Remote Access

Your agents live on your Mac, but two of Agentum’s best surfaces — the Telegram Mini App and Agentum Web Chat — need to reach them from your phone, anywhere. Remote Access is how: a private, encrypted Cloudflare tunnel from your Mac out to the internet, provisioned and supervised entirely by the app. Nothing to install, no router configuration, no port forwarding.

Turning it on

  1. Set up your Telegram bot first — the tunnel wizard checks that your bot token and allowlist are in place before it starts. See Telegram Setup.
  2. Open System → Settings → Telegram Mini App and click Enable remote access.
  3. A short wizard provisions your tunnel and waits until it’s actually serving at the network edge — usually well under a minute.

Once it’s up, the card shows your tunnel’s Public URL (hidden behind a Reveal toggle — treat it like a semi-secret) and the Telegram bot gains its Open Agentum menu button. To add the browser-based chat on the same tunnel, flip on the separate Web Chat card — see Agentum Web Chat.

To turn it all off, click Disable remote access on the same card. The hostname stops resolving to anything.

How it works

  • Agentum bundles Cloudflare’s cloudflared connector inside the app. When you enable Remote Access, Agentum asks its provisioning service for a tunnel, and you get a private hostname of the form https://<16 random characters>.yuriclaw.com — randomly generated and unguessable, not derived from your name or email.
  • The connection is outbound-only: your Mac dials out to Cloudflare’s edge; nothing ever connects inbound to your network. There are no open ports on your router and nothing to firewall.
  • The app supervises the connector — if it crashes or your network blips, it restarts automatically with backoff.

What’s exposed (and what isn’t)

The tunnel forwards only an explicit allowlist of paths, each to its own dedicated local listener:

Public path Serves Protected by
/tma and /api/tma/* The Telegram Mini App Telegram’s signed initData (verified against your bot token) + your user-ID allowlist
/mychat and /api/webchat/* Agentum Web Chat — only if you’ve enabled Web Chat Per-device pairing tokens you approve on the Mac

Everything else returns 404 at Cloudflare’s edge — the request never reaches your Mac. The app’s internal API and dashboard are bound to localhost only and are not reachable through the tunnel at all. The exposure list is deliberately tiny and doesn’t grow without a security review.

When your Mac sleeps

The tunnel is a live connection from your Mac, and there’s no relay in the middle — so if the Mac is asleep or offline, the Mini App and Web Chat are unreachable and push notifications pause. Everything reconnects automatically when the Mac wakes. If you want your agents reachable around the clock, set your Mac to stay awake while plugged in (System Settings → Energy).

Privacy notes

  • Traffic flows phone → Cloudflare → your Mac, end-to-end over HTTPS. Agentum’s own servers are only involved in creating the tunnel, not in carrying your traffic.
  • Your tunnel hostname is effectively a random 80-bit identifier. Still, don’t post it publicly — the path allowlist and auth layers are the real protections, but there’s no reason to invite door-knocking.

Troubleshooting quick hits

  • Just enabled it and the URL errors (Cloudflare 1033/530) → DNS at the edge can lag a few seconds behind “tunnel up.” The wizard normally waits this out; give it a minute and retry.
  • Worked yesterday, dead today → is the Mac awake and online? Wake it and the tunnel re-registers on its own.
  • Mini App opens but won’t authenticate → that’s the Telegram layer, not the tunnel — see Telegram Setup and Troubleshooting.

Next steps