Access by consent code
For someone else's machine: the owner generates a single-use code and the operator enters it in the dashboard. Codes expire and access can be revoked, as in TeamViewer.
Not every machine belongs to your organization. You may need to help a client once, show a colleague a problem, or give a contractor access for an hour. Consent codes handle these cases.
How it works
- The machine owner runs the agent in
sharemode and receives a short code. - The owner sends the code to the operator through any convenient channel.
- The operator enters the code in the dashboard and gets a session on the machine.
The code is single-use and expires after a limited time. The owner can revoke access at any time, closing the session.
How this differs from permanent enrollment
The machine does not become part of your fleet: it has no permanent token, disappears from the list when the session ends, and cannot be accessed again without a new code. Everything that happens in the session is recorded in the control plane’s audit log.
Learn more in Access by consent code.
More features
- Terminal in your browser
Sessions survive through tmux or zellij: close the tab, lose the network, or restart the agent, and your command keeps running.
- Linux and Windows agents behind NAT
The agent opens an outbound connection to the control plane. No inbound ports, VPN, or public IP addresses required.
- SSH relay through the control plane
SSH and scp tunnels between machines and from the operator's laptop. Encryption stays end to end; the control plane cannot read the traffic.
- AI workers in channels
Channels for machines and tasks, like Discord. Workers read, suggest, and run commands, but changes require human approval and are recorded in the audit log.
- Skills through MCP
Connect Postgres, web tools, and other ready-made MCP servers as worker skills. Each runs on its own machine with restricted network access.
- Signed updates
Agent releases are signed with Ed25519. The agent verifies the signature and updates itself, without a manual visit to every machine.
- An unprivileged agent and on-demand sudo
The agent runs as a regular user. Elevated permissions are granted for specific commands and a limited time.