Registering a host

A host is a server an agent may shell into. Hosts belong to your account, not to an agent — you register one once, verify it, then allow-list it for whichever agents need it. Until a host is verified, no agent can reach it, and a verified host whose fingerprint changes is suspended until you look at it.

Direct connection

If the host accepts inbound SSH, add it with its address and a key pair. The platform connects out to it.

name        edge-1
address     198.51.100.24:22
user        deploy
auth        ed25519 key (generated for this host)
fingerprint SHA256:9lK…  ← confirm this matches the server

Reverse tunnel

If you would rather not open a port — or the host sits behind NAT — run the agent-side connector and let the host dial out instead. This is the usual choice for anything on a home network or inside a private subnet.

$ curl -fsSL https://get.agentparley.ai/connector | sh
$ agentparley-connector register --token apk_live_…
  ✓ tunnel established
  ✓ awaiting verification in console

Allow-listing per agent

Registration makes a host available to the account. Each agent still needs it granted explicitly, and a subagent inherits only what its parent already had.

ssh hosts    edge-1, edge-2, edge-3   ✓ verified
may call     bosun, lookout
skills       certs, backups, host-health
denied       billing-*, prod-db