO] ACTIVE SYSTEM SERVICES:
SERVICE NAME                 DISPLAY NAME                           STATUS
cmdiqo-agent                 Cmdiqo Agent Daemon                    Running
LanmanServer                 Server (SMB/CIFS)                      Running
wuauserv                     Windows Update                         Running
WinDefend                    Microsoft Defender Antivirus Service   Running

services

/host PC-OLO win updates

Query installed Windows updates and recent hotfixes

Simulated Output:

[PC-OLO] RECENT WINDOWS HOTFIXES:
HotFixID   Description      InstalledBy          InstalledOn
KB5039212  Security Update  NT AUTHORITY\SYSTEM  2026-09-12
KB5038285  Update           NT AUTHORITY\SYSTEM  2026-08-20
KB5037771  Security Update  NT AUTHORITY\SYSTEM  2026-07-15

parental

/host PC-KIDS parental on

Block YouTube, Roblox, Discord, Minecraft in hosts file & flush DNS

Simulated Output:

🛡️ [PC-KIDS] Parental Guard ENABLED.
Blocked domains: youtube.com, roblox.com, minecraft.net, discord.com
DNS resolver cache flushed successfully.

parental

/host PC-KIDS parental off

Unblock gaming and video sites and restore normal internet access

Simulated Output:

🔓 [PC-KIDS] Parental Guard DISABLED.
Hosts file restored. DNS resolver cache flushed successfully.

parental

/host PC-KIDS parental status

Query active parental blocking status without physical access

Simulated Output:

[PC-KIDS] Parental Guard Status:
Status: ACTIVE 🛡️
Blocked categories: Entertainment (YouTube), Gaming (Roblox, Minecraft), Chat (Discord)
Rule applied at: 2026-09-25 18:00:00

Release Hub

Download Standalone Binaries & Containers

Precompiled standalone executables for Windows and Linux, multi-architecture Docker containers, and the offline console emulator.

Latest Release: v1.0.42• Verified GitHub Build

Authenticode Signed

Windows x64 Standalone Agent

Windows 10 / 11 / Server (x64)

Includes code-signed cmdiqo-agent.exe, automated PowerShell service installer (install-service.ps1), uninstall script, and configuration templates.

Quick Installation Command:

# 1. Extract zip and navigate to directory:
Expand-Archive cmdiqo-agent-windows-x64.zip -DestinationPath C:\cmdiqo-agent
cd C:\cmdiqo-agent

# 2. Configure agent environment:
Copy-Item agent.env.example agent.env
# Edit agent.env with your HUB_URL, AGENT_TOKEN, and AGENT_NAME

# 3. Install as automatic background Windows Service:
powershell.exe -ExecutionPolicy Bypass -File .\install-service.ps1

Download cmdiqo-agent-windows-x64.zip Release Notes →

Systemd Ready

Linux x64 Standalone Agent

Ubuntu / Debian / Fedora / RHEL (x64)

Single-file UPX packed binary cmdiqo-agent with automated systemd service installer script (install-service.sh) and environment files.

Quick Installation Command:

# 1. Unzip archive:
unzip cmdiqo-agent-linux-x64.zip -d /opt/cmdiqo-agent
cd /opt/cmdiqo-agent

# 2. Configure agent environment:
cp agent.env.example agent.env
# Edit agent.env with HUB_URL, AGENT_TOKEN, AGENT_NAME

# 3. Install and start as systemd service:
sudo ./install-service.sh

Download cmdiqo-agent-linux-x64.zip Release Notes →

Multi-Arch

Docker Hub Bot Container

Docker / Podman (AMD64 & ARM64)

All-in-one container including Python runtime, Slack Bolt with Socket Mode, WebSocket Hub server, arp-scan LAN tools, and Docker CLI.

Quick Installation Command:

# Pull image from Docker Hub:
docker pull lhotakj/cmdiqo-bot:latest

# Run container with your .env file:
docker run -d --name cmdiqo-bot \
  --restart unless-stopped \
  --net host \
  --env-file .env \
  -v /var/run/docker.sock:/var/run/docker.sock \
  lhotakj/cmdiqo-bot:latest

Download lhotakj/cmdiqo-bot:latest Release Notes →

Zero-Token Testing

Interactive Slack Simulator

Cross-Platform Python 3.12+

Built-in interactive Slack console emulator. Test commands, regex captures, and live remote agents without needing Slack credentials or Socket Mode.

Quick Installation Command:

# Clone repository and run interactive simulator:
git clone https://github.com/lhotakj/cmdiqo.git
cd cmdiqo
python run.py sim

Download slacksim Release Notes →

5-Minute Setup

From Zero to Full Network Control

Follow these four simple steps to provision your Slack App, run the bot container, and register your first remote agent.

Step 1

Create the Slack App

Go to api.slack.com/apps → Create New App → From scratch.

Socket Mode: Settings → Socket Mode → Enable. Create an App-level Token with scope connections:write (copy xapp-...).
Bot Scopes: OAuth & Permissions → Add commands, chat:write, channels:read, groups:read, channels:join, channels:history.
Slash Commands: Add /help, /lan, /host, and optional aliases /home, /wol.
Install: Click Install to Workspace and copy the Bot User OAuth Token (xoxb-...).

Step 2

Configure Environment

Create a .env file on your primary server alongside your docker-compose.yml:

SLACK_BOT_TOKEN=xoxb-your-bot-token
SLACK_APP_TOKEN=xapp-your-app-token

# Optional: Restrict to authorized user IDs
ALLOWED_USERS=U0123ABCDEF,U0456GHIJKL

# Optional: Shared secret for agents
AGENT_TOKEN=my-secret-token

Step 3

Start the Bot Container

Launch via Docker or run directly with Python. The bot opens a secure outbound TLS WebSocket to Slack:

# Run via Docker:
docker run -d --name cmdiqo-bot \
  --restart unless-stopped \
  --net host \
  --env-file .env \
  -v /var/run/docker.sock:/var/run/docker.sock \
  lhotakj/cmdiqo-bot:latest

# Or pure Python:
python run.py hub

Step 4

Connect Remote Agents

Run the lightweight standalone binary on any Windows or Linux host across your network:

# Windows:
.\cmdiqo-agent.exe --hub-url ws://192.168.1.10:8765 --token my-secret --name PC-01

# Linux:
./cmdiqo-agent --hub-url ws://192.168.1.10:8765 --token my-secret --name nas

💡 Run .\install-service.ps1 on Windows or sudo ./install-service.sh on Linux to automatically register as background system services that start on boot!

Configuration & Security

YAML Command Engine & Environment Variables

Customize commands, aliases, timeouts, and authorization allow-lists using declarative YAML configuration.

📄config/commands.yaml

# Define custom aliases
aliases:
  - name: home
    input: "/home"
    output: "/host home"
    description: "Shortcut alias targeting host 'home'"

# Define modular commands
commands:
  - name: host-docker-restart
    category: docker
    trigger: "/host {host} docker restart {service}"
    description: "Restart docker compose service"
    kind: shell
    target: "{host}"
    run: "docker compose -f /docker/{service}/docker-compose.yml restart"
    timeout: 60

  - name: lan-devices-list
    category: lan
    trigger: "/lan devices list"
    description: "List LAN devices via ARP sweep"
    kind: python
    handler: "commands.devices:list_devices"

Environment Variables Reference

Slack & Bot Credentials

Required tokens to connect the bot to Slack via Socket Mode.

SLACK_BOT_TOKENRequired

Bot User OAuth Token (starts with xoxb-). Generated in Slack App settings under OAuth & Permissions after installing to workspace.

SLACK_APP_TOKENRequired

App-Level Token (starts with xapp-) with connections:write scope. Generated in Slack App settings under Socket Mode.

Access Control & Security

Restrict bot commands to authorized users and specific channels.

ALLOWED_USERSOptional

Comma-separated list of authorized Slack User IDs (e.g. U0123ABCDEF,U0456GHIJKL). Anyone not listed will be rejected.

Default: (empty: anyone with channel access)

ALLOWED_CHANNELSOptional

Comma-separated list of allowed Slack Channel IDs (starts with C, e.g. C0123CHANNELID). Prevents bot execution in unauthorized channels.

Default: (empty: all invited channels)

AGENT_TOKENOptional

Shared secret token for HMAC-SHA256 handshake between Hub server and remote agents. Highly recommended for multi-node deployments.

Default: (empty: unauthenticated)

Agent Configuration

Settings applied to cmdiqo-agent daemon instances on remote machines.

HUB_URLRequired

WebSocket URL of the running cmdiqo-bot Hub server (e.g. ws://192.168.1.10:8765).

Default: ws://127.0.0.1:8765

AGENT_NAMEOptional

Unique name identifying this agent in Slack commands (e.g. /host [AGENT_NAME] uptime).

Default: (hostname)

COMMAND_TIMEOUTOptional

Maximum execution duration in seconds for commands before terminating subprocess.

Default: 180

SHELL_TIMEOUTOptional

Default fallback timeout in seconds for local shell commands executed inside bot container.

Default: 120

Control Your Home Network From Any Slack Channel.

Engineered for Complete Network Autonomy

Socket Mode & Zero Open Ports

Distributed Standalone Agents

YAML-Driven Extensibility

LAN Discovery & Wake-on-LAN

Docker & Container Ops

Remote Host Telemetry

System Services & Windows Updates

Parental & Distraction Guard

Experience Cmdiqo Right in Your Browser

Decoupled Three-Tier Topology

1. Slack Cloud Platform

2. cmdiqo-bot & WebSocket Hub

3. Distributed cmdiqo-agent Daemons

End-to-End Command Dispatch Lifecycle

Built-In Operations & Custom Extensions

Download Standalone Binaries & Containers

Windows x64 Standalone Agent

Linux x64 Standalone Agent

Docker Hub Bot Container

Interactive Slack Simulator

From Zero to Full Network Control

Create the Slack App

Configure Environment

Start the Bot Container

Connect Remote Agents

YAML Command Engine & Environment Variables

Environment Variables Reference

Slack & Bot Credentials

Access Control & Security

Agent Configuration

Control Your Home Network
From Any Slack Channel.