Remote Access

Your agents live on your Mac. Remote Access is what lets you reach them when you’re not sitting in front of it: a private, encrypted Cloudflare tunnel from your Mac out to the internet, set up and supervised entirely by the app. Nothing to install, no router settings, no port forwarding, and no open ports on your network.

Two features ride this one tunnel, and each is switched on separately:

  • Agentum Web Chat — your agent conversation, in any browser and on your phone. This is the one most people want.
  • Public Links — a private web address an agent can hand to an outside service so that service can notify it (a form submission, a payment alert, a delivery update). Most people never need this.

Turning it on

  1. Open Settings → Connections → Remote Access and click Enable.
  2. A short wizard sets up your tunnel and waits until it’s really working out on the internet — usually well under a minute.
  3. Web Chat is switched on by default as part of that, because a tunnel with nothing on it does nothing. You can turn it off again on the Web Chat card below.

Once it’s up, the card shows your Public URL behind a Reveal toggle, and chips telling you which features are currently riding it.

To turn everything off, click Disable on the same card. The address immediately stops resolving to anything.

How it works

  • Agentum includes Cloudflare’s connector inside the app. When you enable Remote Access, Agentum asks its provisioning service for a tunnel and you get a private address of the form https://<16 random characters>.yuriclaw.com — randomly generated and unguessable, never derived from your name or email.
  • The connection is outbound only. Your Mac dials out to Cloudflare; nothing ever connects inward to your home network.
  • The app watches the connector. If it crashes or your Wi-Fi blips, it restarts on its own.

What’s exposed, and what isn’t

The tunnel forwards only the specific addresses below, each to its own separate local listener:

Public address What it serves Who’s allowed in
/mychat and /api/webchat/* Agentum Web Chat — only if Web Chat is on A per-device pairing token that you approve on the Mac
/hooks/* Public Links — only if Public Links is on, and only the specific links you approved The link’s own 128-bit secret, which is part of the address itself

Everything else returns a 404 at Cloudflare’s edge — those requests never reach your Mac at all. The app’s own internal API is bound to your Mac only and is not reachable through the tunnel under any address. That list is deliberately tiny and doesn’t grow without a security review.

A Public Link is created by request: an agent asks for one, and it appears in Settings → Connections → Public Links as a consent row telling you plainly what the agent wants it for. Nothing is created until you approve it, and:

  • The address is the password. Each approved link carries a random 128-bit secret in its URL, so treat the address like a credential.
  • You can rotate a link at any time — the address changes, the old one stops working, and the agent keeps its approval.
  • “Not now” is remembered. Declining doesn’t create a link, doesn’t mint a secret, and stops the agent re-asking.

When your Mac sleeps

The tunnel is a live connection from your Mac, with no middleman holding your messages — so if the Mac is asleep or offline, Web Chat is unreachable and push notifications pause. Everything reconnects by itself when the Mac wakes. If you want your agents reachable around the clock, set your Mac to stay awake while plugged in (System Settings → Lock Screen / Energy).

Privacy notes

  • Traffic goes phone → Cloudflare → your Mac, over HTTPS the whole way. Agentum’s own servers help create the tunnel; they never carry your messages.
  • Your address is effectively a random 80-bit identifier. Even so, don’t post it publicly — the address list and the sign-in layers are the real protection, but there’s no reason to invite door-knocking.

Troubleshooting quick hits

  • Just enabled it and the URL errors (Cloudflare 1033 or 530) → the internet’s address system can lag a few seconds behind “tunnel up.” The wizard normally waits this out; give it a minute and retry.
  • Worked yesterday, dead today → is the Mac awake and online? Wake it; the tunnel re-registers on its own.
  • Web Chat asks to pair every time → that’s the Web Chat layer, not the tunnel. See Agentum Web Chat.

Next steps