StacksAtlas

StacksAtlas is a local network monitoring appliance. It discovers devices on your LAN, grades security risks, tracks stability, and (with Business) runs always-on with alerts and fleet options. Everything runs on your hardware. No cloud account and no subscription.

Free portable is a session scanner with unlimited device discovery: run it, scan your whole network, review security grades and findings, export reports, then close and remove when done. No license key, no device cap, no greyed-out rows. Session data does not persist after exit.

Business ($40, one-time) is the full always-on appliance: Windows MSI service, macOS Install daemon, or Docker with a persistent database. Adds real-time alerts, webhooks, SSO, Hub mode, and Tailscale federation. One license per machine (Hub and each enrolled site). Discovery stays unlimited; you pay per appliance, not per device.

Compare tiers in the docs →

No. Unlimited device discovery on every tier, free portable included. We do not cap, mask, or grey out devices to upsell you. The free build is a session scanner: your inventory clears when you exit portable mode. Business adds a persistent database, always-on monitoring, alerts, and fleet features, not a higher discovery limit.

Portable vs Business in the docs →

No. Download portable for Windows, macOS, or Docker and start scanning. Optional free registration via Lemon Squeezy on the download section is only for release-update emails, not activation.

Yes. Use docker-compose.portable.yml from the repo for a free session scanner (no license key). Open http://127.0.0.1:5000 on the host (Linux/Docker). macOS portable uses http://127.0.0.1:5050. When finished, run docker compose -f docker-compose.portable.yml down -v to remove session data.

For an always-on NAS or Linux server with persistence, alerts, and federation, use the standard docker-compose.yml with a Business license. Docker setup guide →

Free (try a scan, then leave): Windows download, macOS download, or Docker/Linux for a session.

Business (leave it running): Windows service install, macOS always-on install, or Docker/NAS appliance.

See Where can I run it? under pricing, or the installation docs →.

After you start StacksAtlas, open a browser on the same computer:

• Windows & Docker: http://127.0.0.1:5000
• macOS: http://127.0.0.1:5050 (macOS reserves port 5000 for AirPlay)

Optional HTTPS on port 5001 is available after onboarding. The Windows installer can trust the local certificate automatically.

Never. Device lists, MAC addresses, scan results, and credentials stay on your appliance. Discovery does not phone home. Business licenses validate once with Lemon Squeezy at activation; after that the appliance can run offline within the license grace period. Data sovereignty overview →

Each device is labeled HEALTHY, WARN, or CRITICAL (green, yellow, or red) based on findings like open Telnet, weak defaults, or risky services. Grades are included in the free portable app so you can audit a network before buying always-on. Security documentation →

The topology map shows how devices connect: gateways, switches, Wi-Fi, and what hangs off each uplink. You can set parent devices and port labels, then export the map for documentation. Try the simplified sample under Preview the product UI, or read the Dashboard guide →.

Real-time device up/down alerts, new-device notifications, and outbound webhooks (Slack, Teams, Discord, or generic HTTPS) are Business only. The free portable app is a session scanner with no background monitoring. Integrations guide →

Ghost devices are hosts that disconnect, reconnect, or disappear intermittently. StacksAtlas tracks Last Seen and a Stability Score so you can catch flapping devices before they disrupt critical endpoints. Flap detection →

One $40 perpetual license per always-on appliance (Hub brain or standalone site). Each enrolled remote site also activates its own key on that machine. To move hardware, deactivate in the Lemon Squeezy customer portal from your purchase receipt, then activate the same key on the new machine.

Licensing & activation guide →

Yes, within the built-in license grace period. The appliance shows warnings before validation expires so air-gapped sites can plan a reconnect. Portable mode does not require activation at all.

License & privacy summary →

Yes, with Business. Enable Hub mode on a central appliance and enroll remote site Nodes (including over Tailscale when sites are not on the same LAN). Each Hub and each enrolled site activates its own Business license. Federation is orchestration, not a shared license pool. Hub & fleet guide →

On the Hub: enable Central Hub in Settings → Federation, activate Business, then generate a enrollment string (Direct Network for LAN, Tailscale for remote sites). On the edge appliance: paste the string under Sovereign mTLS enrollment, set a site name, and enroll. Strings expire in 15 minutes.

Step-by-step Hub & fleet guide →

Check for updates in the appliance under Settings (Windows can apply signed updates in-app; Mac and Docker are guided). Hub sites can also stage updates for enrolled Nodes. Product feature development is frozen as of July 13, 2026; security and critical fixes may still ship as patches. See the changelog → and installation / updates docs →.

Minimum: dual-core CPU, 2 GB RAM, 500 MB disk. Recommended: quad-core, 4 GB RAM, 10 GB disk for log retention. Supported OS: Windows 10/11/Server 2019+, macOS 12+, or Docker on Linux/NAS. A wired gigabit connection is recommended on busy subnets.

Full requirements table →

The appliance host needs outbound access to devices on subnets you scan (ICMP, ARP, mDNS, and common service ports). The MSI installer opens Windows Defender rules for ports 5000 (HTTP) and 5001 (HTTPS). If discovery finds few devices, check VLAN routing, host firewalls, and that the correct network adapter is selected in the UI.

Troubleshooting guide →

For reliable ARP and mDNS discovery, the Docker appliance should run with host network mode (or equivalent on your platform) so the container shares the host NIC. NAT-only bridge mode often hides devices on the LAN. See the installation guide → for compose examples.

Yes. Official DMG builds are Developer ID signed and notarized (v1.7.6+). Mount the image and open StacksAtlas.appnormally. You should not see “unidentified developer” on current releases from stacksatlas.com →.

If macOS still blocks launch (rare browser quarantine), right-click StacksAtlas.app → Open once. For free portable, run StacksAtlas.app only, not Install StacksAtlas.app (Business always-on). Session data lives in ~/StacksAtlas-Trial until you choose Close & remove portable data.

New and frequently updated installers can trigger browser or SmartScreen warnings before reputation builds up. Use Keep in the browser download bar, then on SmartScreen choose More info → Run anyway. Windows MSI builds are Authenticode-signed. Portable and Mac builds are distributed via releases.stacksatlas.com. Step-by-step install help →

Basic discovery works without them on every platform. For richer MAC/vendor data on Windows, install Npcap (not bundled). Deep Scan uses Nmap when installed for per-device port and OS detail, including on Docker, where the official image does not ship Nmap. Both are optional third-party tools with their own licenses. Install Deep Scan (all platforms) →

Yes. A JWT-authenticated REST API runs locally on your appliance. Interactive documentation is at /api-docs (Swagger UI) after install. Use it for custom scripts, the OpenAVC Control Bridge, and automation. Integration recipes →

Feature and site development is frozen as of July 13, 2026. The changelog → is the public record of what shipped, including homelab and preview trains. Security and critical fixes may still ship as patch releases. Use the docs and troubleshooting guide for day-to-day help.

Start with the documentation →, troubleshooting guide →, and UI preview on this site. Business license activation and billing: use the Lemon Squeezy customer portal from your purchase receipt.