AgentOS Connect

How to check it yourself

Here is what Connect does with your connection, claim by claim, where to check it in the source, and where the limits are.

Cloudflare carries the connection

When you link a machine, we create one Cloudflare Tunnel for it and one DNS name, m- followed by 16 hex characters. The tunnel's only route is that name to a port on your machine's loopback address; anything else gets a 404. We set that route through Cloudflare's API with a key limited to tunnels and DNS on runagentos.com, and the app only ever writes a loopback address. Your machine runs Cloudflare's connector, a pinned release checked against its published SHA-256. The connector dials out, so no port opens on your router. Your phone's HTTPS is handled by Cloudflare's network, with its certificate for runagentos.com, on the way down the tunnel. Our servers aren't in that path.

  • lib/security/auth.ts · tunnel traffic is never trusted as this machine: it must carry a paired device's token

The client is open source

The part of Connect that runs on your machine is in the AgentOS repository under an open-source licence, and the README's Connect section lists where each piece lives. You can read it, run its tests, and build AgentOS from source instead of installing it from npm.

$ git clone https://github.com/saadnvd1/agent-os && cd agent-os && npm install && npm test

Devices get in by pairing

Everything that arrives through the tunnel gets the same check as a stranger on your Wi-Fi: it must carry the token of a paired device. It is never treated as your machine itself, even if it claims to be localhost. New devices are added with a one-time code from your machine or your tailnet. A paired phone can use AgentOS but can't add other devices, and nothing on our side can add one.

Approvals use passkeys

Your Connect account signs in with a passkey; we store only its public key. On your machine, approving a new passkey, a hard-line decision or a resume needs a passkey with Face ID or Touch ID, on a challenge tied to that one request, valid once for two minutes. An agent running on your machine can reach every page but can't make your fingerprint reader sign.

Your work never touches our servers

This site holds your account and the list of your machines. Your code, terminal, agents' output and every key stay on your machine. That's the complete list of what crosses to us, and the section below names the parts that are visible to us.

The limits

What this design doesn't protect against, so you can decide with the whole picture.

A stolen paired device has full access until you revoke it

A paired phone can do anything you can do in AgentOS. If one goes missing, remove it in AgentOS under Devices (it's cut off at once), or run agent-os disconnect on the machine to switch Connect off entirely.

We can see some things

Your machines' names, whether each is online, your account email, and billing details if you're on Pro. Not the contents of anything.

Cloudflare carries the connection

Your traffic runs on Cloudflare's network, over HTTPS and then the encrypted tunnel to your machine, so you're relying on Cloudflare as a carrier, as much of the web does. Your machine still checks for a paired device on every request. If you'd rather keep everything on a network you run, AgentOS also works over Tailscale or your own VPN.

We hold the key that sets your machine's route

Our servers keep the Cloudflare key that creates your tunnel and its address. It's limited to tunnels and DNS on runagentos.com, and kept out of logs. Whoever held it could change where your address points, which is why the pairing check runs on your machine and not here.

Your machine's address is public

Its hostname is a public DNS name in our zone: m- plus a digest of a random id, not your name. Anyone who learns it reaches Cloudflare's 404 or your machine's pairing screen, nothing more.

Found something that doesn't hold up? Email [email protected].