What operating systems does Tink support?

Any Linux distribution with curl and Node.js 20 or newer. The installer uses a user-local command and does not require systemd or root access.

Does Tink run commands automatically?

No. Tink suggests fixes and waits for your explicit approval. Nothing runs without you confirming it first.

How much resources does the Tink agent use?

Minimal. The agent idles at under 20MB RAM and near-zero CPU between scans. Scans themselves take a few seconds.

Can I use Tink on containers?

Tink is designed for long-running servers, not ephemeral containers. For Kubernetes, point it at your nodes instead.

What data does Tink collect?

System metrics (CPU, memory, disk, network), running services, and relevant log snippets when diagnosing issues. No application data, credentials, or file contents.

Tink vs SentinelOne

SentinelOne Singularity is EDR and XDR. It hunts malware on the endpoint. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.

SentinelOne hunts threats. Tink answers “why is this VPS sick?”

Accidental sysadmins land on SentinelOne because Singularity is the default “autonomous EDR.” Then disk is at 91% on web-1, nginx dies, and last night's storyline does not say what to run. A filling /var is a Tink warning; it is not a Singularity graph.

Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using SentinelOne if you already want that EDR. Use Tink if you run Linux servers and want a mechanic. They can sit in the same shop.

Feature	Tink	SentinelOne
Setup time	30 seconds (one curl \| sh command)	Singularity agent, site token, console, and a seat per host — then you still SSH into every Linux box when it is sick
What you get	Working monitoring, diagnosis, and approved fixes	EDR/XDR — behavioral AI, rollback, Ranger. Not a fleet mechanic for disk, nginx, or certs
Pricing	Free (Scout) / $9 / $29 per machine per month	Per-endpoint Singularity SKUs. You still pay the person who SSHs into nginx after the outage
Hidden costs	None — fully managed	A second console for threats, and whether anyone watched /var on the app servers
Monitoring approach	Agent on the server — CPU, disk, services, logs, certs, ports	Process telemetry and autonomous response. Singularity does not forecast fill time or propose a restart
Configuration	None after install — heuristics and AI	Policy groups, exclusions, and whether last week's agent still matches the live host
Plain-English diagnosis	Yes — AI explains root cause, impact, and fix	No — you read a storyline and then SSH into the Linux host anyway
Fix execution	Proposes and executes approved commands with an audit trail	Containment and rollback on the endpoint — SentinelOne cannot free disk or rotate a cert on the app server
Alerting	Built-in across 8 channels	Console + email/SIEM. A Singularity storyline is not a Telegram diagnosis of a filling /var
Predictive alerts	Yes — disk fills in ~6 days, memory and CPU trends	Threat graphs only — Singularity does not forecast fill time on the host it already sensors
Firewall / port exposure	Built-in — warns when the host firewall is inactive or dangerous DB ports listen	Network control exists. It still will not say Redis is bound to 0.0.0.0 on web-1
Machine offline detection	Agent presence monitoring with multi-channel alerts	A host that stopped scanning is a Tink alert. SentinelOne still shows last agent heartbeat as healthy until you look
Public status page	Shareable URL with 90-day history	Not included — SentinelOne has no customer-facing status page for your app fleet
Weekly fleet digest	Automated Monday digest + daily brief when issues are open	Not included — a Singularity dump is not a plain-English fleet narrative
On-call tracking	Built-in /oncall command + incident acknowledgment	Not included — wire something else into PagerDuty
Conversation interface	Telegram, WhatsApp, web dashboard, CLI	Singularity console + SSH. No mechanic you text when /var filled on the VPS
Learning curve	None — works after install	Low to install the agent; higher to keep policies, exclusions, and Ranger honest
Best for	Freelancers, small teams, accidental sysadmins (1-50 Linux servers)	Operators who already want Singularity EDR and will still SSH into every Linux host when it is sick

When SentinelOne is the right choice

Keep using SentinelOne when you already want that exact job:

EDR / XDR — Singularity detections, rollback, and Ranger — not a fleet digest.
Threat hunting — SentinelOne is the malware console; it is not a mechanic for the Linux hosts it sensors.
Compliance endpoint — an agent you already standardized on that a $9 agent will not replace.
No conversation layer wanted — some operators prefer the Singularity console and will never use a mechanic.

The real cost of “just put Singularity on it”

The agent is cheap to roll. A working ops loop for five Linux boxes is not:

A clean storyline still means you SSH into each host and change the box by hand when it gets sick
Host fill, nginx, certs, and a quiet agent never appear unless you built extra checks on the Linux side
A filling /var is a Tink disk warning on every scan — SentinelOne stays a threat graph until you are looking
A single VPS with nobody logged in still needs a mechanic, not another prevention policy

For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens Singularity after the outage, and every scan includes a diagnosis a quiet EDR will not type.

No SSH homework. No silent host. One command install.

Start Mechanic

Also compare: Tink vs CrowdStrike · Tink vs Wazuh · Tink vs CrowdSec