Guide

TunnelCrib Agent guide

TunnelCrib Agent is lightweight background software installed on a Device you want to access. It registers the Device, advertises approved Services, and handles secure on-demand Tunnels.

1. Download

1. Go to the project's GitHub Releases page.
2. Download the tunnelcrib-agent-<target> binary for your OS and architecture.
3. Place it in a stable location.

2. Register (one-time setup)

./tunnelcrib-agent --register <domain> <orgid> <token>

This saves:

• server/org settings
• a Device keypair used for nonce-signature authentication

3. Configure Services (optional)

Agent configuration stores named Tunnels — each with a name, a target (host:port), and an advisory type used only to pick a local launcher on the Client — in:

• Linux/Windows: ~/.config/tunnelcrib/agent/protocols.json
• macOS: ~/Library/Application Support/TunnelCrib/agent/protocols.json

If missing, TunnelCrib creates it with a single OS-appropriate default Tunnel: ssh on Linux, rdp on Windows, vnc on macOS. Since name and type are independent, you can add multiple Tunnels of the same type (e.g. two SSH targets) or give a Tunnel a descriptive name unrelated to its type (e.g. proxmox of type http).

Add, list, or remove Tunnels without hand-editing the file:

./tunnelcrib-agent --add 192.168.0.66:22 --type ssh --name "syslog_server"
./tunnelcrib-agent --list-tunnels
./tunnelcrib-agent --remove-tunnel syslog_server

Optional runtime overrides:

./tunnelcrib-agent --protocols ssh,rdp,winrm
./tunnelcrib-agent --local-port 3389

4. Run

./tunnelcrib-agent

• Default mode: attempts a direct Tunnel first, falling back to a Relay.
• Relay mode: ./tunnelcrib-agent --ssh

Last reviewed 2026-09-09 against the current CLI source. Corrections are welcome — support@gaur.is.