Overview
What it is
Section titled “What it is”Nythronix is a control plane for remote machines. A small agent installed on each machine connects to the control server over an outbound WebSocket connection. You can then work with the machine from your browser: open terminals, relay SSH through the control plane, grant one-time access by code, and connect AI workers that run commands with your approval.
The key property: machines need no public IP, open ports, or VPN. The agent behind NAT calls out to the server; the server never initiates a connection to the machine.
Nythronix comes in two forms: SaaS (the dashboard at https://app.nx.3fe.ru, with agents connecting through nx.3fe.ru) and self-hosted (the same codebase on your server). This documentation describes the SaaS dashboard; self-hosted differences are covered in the FAQ.
Components
Section titled “Components”| Component | Purpose | Runs on |
|---|---|---|
| Control plane | HTTP/WebSocket API, authentication, auditing, byte routing between agents, chat, and worker memory. | nx.3fe.ru |
| Dashboard | Web interface: overview, terminals, tunnels, workers, and administration. | https://app.nx.3fe.ru |
Agent nythronix-agent |
A service on the managed machine. Creates terminals (PTY), accepts relay streams, runs worker commands, and updates itself. | Each machine |
| Worker | An AI channel participant. Reads the channel, reasons, calls tools, and asks for human approval. | A container on the Nythronix side |
Operator CLI nyx-operator |
Lists the fleet and opens a local port routed through the control plane to a machine behind NAT (SSH, scp, rsync). | Your laptop |
MCP server nyx-mcp |
Exposes the same actions to Claude Code and other MCP clients: find a machine, open a tunnel, or run a read-only check. | Your laptop |
See SSH relay and tunnels for a detailed connection diagram.
Glossary
Section titled “Glossary”- Machine / agent. In the dashboard these mean the same thing: a record of an installed agent, with a login, hostname, version, platform, presence (Online / Offline), and tags.
- Organization. The isolation boundary. Operators see only their organization’s machines; relays and tunnels work only between agents in the same organization.
- Operator. A person’s dashboard account. Roles:
owner,admin,operator,viewer. Viewers can watch terminals but cannot type in them. Admins and owners can access the Admin section (agent enrollment, tokens, releases, and audit). - Session. One terminal on a machine: a plain shell or a session inside tmux or zellij. Sessions live on the agent, not in the browser, and can be rejoined by one or several people. See Terminal and sessions.
- Enrollment token (
nyxet_…). A single-use or reusable token that lets an agent obtain permanent credentials during installation. Create one in Admin → Agents → Enrollment tokens. - Relay. A mechanism for switching bytes between two agents, or between your
nyx-operatorand an agent. This makes SSH and other TCP services reachable behind NAT. Enable it separately on each target machine. - Tunnel. A local TCP port that leads through the relay to another machine’s loopback port. It can run on an agent (created in the dashboard) or on your laptop (
nyx-operator tunnel). - Consent code. A one-time code generated by the machine owner with
nythronix-agent share. The operator enters it on the dashboard and receives exactly the access the owner allowed. See Access by consent code. - Channel. A chat within an organization for people and workers. A worker can belong to several channels, and a channel can contain several workers.
- Worker. An AI channel participant. Runs commands on machines only through the control server and with human approval, except for commands on the safe read-only list. On Linux, its commands run as the unprivileged
nyx-workeruser. - Skill. An additional set of worker tools: an MCP server running on the machine itself, for example to access a local database, and made available through the control plane. Enable skills in Admin → Agents → Skills.
Who it is for
Section titled “Who it is for”- Administrators managing machines behind NAT (offices, branches, home PCs, VPS instances) who want browser access without a VPN.
- Teams that need shared terminal viewing and an activity log.
- People providing one-time support on someone else’s machine who want access to last only as long as the owner permits.
- Anyone who wants AI workers to handle routine tasks while retaining approval of every command that makes changes.
Start with the quickstart.