Want to know when your own machine boots, logs in, or starts a shell? Create a key, then install one of the generated snippets on the host you want to watch: Get the installer for a key via:
The snippets are designed to be unobtrusive — backgrounded execution, 3–10s timeouts, output redirected to /dev/null. They won’t slow your shell startup or hang your boot if the mantis server is unreachable. Example: alert me on every SSH login
Example: alert me when my Mac boots
These keys behave identically to a normal HTTP key server-side — the difference is the install helpers that wire the trigger to host events. The same key can serve any installer type, so you can reuse one key for shell + login + boot if you don’t want to discriminate.

​
Web-embed snippets (CSS / JS)

In addition to host-event installers, the same /install endpoint generates two web-embed snippets you can paste into your own website:
Both are also visible as tabs (“web CSS”, “web JS”) on the key detail page in the dashboard, with the JS tab exposing an inline hostname input field. The dashboard tab regenerates the snippet whenever you change the hostname. The CSS uses partial escape-sequence obfuscation on the URL (\6c for l, etc.) so the canary URL is less obvious to a casual reader of the stylesheet — browsers parse it identically. The JS snippet sends explicit ?l=<location>&r=<referrer> query params alongside the canary URL so you can identify the cloning site even when the Referer header is stripped (strict referrer policies, mixed-protocol downgrades, etc.).

​
Physical snippets (NFC)

The /install endpoint also generates an NFC URL record:
Write the generated URL to a blank tag with any NFC writer app. Mantis appends ?src=nfc, which the trigger endpoint promotes into host_context.source = "nfc" when the tag is tapped. The printable nfc-label PDF is a QR/sticker companion for the same key; it only fires when scanned or tapped, not when the PDF itself is opened.

​
Smart-home snippets (Home Assistant / Scrypted)

The /install endpoint also generates smart-home snippets:
Use --profile on the install command to decide which server the generated snippet reports to. The snippet stores a literal URL, so changing the CLI’s current profile later does not affect already-installed Home Assistant or Scrypted automations.

​
Drive an action when a hit fires

The snippets above let Home Assistant trigger a mantis. The reverse also works: a home_assistant notification destination lets a hit drive HA — flip a switch, cut a VLAN, fire a scene, or push a phone notification. Point it at an HA webhook automation:
Every hit then POSTs a mantis.hit JSON payload (memo, IP, user-agent, and the full host_context) to that webhook. The target URL must end in /api/webhook/<id>. To scaffold the HA side, generate a ready-to-paste automation skeleton — it listens on the webhook, drops the activation ping, and shows example actions (switch toggle, mobile push, logbook entry):
If Mantis reaches HA over a private/Tailscale address, the SSRF guard blocks it unless you set ALLOW_PRIVATE_WEBHOOKS=1 (an instance-wide switch — prefer restricting egress at the network layer). For devices that do not expose useful webhooks, iot-helper/ can watch LAN neighbor tables and log files, then fire the same Mantis URL for unexpected online/login events.

​
What information each installer captures

Each installer sends X-Mantis-* headers alongside the hit, which the server parses into a structured host_context object exposed on the API + dashboard + CLI. (Boot-time installers don’t include X-Mantis-User because no user is logged in yet.) The big win is $SSH_CLIENT — when someone SSHes into your machine and the shell snippet fires, the mantis records the SSH client’s IP, not just the machine’s own public IP. The dashboard surfaces this prominently as ← <client-ip> next to the user/host context. The CLI shows the same:
Empty / missing X-Mantis headers (e.g., a non-SSH local shell, or a boot event with no user) are simply not displayed, so the chip stays compact.