Tunnel

The tunnel

A small daemon on your own computer that lets your agents run commands there and use its local models, with no open port and no firewall change.

The tunnel connects one of your own computers to AgentParley: a home server, a VPS, a work machine behind NAT. Once it is connected, your agents can run commands and edit files on it (SSH commands), and any models it runs can serve your agents as providers (local models, Codex and Claude Code).

It is a single program, agentparley, that you install on the computer. It dials out to AgentParley and keeps that connection open. AgentParley never connects in, so you open no port, change no firewall rule and need no public address. It works from behind NAT, a home router or a corporate proxy that allows outbound HTTPS.

The daemon is open source. The code that runs on your machine is public, so you can read what you are installing before you run it.

How it fits together

your computer                                   AgentParley
┌──────────────────────────┐                    ┌──────────────────────────────┐
│ agentparley daemon       │ ── outbound ────▶  │ SSH egress service           │
│  · runs commands         │    gRPC over 443   │  holds the open connection   │
│  · reads/writes files    │                    │  and forwards each operation │
│  · relays local models   │                    └──────────────▲───────────────┘
└──────────────────────────┘                                   │
            │ login, token refresh                             │ one operation at a time
            ▼                                                  │
     AgentParley API  ◀────────────────────────────  your agent's turn

• The egress service holds your daemon's connection. When an agent runs a command on your computer, its turn sends that one operation to the egress service, which passes it down your open connection and returns the result.
• Each operation is authorized on its own. The turn gets a short-lived token for that single operation, scoped to your computer. The egress service checks it against AgentParley's published keys before forwarding anything.
• Your daemon proves who it is with a key that never leaves the computer. At login it creates an Ed25519 key pair and AgentParley records the public key's fingerprint. Every token refresh is signed with the private key, so a copied refresh token alone is not enough to impersonate your computer.
• Removing the computer takes effect within seconds. Delete it in the console, or run agentparley logout on it, and its connection is closed within about 15 seconds.

Install

Linux with systemd, x86-64 or ARM64:

curl -fsSL https://get.agentparley.ai/tunnel/install.sh | sudo sh
sudo -u <run-as-user> agentparley login
sudo systemctl start agentparley

The installer downloads the binary for your CPU, verifies its checksum, writes /etc/agentparley/config.yaml, creates /var/lib/agentparley (readable only by the run-as user), and installs and enables the systemd service.

<run-as-user> is the OS account your agents' commands run as. By default it is the account that ran sudo. Pick it deliberately: an agent can do on this computer exactly what that user can do, and nothing more. The daemon has no way to switch to another user.

You can also start in the console: Settings → Sandboxes → Connect a computer → Tunnel shows the same command.

Log in

agentparley login prints a short code and a link:

Open https://app.agentparley.ai/device and enter this code: S2GK-5ZX3
Waiting for approval...

Open the link while signed in, check the computer name it shows, and approve. The daemon then creates its identity key, swaps the one-time approval for a long-lived login, and the computer appears in your console as a connected computer. Start the service and it connects.

You approve every new install in person on purpose: a stolen install command alone cannot add a computer to your account.

Computers nobody sits at. A rented machine can log in from a one-time enrolment token file instead (/run/agentparley/enrolment-token). If the daemon finds no saved login and that file exists, it enrols with the token. AgentParley's own rented sandboxes use this.

Let an agent use it

A connected computer is available to an agent only once you allow it. On the computer's page, or in the agent's settings, choose which agents may use it and which computer is an agent's primary one (used when the agent doesn't name a host). Then the agent has the ssh_* tools for it. See SSH commands.

Configuration

Everything the daemon reads is in /etc/agentparley/config.yaml:

server:
  api: https://services.agentparley.ai/platform
  egress: services.agentparley.ai:443
run_as: deploy            # must be the user the service runs as
enabled: true             # false refuses every operation
read_only: false          # true refuses every file write and delete
allow_commands: []        # empty = any command (still subject to deny_commands)
deny_commands: []         # deny always beats allow
max_concurrent_operations: 8
auto_update: true

enabled, read_only, allow_commands and deny_commands are your own lever on this computer. The daemon checks them before every operation, on the computer itself, whatever AgentParley decided. See Limiting what agents can do.

Updates

Each time the service starts it checks https://get.agentparley.ai for a new release and installs it before it connects. An update is installed only if its checksum signature verifies against the release key built into the daemon. A failed check never stops the tunnel from starting on the version already installed.

• sudo agentparley update updates now and restarts the service.
• auto_update: false turns off the automatic check, for machines whose software only changes on purpose.

Diagnose

agentparley doctor checks everything and changes nothing:

✓ version           up to date
✓ config            /etc/agentparley/config.yaml
✓ running as        deploy
✓ logged in
✓ service           enabled and active
✓ api reachable     https://services.agentparley.ai/platform/health
✓ egress reachable  services.agentparley.ai:443
✓ clock             within 1s of server time
✓ providers

Run it as the run-as user (sudo -u <run-as-user> agentparley doctor) to include the login and local model checks. Every failed line says how to fix it. journalctl -u agentparley has the daemon's log.

Remove it

• agentparley logout revokes this install at AgentParley and deletes its login and key from the computer. The local wipe happens even when the computer can't reach AgentParley.
• curl -fsSL https://get.agentparley.ai/tunnel/uninstall.sh | sudo sh removes the binary, service and folders.

What it keeps on disk

Each chat's shell state (working directory, exported variables) lives in memory-backed storage (/dev/shm), so a reboot clears it. It can hold secrets an agent exported, so it is never written to a real disk.