Linux and Windows agents behind NAT
The agent opens an outbound connection to the control plane. No inbound ports, VPN, or public IP addresses required.
Install the Nythronix agent on a machine and it connects to the control plane over an outbound WebSocket connection. The machine needs no public IP, port forwarding, VPN, or IP allowlist. This works equally well for a server in a data center, a laptop behind a home router, or an office workstation behind corporate NAT.
Windows
The installer asks for the control plane URL and a single-use enrollment token, installs the agent as a service, and optionally enables OpenSSH Server. Silent installation is available for bulk deployment.
The same file works across the Windows family, from 7 SP1 and Server 2008 R2 through 11, on both 32-bit and 64-bit systems. The installer detects the OS version and architecture and extracts the appropriate agent build. On older systems without a component store or access to GitHub, OpenSSH Server comes from the installer bundle. An existing OpenSSH installation is left alone and is not removed when the agent is uninstalled.
The browser terminal works on Windows 10 1809 and later, which provide ConPTY. On older systems, the machine still appears in the dashboard, responds to commands, and is accessible over SSH through the relay. Open a terminal to it through a neighboring modern machine.
Linux
The dashboard’s installation script creates an unprivileged user, installs the binary, and adds a systemd unit. The agent runs without root, with elevated permissions granted through a sudo policy.
Token enrollment
Enrollment tokens are single-use and created in the dashboard. You can attach tags to a token so machines enrolled with it immediately join the right group: client:acme, env:prod, role:db.
What the dashboard shows
Online or offline status, operating system, agent version, tags, and active sessions. Tag filters and groups work throughout the dashboard.
Learn more: Windows installation, Linux installation, Machines and tags.
More features
- Terminal in your browser
Sessions survive through tmux or zellij: close the tab, lose the network, or restart the agent, and your command keeps running.
- SSH relay through the control plane
SSH and scp tunnels between machines and from the operator's laptop. Encryption stays end to end; the control plane cannot read the traffic.
- Access by consent code
For someone else's machine: the owner generates a single-use code and the operator enters it in the dashboard. Codes expire and access can be revoked, as in TeamViewer.
- AI workers in channels
Channels for machines and tasks, like Discord. Workers read, suggest, and run commands, but changes require human approval and are recorded in the audit log.
- Skills through MCP
Connect Postgres, web tools, and other ready-made MCP servers as worker skills. Each runs on its own machine with restricted network access.
- Signed updates
Agent releases are signed with Ed25519. The agent verifies the signature and updates itself, without a manual visit to every machine.
- An unprivileged agent and on-demand sudo
The agent runs as a regular user. Elevated permissions are granted for specific commands and a limited time.