Operator workstation

What gets installed

Two tools are installed on the operator’s machine, with an optional third:

Tool	Purpose
nyx-operator	CLI for machine lists and manual relay tunnels
nyx-mcp	MCP server exposing the same actions to Claude Code and other clients
nythronix-agent	Optional: makes the operator’s machine itself manageable

Neither your machine nor the target needs inbound ports; the target agent only needs to be online.

Installation and updates

One command on Linux x86_64:

curl -fsSL https://nx.3fe.ru/downloads/install-operator.sh | bash

The script downloads binaries published by the control server, checks each against the accompanying sha256 list, and installs to ~/.local/bin, or /usr/local/bin when run as root. A checksum mismatch aborts installation.

Run the same command to update. The script compares installed and published versions and replaces only changed tools. A running nyx-mcp is replaced safely by renaming the new file into place; the process held by Claude Code continues using the old binary until it exits.

Note

Unlike the agent, operator tools do not update themselves. Run the command again to install a new version. Use --check to inspect available updates without changing anything.

Pass script flags after bash -s --:

Flag	Purpose
--check	Show installed and available versions, then exit
--only operator,mcp,agent	Install only the listed components
--prefix DIR	Installation directory
--force	Reinstall even if versions match
--server URL	Control server, default https://nx.3fe.ru
--cabinet URL	Dashboard URL for nyx-operator login, default https://app.nx.3fe.ru
--with-agent	Also install the agent and enroll this machine
--token nyxet_…	Enrollment token, required with --with-agent
--name "Name"	This machine’s dashboard name

Making the operator’s machine manageable requires root: enrollment writes /etc/nythronix/agent.json and installs a systemd unit.

curl -fsSL https://nx.3fe.ru/downloads/install-operator.sh \
  | sudo bash -s -- --with-agent --token nyxet_… --name "My laptop"

Caution

The script supports Linux x86_64 only. Operator tool builds for other architectures, Windows, and macOS are not published yet. The Windows .exe installer installs the agent, not operator tools.

Signing in

Run once on each machine:

nyx-operator login --server https://app.nx.3fe.ru --token nyxop_…
claude mcp add nythronix -s user -- ~/.local/bin/nyx-mcp

Credentials are stored in ~/.config/nythronix/operator.json with permissions 0600. Both CLI and MCP use this file, so one login is enough. Treat it like an SSH key. Environment variables NYX_SERVER and NYX_TOKEN take precedence.

The second command is needed only for Claude Code. See MCP for operators.

Where accounts and tokens come from

These are separate; creating an account does not create a token.

1. Account. An administrator creates it in Admin → Operators with an email, password, and role. The password is only for dashboard sign-in; CLI and MCP do not use it.
2. Token. The operator signs in and creates a named token in Settings → API tokens. The nyxop_… value is shown once; only its hash is stored. Copy it immediately into nyx-operator login. If lost, revoke it and create another.

Tokens are self-issued. Administrators cannot issue them on behalf of others. To give a colleague CLI access, create an account and share its password; the colleague creates their own token. This binds every audited token to one person.

Roles

Role	Dashboard	Tunnels	run_command, SSH keys	Admin pages
viewer	Read only	No	No	No
operator	Yes	Yes	No	No
admin	Yes	Yes	Yes	Yes
owner	Yes	Yes	Yes	Yes, all organizations

An ordinary operator can open relay tunnels and use SSH. Checks through run_command and key installation through authorize_ssh_key require admin privileges.

First check

nyx-operator agents --online
nyx-operator tunnel web-01 --port 22 --listen 127.0.0.1:2222
ssh -p 2222 user@127.0.0.1        # in another terminal

Identify the machine by dashboard name, hostname, login, or ID; a unique substring is enough. The tunnel lives with the process; Ctrl-C closes it. Any TCP port works, including --port 3389 for RDP or --port 5432 for Postgres.

Building from source

Only needed when modifying the tools or running a self-hosted installation without published binaries:

make mcp     # nyx-operator and nyx-mcp in target/release/

Next steps

• CLI reference: all nyx-operator commands and flags.
• MCP for operators: nyx-mcp tools and security rules.
• SSH relay and tunnels: relay internals and server visibility.