Michael J. DuffPort Charlotte, Florida · November 2026
Whit, John,
I put this together for the two of you. It walks through what I've built this year: an MSP operations platform, endpoint automation, a documentation system, a project management SaaS, a lead-generation directory for MSPs, and the shared AI memory system that all of it grew out of.
It takes a few minutes. Press play and sit back, or scroll at your own pace.
Once you've had a look, I'd like to open a discussion about where this could fit at HCTG.
For Whit & John · Hill Country Tech GuysBuilt to run / 2026
Built for desktop. This presentation isn't optimized for mobile. Open it on a computer screen for the intended experience.
BUILTTORUN.
2026 has been a busy year for HCTG and for me. I've built eight products and platforms with AI at the helm, and with four years at HCTG and 20 in the MSP field behind me, I'm ready to put that to work for us. Take a look for yourself, and let me know if we can take this further.
08 projects / 20 yrs MSP / 01 builderBuilt for desktop · not optimized for mobileScroll to feel it ↓
To Whit & John · Hill Country Tech GuysFrom Michael DuffNovember 2026
Whit & John: For most of 2026, on my own time and my own subscriptions, I've been working hands-on with AI and building custom software, most of it aimed at MSP operations and AI integrations. After more than four years with HCTG, I'd like you to see some of what I can do. I believe it could be a real asset to HCTG's AI work and to building custom tools for our clients and our own team. Take your time with it, and if it's useful, I'd welcome a conversation.
Not public yet
Three platforms built and running in private ahead of launch. These are live screens from my test clients.
IT automation & device deployment
Automated IT documentation
AI-driven autonomous RMM platform
The work
01 — 08 · scroll sideways
Live capture
01 · Running
AI-native MSP operations: remote access, docs, software, monitoring and alerts in one place.
Live capture
02 · In development
Desired-state endpoint management that fixes drift and verifies the result.
Live capture
03 · In development
IT documentation for MSPs, self-hosted, sold once.
Public demo
05 · Launching in 1–2 wks
Every project on one board, built for agencies and client work.
Design mockup
06 · Waitlist
Branded client portal with a built-in CRM and AI.
Live site
07 · Live · 4,900+
US directory matching businesses with managed IT providers.
Live site
08 · Live
Cinematic 3D scroll websites. This page is built the same way.
Keep scrollingThe detail ↓
Overmind · Overseer · IT Documented · live captures
One screen. Every client.
The platform as it runs today, with test clients. Scroll to walk each screen top to bottom; switch screens above it.
Fleet at a glanceClients, endpoints, alerts, backups, patches and tickets in one row.
Backup & recoveryProof the backups ran, not just a green check.
Alerts and one-click actionsPriority wave, remote control, scripts and patching from the same screen.
Fleet gaugesLive CPU, RAM and disk for every machine.
Provider statusCloudflare, GitHub, OpenAI, AWS and Azure watched for outages.
Command dashboard. Every client's devices, alerts, backups, patches and certificates on one screen, worst first.Custom widgets. Drag, resize, add or remove panels: gauges, health trends, exploited-CVE feed, site latency, AI budget and more.Launchpad. 92 tools and portals in one index, pinned, filed and opened from one place.Endpoints. Live CPU, RAM and disk for the whole fleet, plus security posture and patch compliance.One machine. Scored and explained: what's failing, why, and the one-click fix.Remote access. Unattended access through the Overmind agent, with a live screen thumbnail before you connect.Network discovery. An hourly sweep finds every device on the wire: vendor, services, managed or not.Topology map. The network drawn from the scan: internet, gateway, then every device grouped by kind.Radar view. The same network as a live radar, down to which switch port each device is on.Alerts. Grouped by age across every client, with acknowledge, resolve and mute on the row.Governed AI. AI triages alerts through a pipeline with human approval, a daily spend cap and a full run log.Duffman AI core. The platform's own AI, with live vitals for every service in the stack.Script library. Tested PowerShell checks and fixes, run against any machine from the browser.
An AI-native MSP operations platform: remote access, documentation, software management, monitoring and alerts in one place.
MeshCentral remote access and a live HUD dashboard
Fleet Command. What every computer should have, flowing out to each one, with drift and coverage at a glance.Declared, then enforced. 53 deployments across four clients, each with its desired state and enforcement level.1,447 maintenance sessions completed: detect, install or update, verify, on a schedule or on demand.
Desired-state endpoint management. Describe what every computer should look like; Overseer fixes what drifted and verifies the result.
Maintenance sessions in set windows or on demand
One-run onboarding for new machines
WinGet catalog, PowerShell script library
Roles, per-client separation, full audit trail
Windows · WinGet · PowerShell · own Windows agent · Python · FastAPI · Next.js
29capabilities
WinGet+ MSI, EXE, ZIP, ISO
1agent for both products
Why it matters to HCTGThe deployment and patching layer techs live in, rebuilt as a working engine.
Every client's documents. Folders, auto-filed configurations, and who changed what, people and AI alike.Domains that update themselves. Registrar, renewal, DNS records and a certificate countdown, pulled automatically.Locations on the map. Type the address; it's geocoded and pinned automatically.
IT documentation for MSPs, in the spirit of IT Glue, sold as a one-time purchase and self-hosted.
One search across docs, passwords, configs and assets
Encrypted passwords with a log of every reveal
Version history, expiry tracking, health score per client
Overmind module → standalone · self-hosted · same stack as Overmind
1codebase with Overmind
Autodomain, SSL and map checks
Why it matters to HCTGDocumentation is every MSP's backbone; this shows I can design it, not just use it.
Every project. Every client. Every agent. One board. The Taskift site, with Claude, ChatGPT and Gemini connected to the board.A photo and film studio. Weddings, brand shoots, headshots and events side by side, with dates, fees and hours on every card.A marketing agency. Six retainer clients on one board, with client requests and approvals flagged on the card.A web studio. Six client sites in flight at once, each page moving through client review before it ships.A solo designer. Six clients and no team, with an AI agent handling first drafts.Gantt with dependencies. The same tasks on a timeline, linked so a slipped task shows what it holds up.AI agents on the team. Atlas, an AI agent, is assigned the task, builds it and reports back in the comments. Every agent action is logged.Clients approve in writing. A homeowner change order with its price, flagged for the client, and the work it's blocking.Reports built in. Burndown, status mix, lead and cycle time, and each person's workload, for the month or any range.
A project board that shows every project on one screen, built for agencies and teams doing client work.
Gantt with dependencies, automations, client guest views
AI agents through Claude, ChatGPT, Gemini and Codex
Google Calendar and GitHub integrations, Stripe billing
The client portal. What a client sees: waiting-on-you items, invoices, the next meeting and every project with its progress.The agency side. Pipeline, unpaid invoices and an AI briefing that flags who has gone quiet, who is reading a proposal and who is late.
A branded client portal with a built-in CRM, proposals, e-signatures, invoices and AI.
CRM pipeline that logs portal activity
AI briefings, drafted replies and weekly recaps
Name, brand and site up within a week
Sign in with Taskift · built on Taskift’s stack
2screens designed
Daysfrom gap to live site
Why it matters to HCTGSpotting a market gap and moving on it in days.
Live today. Businesses search managed IT providers near them and send one request to the ones that fit.Browse by state. 257 Florida providers, filtered by service, with featured listings on top.Provider profiles. Services, company details, reviews and a direct message form on every listing.Get matched. One request, routed to the listed providers that cover that area and service.Listing plans. Free, Standard and Featured tiers, billed through Stripe and PayPal.Consumer tips. Plain-English guides for business owners hiring an MSP.Guides that rank. Each article targets a buyer question and links straight into quotes.
A US directory where businesses find managed IT providers and send one quote request to matching MSPs.
Live today. Scrolling plays a brand’s story like a film; the flight at the top of this page is built the same way.
Cinematic 3D scroll websites, where scrolling plays a brand's story like a film. This showcase is built with the same craft.
Higgsfield · Codex · canvas scroll playback · Amazon SES
2live builds
1this page
Why it matters to HCTGHigh-end web work with AI generation, the kind that could sell HCTG's own brand.
The effort behind it
Overmind · 109 of 120 days worked
Commits per week · Jul 11 → Nov 8, 2026
HealthyWarningDownIdle
Its own Windows agent
Every managed PC runs my agent as a service, with its own system tray icon that shows its state at a glance. It checks in every 60 seconds, looks for work every 5, restarts itself if it ever hangs, and updates itself.
01 · Under the hood
Overmind, in full
Everything the platform does, grouped by job. Overmind runs today as my internal platform; Overseer and IT Documented are in development as products of their own.
The stack.
01 / 09
What it runs on.
Docker containers on Ubuntu 24.04, on a dedicated VPSOvermind
PostgreSQL underneath every recordOvermind
A Python API that every screen and agent goes throughOvermind
Cloudflare in front of all of itOvermind
MeshCentral for remote accessOvermind
Amazon SES for email, ntfy for push alertsOvermind
Moved off a Synology NAS onto the VPS in SeptemberOvermind
Integrations.
02 / 09
What it talks to.
Connectors for RMM, PSA, identity provider, security software and Active DirectoryOverseer
Build-your-own integrations with six capability typesOverseer
JSON HTTP API with tokens scoped by role and tenantOverseer
Software from WinGet, MSI, EXE, ZIP and ISOOverseer
MeshCentral sessions opened straight from an alertOvermind
AI agents write through the same API as people, with revisions and auditOvermind
Automation.
03 / 09
What it does without being asked.
Maintenance sessions on a schedule, with catch-up when a machine was offlineOverseer
Allow and exclude windows at four levelsOverseer
Tasks that check, correct, then check againOverseer
Script editor with test runs, PowerShell in four contextsOverseer
End-user emails that let people postponeOverseer
Domain registrar and expiry filled in automaticallyIT Doc
An overnight build loop with results waiting in the morningOvermind
Self-healing.
04 / 09
How it fixes what drifted.
Detect, add context, remediate, verify, on a loopOvermind
Each app declared: installed, updated if found, uninstalled or ignoredOverseer
Required, onboarding and ad hoc enforcementOverseer
A failed test script triggers a clean reinstallOverseer
Never grades a machine from stale data; preflight checks hold firstOverseer
Restarts only when needed, ignoring ones the machine already owedOverseer
Verified fixes feed back into playbooksOvermind
Security.
05 / 09
How it stays safe while doing it.
Cloudflare Zero Trust sign-in in front of the HUDOvermind
Unattended work needs a live authorization, and never covers uninstallsOverseer
Previews are true dry runs; revoking access is instantOverseer
Roles, per-client scoping and lockout guardsOverseer
Every password reveal is logged before it is shownIT Doc
Integration secrets in private stores; tampered installers refusedOverseer
Authenticated SMTP only, full audit logOverseer
Documentation.
06 / 09
What it remembers about every client.
Docs with full version historyIT Doc
Configurations kept current straight from the machinesIT Doc
Flexible assets with ten field types, plus checklistsIT Doc
Domains and certificates tracked, with a 45-day expiry listIT Doc
A health score per clientIT Doc
Press / for one search across everythingIT Doc
Computer records with twelve tabs, terminal includedOverseer
Visibility.
07 / 09
How you see all of it.
A live HUD dashboard for the whole estateOvermind
Network scanner with a topology radarOvermind
Two visual languages: the HUD and calm, flat work screensOvermind
Five reports, dashboard counters and a system status pageOverseer
WordPress sites and their health in one viewOvermind
The AI.
08 / 09
Where the AI comes in.
Duffman AI coordinates specialist AI across several platforms and local toolsOvermind
Claude works inside Overmind under its own operator accountOvermind
Every AI write is revisioned and audited like a person'sOvermind
Claude, ChatGPT and Gemini share one memory in ObsidianAI brain
Nested tenants, each with its own branding and emailOverseer
Standouts.
09 / 09
The parts I'm proudest of.
One installer or USB stick onboards any client's machineOverseer
The user's Windows profile is ready before their first sign-inOverseer
Agent installs through a provisioning package or Windows SandboxOverseer
Machine identity tied to hardware, so it survives a rebuildOverseer
WordPress fleet management built inOvermind
Next on the roadmap: certificate automation, a browser extension, a mobile appOvermind
Under the surface
0 of 4 files opened
The screens are the tip. Open each file for the numbers behind it: commits, tests, endpoints and every capability, grouped by job.
71 capabilities, grouped by job. This is the part the screens don't show.2,603commits7,602automated tests794API endpointsOpen the file↓
The hard numbers
0commits
0automated tests
0API endpoints
0database tables
0capabilities
What it does, grouped by job
Command center
NOC dashboard, worst client first
Drag-and-drop custom widgets
Launchpad for every tool and portal
Command bar and global search
Client scope switcher
Notifications, push alerts and email
System status and self-checks
Clock and weather chips for the desk
Windows agent
Own agent, runs as a Windows service
System tray icon with four live states
Heartbeat every 60 seconds
Polls for work every 5 seconds
Self-watchdog restarts a hung agent
One-click installer and auto-update
Rollback to the last good version
Support bundle for troubleshooting
Endpoint insight
Hardware, disk and registry inventory
Disk health and crash tracking
Service watchdog
BitLocker key escrow
Encryption and certificate reports
Security score per machine
Install-date and software history
Identity matching for new machines
Remote & response
Unattended remote access
Live screen thumbnails
Browser terminal
Quick support sessions
Scan, update and reboot in one click
Auto-remediation with a kill switch
Backup re-trigger
Endpoint trace and run output
Network
Hourly discovery sweep
Topology map and radar view
Layer-2 switch-port mapping
IPAM
Config backups for network gear
Outside exposure check
Risky-service flags
Vendor tracking
Prospect scanner for new clients
Patching & software
Patch policy by update category
Patch remediation
Maintenance windows
Desired-state deployments (Overseer)
Software library and licenses
Onboarding runs for new machines
Script host and script library
Rollouts, preflight and reboots
Monitoring & alerts
Alert rules and thresholds
Alert correlation, less noise
Uptime monitoring
Backup monitoring
Certificate expiry tracking
Exploited-CVE feed (CISA KEV)
SLA tracking
AI
AI triage pipeline with approval
Skills armed per alert type
Daily and per-client spend caps
Run log and decision ledger
MCP access for AI agents
Duffman AI core
Every AI action audited
Business & docs
Service desk tickets
Reports
Licensing and billing
Client branding and branded email
Multi-tenant, per-client separation
WordPress and website management
App control
IT Documented built in
The IT Glue-style documentation an MSP lives in, built into Overmind. The feature I use most.88commits429automated tests57API endpointsOpen the file↓
The hard numbers
0commits since Jul 18
0automated tests
0API endpoints
0record types
0lines in its API
What it does, grouped by job
Documents
Rich-text editor built for runbooks and procedures
HTML and Markdown documents
Folders, with Configurations filed automatically
Full version history on every document
Expiry dates so stale docs surface
AI drafts a document from a one-line description
Passwords
Encrypted password vault, per client
Every reveal logged before it is shown
Reveal is a permission, not a default
Stored per client, beside the rest of its documentation
AI agents can file credentials through the API, audited
Domains & certificates
Domain & SSL tracker for every client
Registrar and expiry filled in automatically
Live SSL certificate countdowns
A 45-day expiring list on the home screen
Certificate sweep across the whole fleet
Locations & maps
Type the address; it is geocoded automatically
Pinned on a live map inside the record
One click to Google Maps directions
Site layouts and site summaries per location
Structured records
33 record types: SITREP, configurations, contacts, Office 365 licenses, mapped drives, LAN, WAN, printers, UPS and more
Flexible assets with ten field types
Checklists
A health score per client
AI documentation
AI documents machines automatically, configurations written straight from the endpoint
AI-created runbooks
Runbooks that drive auto-remediation
Every AI write revisioned and audited like a person's
Who changed what, and when, on every record
Find anything
Press / to search every client at once
Filter by documents, passwords, configurations, assets or checklists
Favorites, popular this week and recently viewed
Activity feed across every client
29 capabilities across 50+ backend modules, the longest-running build of the lot.29capabilities50+backend modules5package typesOpen the file↓
The hard numbers
0capabilities
0+backend modules
0package types: WinGet, MSI, EXE, ZIP, ISO
0agent shared with Overmind
What it does, grouped by job
Desired state
Declare what every PC should have
Drift detection and auto-fix
Enforcement levels per deployment
Cross-client and per-client targets
Standing authorization for unattended work
Change requests and deferrals
Maintenance sessions
Detect, install or update, verify
Scheduled or on-demand sessions
Maintenance windows per client
Preflight checks before changes
Reboot handling and user notices
Re-run and full session logs
Software library
Software library with icons
Dynamic versions and dependencies
Package repair
Exclusions and ordering
Media and installer storage
OS end-of-life tracking
Integrations & licensing
Integration adapters and cadence
People and device sync
License files and license runs
Credentials vault for installs
Compliance reporting
Pending-updates reports
Onboarding
One-run onboarding for new machines
Identity matching for new computers
User affinity
Agent download and installer wizard
Email routing for notices
29 capabilities that turn "another kanban board" into a product.469commits since Oct 19614automated tests385API endpointsOpen the file↓
The hard numbers
0commits since Oct 19
0automated tests
0API endpoints
0capabilities
What it does, grouped by job
Boards & work
Every project on one board
Kanban board and Gantt timeline
Dependencies and milestones
Subtasks, custom properties and tags
Time logging per task
Templates and starter boards
Clients & outsiders
Client portal and guest access
Public boards and shareable task links
Suggestions from outsiders, reviewed first
Forms that create tasks
Email-to-board inbox
White-label branding
Automation
Board automations
GitHub integration
Google Calendar feed
Zapier
Push and email notifications
Follow tasks and mentions
AI agents
MCP server so Claude, ChatGPT, Gemini and Codex can work the board
Read-only and full-access agent tokens
Standup, workload and blocked-task reports
Every agent action logged on the task
Board AI assistant
SaaS business
Stripe billing and plans
Workspaces and roles
Affiliate program
Admin console and view-as
Audit trail
Automated backups
All four open. That's everything under the hood.
A shared brain
04 / Where it all started · May 8, 2026
This came first. Before Overmind had a single commit, I built one memory that every AI on the team reads and writes, so no session ever starts from zero. Every product on this page was built on top of it.
How every session runs
A loop, not a restart.
Load contextReads the session card and the work queue before saying a word.
Work in its laneBuilds, tests and deploys inside its own rules and permissions.
Brief out, sanitizedOutside lanes get scrubbed briefs; results come back for review.
Write backUpdates the project file and hands off the next item in the queue.
Nightly digestAt 9 PM the day is filed into the vault for the next session.
Delegation · since Jul 23, 2026
The right model for every job.
Frontier-model time is the scarce resource, so every task is routed to the cheapest lane that can do it well. Specs go out, work comes back, and the lead model reviews all of it.
Tier 0 · lead
Frontier session model
Architecture, specs and design calls. Reviews everything that comes back from the other lanes.
plans · reviews · decides
Tier 1 · same pool, lower burn
Claude subagents
Bulk code once a pattern is settled, ops and debug loops, and mechanical transforms, fanned out in parallel.
Sonnet · Haiku
Tier 2 · zero Claude cost
Outside agents, overnight
Standalone modules from tight specs, test suites, whole-repo analysis and research sweeps, run headless while I sleep.
Codex · Gemini (Antigravity)
Second opinions · since Jul 24
Big calls get two outside reviews.
The same sanitized brief goes to ChatGPT and Gemini on high-effort models
One round only, no review-of-review loops
Disagreement between model families is treated as signal, and outside claims of fact are verified first
Every opinion is logged with whether it changed the decision
Budget, measured honestly. Each lane is judged on first-pass acceptance, pullbacks and review time, not "tokens saved". A lane that saves tokens but doubles review loses the route.
It came first
The brain, then everything else.
May 8Brain architecture designed
May 14Gemini joins the brain; auto-ingest live
May 20Daily digests run on their own
Jul 23–24Delegation tiers, second opinions and a dispatch ledger
Sanitized before it goes out, not after. Example data, not a real client.
Data stays home
Client data never leaves
Names, IPs, users and credentials are stripped from every outside brief
Screenshots are masked before they're shared
Outside agents work in one scoped folder, never the whole vault
Anything I tag <private> stays out of the vault and every digest
Least privilege
The AI has its own key, not mine
A dedicated automation account, not admin: admin routes answer 403
Every write is scoped to one tenant
Its token rotates every 14 days and is never printed
Secrets
No AI ever types a password
Secrets live in the environment and password store, not in notes or chat
Sign-ins stay with me
Credentials never go to an outside lane
Provable
Every change leaves a trail
Writes go through the API, with a revision and an audit entry
Every dispatch is logged: lane, task, accepted or rejected
AI actions wait in an approval queue under a daily spend cap
Perimeter
Zero Trust in front of everything
Cloudflare Access gates every app before it loads
Agents use their own service tokens
DNS changes are cleared with me before they're applied
Recovery
Backed up three ways, from day one
Every project starts in a private repo with an off-machine copy
Nightly database dumps, offsite in Wasabi S3 buckets
Plus a local copy and Google sync
A restore test every month, before the first real user
Found an exposure? It's reported to me immediately. If I don't answer, the agent fixes it rather than leave the door open.
Every agent reads and writes the same vault, so work carries across sessions and tools without me relaying it. GitHub holds the rules for how they collaborate, every outside dispatch is logged, and a short list of decisions always comes back to me.
0AI platforms
1,500+notes in the vault
0agent handoffs
What this means for HCTG
Let's put this to work.
Over four years with HCTG, 20 years in the MSP field, and a year of shipping AI-built software. If any of this is useful to where HCTG is heading, I'd welcome a conversation.
