The agent

The agent is the only thing MZPanel installs on your VPS. It’s a single static Go binary that holds one outbound WebSocket to the control plane and runs work locally.

What it is

• One process, mzagent, managed by systemd (mzagent.service).
• No runtime dependencies — it cross-compiles for amd64 and arm64.
• It carries a native engine: site, backup, database, Docker and every other operation runs inside the agent itself. There is no separate implementation and no Bash mz script — the panel and the command line share this one engine.

Two front-ends, one engine

Every command you run from the dashboard travels down the WebSocket, into the agent’s native engine, and streams back. That exact engine also has a command-line front-end: the same binary, symlinked as mz, runs your arguments locally.

• Web — click in the panel; the API dispatches a job to the agent.
• CLI — SSH into the box and type mz site list, mz php list, mz cron add ….

Because both paths reuse the same dispatch, the CLI reaches everything the panel can do — new features appear in mz the moment they ship. See The mz CLI.

Earlier versions shelled out to Bash

Older builds ran a separate Bash mz CLI. That has been retired: the engine is now native Go inside the agent, and mz is simply that binary invoked under a different name — not a second implementation.

Footprint & requirements

• Ubuntu 24.04 LTS
• 1 CPU / 1 GB RAM minimum
• Idles around ~15 MB RAM
• Only outbound HTTPS:443 required — no inbound ports, no domain on the VPS

How it connects

The agent dials outbound to wss://ws.mzpanel.com:443 and keeps one persistent connection that carries a heartbeat, metrics, commands, and pushed events. NAT and firewalls don’t matter because nothing connects to your VPS. See Architecture.

Auto-updates

The agent can update itself safely: it downloads the new binary, verifies an Ed25519 signature and SHA-256, sanity-runs it, then does an atomic swap and restart. Rollouts are staged (canary → wider percentages) so a bad build never hits everyone at once. You can set the update policy (pinned / manual / security / auto) per server or per workspace.

Uninstall

Deleting a server in the dashboard soft-deletes it and disconnects the agent; the sites and data on the VPS are left untouched. See Install the agent for the install/uninstall commands.

Related

• Architecture — the two operating modes and data flow.
• The mz CLI — driving the same engine from the command line.
• Install the agent — the one-line install and uninstall.
• Security model — tokens, trust and isolation.