What is Kerberos Agent?

Kerberos Agent is an open-source video surveillance agent that runs alongside IP cameras to process RTSP streams. It provides motion detection, continuous recording, and conditional recording with pre/post buffering. Recordings are stored locally or uploaded to cloud storage (S3, Kerberos Vault, Dropbox) and can be encrypted at rest with AES-256-CBC. The agent exposes a web UI for configuration and playback, a REST API documented via Swagger, and integrates with MQTT, WebRTC, and ONVIF for PTZ and stream discovery. It runs on ARMv6 through AMD64 hardware including Raspberry Pi, NVIDIA Jetson, and Intel NUC, and can be deployed via Docker, Docker Compose, Kubernetes, static binary, Snap, or Balena. Each agent instance handles a single camera feed.

Should you self-host Kerberos Agent?

Kerberos Agent scores 56/100 on selfhost.directory (how scoring works) and ranks #11 of 24 in Video Surveillance. It has 1 129 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v3.13.2, came out on 21 October 2026. New versions land roughly every 2 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is Frigate (84/100, 37 023 stars). It scores higher overall, so compare the two before you pick. See Kerberos Agent vs Frigate side by side.

Features

Cloud Storage Integration
Continuous recording
Encryption at Rest
End-to-end encryption
Health check endpoint
HLS fragmented recordings
Motion Detection
MQTT messaging
Multi-stream Support
ONVIF Support
Pre- and post-recording
REST API with Swagger
Webhook Integrations
WebRTC live streaming

How to configure Kerberos Agent

AGENT_AUTO_CLEANtrueCleans up the recordings directory.
Cleans up the recordings directory.
values: true, false
AGENT_AUTO_CLEAN_MAX_SIZE100If AUTO_CLEAN enabled, cap the recordings directory at this size (in MB). When unset/0, recordings may use the whole disk instead.
If AUTO_CLEAN enabled, cap the recordings directory at this size (in MB). When unset/0, recordings may use the whole disk instead.
AGENT_AUTO_CLEAN_MIN_FREE_SPACEWhen AUTO_CLEAN is enabled and no MAX_SIZE is set, keep at least this much free space (in MB) on the recordings disk before deleting the oldest recordings. Defaults to 5% of the disk.
When AUTO_CLEAN is enabled and no MAX_SIZE is set, keep at least this much free space (in MB) on the recordings disk before deleting the oldest recordings. Defaults to 5% of the disk.
AGENT_CAPTURE_CONTINUOUSfalseToggle for enabling continuous 'true' or motion 'false'.
Toggle for enabling continuous 'true' or motion 'false'.
values: true, false
AGENT_CAPTURE_FRAGMENTEDfalseSet the format of the recorded MP4 to fragmented (suitable for HLS).
Set the format of the recorded MP4 to fragmented (suitable for HLS).
values: true, false
AGENT_CAPTURE_FRAGMENTED_DURATION8If AGENT_CAPTURE_FRAGMENTED set to true, define the duration (seconds) of a fragment.
If AGENT_CAPTURE_FRAGMENTED set to true, define the duration (seconds) of a fragment.
AGENT_CAPTURE_IPCAMERA_ONVIFMark as a compliant ONVIF device.
Mark as a compliant ONVIF device.
AGENT_CAPTURE_IPCAMERA_ONVIF_PASSWORDONVIF password to authenticate against.
ONVIF password to authenticate against.
AGENT_CAPTURE_IPCAMERA_ONVIF_USERNAMEONVIF username to authenticate against.
ONVIF username to authenticate against.
AGENT_CAPTURE_IPCAMERA_ONVIF_XADDRONVIF endpoint/address running on the camera.
ONVIF endpoint/address running on the camera.
AGENT_CAPTURE_IPCAMERA_RTSPFull-HD RTSP or RTSPS endpoint for the target camera.
Full-HD RTSP or RTSPS endpoint for the target camera.
AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILEPEM CA bundle appended to the system roots for RTSPS camera certificate verification.
PEM CA bundle appended to the system roots for RTSPS camera certificate verification.
AGENT_CAPTURE_IPCAMERA_RTSPS_INSECUREfalseDisable RTSPS camera certificate verification; use only when a trusted CA cannot be installed.
Disable RTSPS camera certificate verification; use only when a trusted CA cannot be installed.
values: true, false
AGENT_CAPTURE_IPCAMERA_SUB_RTSPRTSP or RTSPS sub-stream endpoint used for livestreaming (WebRTC).
RTSP or RTSPS sub-stream endpoint used for livestreaming (WebRTC).
AGENT_CAPTURE_LIVEVIEWtrueToggle for enabling or disabling liveview.
Toggle for enabling or disabling liveview.
values: true, false
AGENT_CAPTURE_MAXLENGTH30The maximum length of a single recording (seconds).
The maximum length of a single recording (seconds).
AGENT_CAPTURE_MOTIONtrueToggle for enabling or disabling motion.
Toggle for enabling or disabling motion.
values: true, false
AGENT_CAPTURE_PIXEL_CHANGE150If CONTINUOUS set to false, the number of pixel require to change before motion triggers.
If CONTINUOUS set to false, the number of pixel require to change before motion triggers.
AGENT_CAPTURE_POSTRECORDING20If CONTINUOUS set to false, specify the recording time (seconds) after motion event.
If CONTINUOUS set to false, specify the recording time (seconds) after motion event.
AGENT_CAPTURE_PRERECORDING10If CONTINUOUS set to false, specify the recording time (seconds) before/after motion event.
If CONTINUOUS set to false, specify the recording time (seconds) before/after motion event.
AGENT_CAPTURE_RECORDINGtrueToggle for enabling making recordings.
Toggle for enabling making recordings.
values: true, false
AGENT_CAPTURE_SNAPSHOTStrueToggle for enabling or disabling snapshot generation.
Toggle for enabling or disabling snapshot generation.
values: true, false
AGENT_CLOUDs3Store recordings in Kerberos Hub (s3), Kerberos Vault (kstorage), or Dropbox (dropbox).
Store recordings in Kerberos Hub (s3), Kerberos Vault (kstorage), or Dropbox (dropbox).
values: s3, kstorage, dropbox
AGENT_DROPBOX_ACCESS_TOKENThe Access Token from your Dropbox app, that is used to leverage the Dropbox SDK.
The Access Token from your Dropbox app, that is used to leverage the Dropbox SDK.
AGENT_DROPBOX_DIRECTORYThe directory, in Dropbox, where the recordings will be stored.
The directory, in Dropbox, where the recordings will be stored.
AGENT_ENCRYPTIONfalseEnable 'true' or disable 'false' end-to-end encryption for MQTT messages.
Enable 'true' or disable 'false' end-to-end encryption for MQTT messages.
values: true, false
AGENT_ENCRYPTION_FINGERPRINTThe fingerprint of the keypair (public/private keys), so you know which one to use.
The fingerprint of the keypair (public/private keys), so you know which one to use.
AGENT_ENCRYPTION_PRIVATE_KEYThe private key (assymetric/RSA) to decrypt and sign requests send over MQTT.
The private key (assymetric/RSA) to decrypt and sign requests send over MQTT.
AGENT_ENCRYPTION_RECORDINGSfalseEnable 'true' or disable 'false' end-to-end encryption for recordings.
Enable 'true' or disable 'false' end-to-end encryption for recordings.
values: true, false
AGENT_ENCRYPTION_SYMMETRIC_KEYThe symmetric key (AES) to encrypt and decrypt requests sent over MQTT.
The symmetric key (AES) to encrypt and decrypt requests sent over MQTT.
AGENT_FORCE_TURNfalseForce using a TURN server, by generating relay candidates only.
Force using a TURN server, by generating relay candidates only.
values: true, false
AGENT_HUB_ENCRYPTIONtrueTurning on/off encryption of traffic from your Kerberos Agent to Kerberos Hub.
Turning on/off encryption of traffic from your Kerberos Agent to Kerberos Hub.
values: true, false
AGENT_HUB_KEYThe access key linked to your account in Kerberos Hub.
The access key linked to your account in Kerberos Hub.
AGENT_HUB_PRIVATE_KEYThe secret access key linked to your account in Kerberos Hub.
The secret access key linked to your account in Kerberos Hub.
AGENT_HUB_REGIONThe Kerberos Hub region, to which you want to upload.
The Kerberos Hub region, to which you want to upload.
AGENT_HUB_SITEThe site ID of a site you've created in your Kerberos Hub account.
The site ID of a site you've created in your Kerberos Hub account.
AGENT_HUB_URIhttps://api.hub.domain.comThe Kerberos Hub API, defaults to our Kerberos Hub SAAS.
The Kerberos Hub API, defaults to our Kerberos Hub SAAS.
AGENT_KERBEROSVAULT_ACCESS_KEYThe access key of a Kerberos Vault account.
The access key of a Kerberos Vault account.
AGENT_KERBEROSVAULT_DIRECTORYThe directory, in the Kerberos vault, where the recordings will be stored.
The directory, in the Kerberos vault, where the recordings will be stored.
AGENT_KERBEROSVAULT_PROVIDERA Kerberos Vault provider you have created (optional).
A Kerberos Vault provider you have created (optional).
AGENT_KERBEROSVAULT_SECRET_KEYThe secret key of a Kerberos Vault account.
The secret key of a Kerberos Vault account.
AGENT_KERBEROSVAULT_URIhttps://vault.domain.com/apiThe Kerberos Vault API url.
The Kerberos Vault API url.
AGENT_KEYA unique identifier for your Kerberos Agent, this is auto-generated but can be overridden.
A unique identifier for your Kerberos Agent, this is auto-generated but can be overridden.
AGENT_MODEreleaseYou can choose to run this in 'release' for production, and or 'demo' for showcasing.
You can choose to run this in 'release' for production, and or 'demo' for showcasing.
values: release, demo
AGENT_MQTT_PASSWORDPassword of the MQTT broker.
Password of the MQTT broker.
AGENT_MQTT_URItcp://mqtt.kerberos.io:1883MQTT broker endpoint for bi-directional communication. Accepts ActiveMQ mqtt+ssl:// URLs.
MQTT broker endpoint for bi-directional communication. Accepts ActiveMQ mqtt+ssl:// URLs.
AGENT_MQTT_USERNAMEUsername of the MQTT broker.
Username of the MQTT broker.
AGENT_NAMEagentThe agent friendly-name.
The agent friendly-name.
AGENT_OFFLINEfalseMakes sure no external connection is made.
Makes sure no external connection is made.
values: true, false
AGENT_PASSWORDrootThe password used to authenticate against the Kerberos Agent login page.
The password used to authenticate against the Kerberos Agent login page.
AGENT_PORT80HTTP web server port. Overrides the -port command-line value and must be between 1 and 65535.
HTTP web server port. Overrides the -port command-line value and must be between 1 and 65535.
values: 1-65535
AGENT_REGION_POLYGONA single polygon set for motion detection.
A single polygon set for motion detection.
AGENT_REMOTE_ACCESS_ENABLEDfalseAllow encrypted Hub MQTT sessions to stream Agent logs and open an interactive shell. Enable only for trusted deployments.
Allow encrypted Hub MQTT sessions to stream Agent logs and open an interactive shell. Enable only for trusted deployments.
values: true, false
AGENT_REMOVE_AFTER_UPLOADtrueWhen enabled, recordings uploaded successfully to a storage will be removed from disk.
When enabled, recordings uploaded successfully to a storage will be removed from disk.
values: true, false
AGENT_SIGNINGtrueEnable 'true' or disable 'false' for signing recordings.
Enable 'true' or disable 'false' for signing recordings.
values: true, false
AGENT_SIGNING_PRIVATE_KEYThe private key (RSA) to sign the recordings fingerprint to validate origin.
The private key (RSA) to sign the recordings fingerprint to validate origin.
AGENT_STUN_URIstun:turn-fra1.kerberos.io:3478When using WebRTC, you'll need to provide a STUN server.
When using WebRTC, you'll need to provide a STUN server.
AGENT_TIMEfalseEnable the timetable for Kerberos Agent
Enable the timetable for Kerberos Agent
values: true, false
AGENT_TIMETABLEA (weekly) time table to specify when to make recordings.
A (weekly) time table to specify when to make recordings.
AGENT_TIMEZONEAfrica/CeutaTimezone which is used for converting time.
Timezone which is used for converting time.
AGENT_TURN_PASSWORDpassword1TURN password used for WebRTC.
TURN password used for WebRTC.
AGENT_TURN_URIturn:turn-fra1.kerberos.io:3478When using WebRTC, you'll need to provide a TURN server.
When using WebRTC, you'll need to provide a TURN server.
AGENT_TURN_USERNAMEusername1TURN username used for WebRTC.
TURN username used for WebRTC.
AGENT_TUS_CHUNK_SIZE_BYTES8388608Bytes sent in each resumable-upload PATCH. Set to 0 or a negative value to send all remaining bytes in one PATCH.
Bytes sent in each resumable-upload PATCH. Set to 0 or a negative value to send all remaining bytes in one PATCH.
AGENT_USERNAMErootThe username used to authenticate against the Kerberos Agent login page.
The username used to authenticate against the Kerberos Agent login page.

FAQ

Can I leverage ONVIF capabilities?

Yes, Agent integrates with ONVIF for PTZ presets, stream discovery, audio back channel, and more.

Is my data encrypted?

Agent offers end-to-end encryption using AES and RSA. Recordings can be encrypted with an AES key, and live streams can be encrypted when connected to Hub.