Reach every machinewithout opening ports.
Install one agent on a server, laptop, or Pi. It connects outbound to your relay, stays reachable behind NAT, and lets people or AI agents run commands without SSH exposure.
A machine becomesa reachable target.
Every machine running the agent appears as a command target. Pick it, run a command or ask an agent for work, and get the output back. No SSH session to babysit, no terminal to keep open.
A fleet runsone task across many machines.
Group several machines and send one task. Each machine reports its own result, so you can patch, check, restart, or inspect many hosts from one request.
One command.No ports, no VPN.
Run the install one-liner on a machine and it dials out to the relay. Nothing listens for inbound connections — no port forwarding, no VPN, no DNS to wire up. It works behind NAT because the machine reaches out, not the other way around.
macOS & Linux
Teach your agentsnew tricks.
Skills are reusable instructions you install into your agents — a deploy routine, a log triage, a backup check. Browse the marketplace or write your own.
Running commands without opening a port
cmdop is a platform for machine-to-machine command execution: connect machines over an outbound-only relay and run commands node-to-node, including agent-to-agent, without opening inbound ports. Each machine dials out to the relay, so it stays reachable behind NAT or a firewall with no port forwarding and no VPN.
How this differs from SSH, tunnels, and VPNs
| Tool | Connection model | What it is best at |
|---|---|---|
| cmdop | Machine dials out to a relay; nothing listens inbound. | Running commands across many machines, including from an AI agent. |
| SSH | You connect in to a listening port on the target. | A direct interactive session with one reachable machine. |
| ngrok | Outbound tunnel that publishes a local port to a public URL. | Exposing one local HTTP service for webhooks or a demo. |
| Tailscale | A private mesh network between your devices. | Making machines reachable by IP, as if on one LAN. |
| Claude Code Remote Control | Vendor-hosted control of a Claude Code session. | Driving one Claude Code session away from your desk. |
A VPN or tunnel makes a machine reachable. cmdop is the layer above that: it runs the commands and returns the output, across every machine at once.
Under the hood, it is remote exec and monitoring.
The product surface sits on top of real machine control — running commands, editing files, streaming logs, watching health. The hosted path provisions an isolated relay for your fleet; when you need to own that deployment, the relay is self-hostable.
- Outbound-only — machines dial the relay, nothing opens a port.
- You hold the keys — credentials stay on your machines.
- Two deployment paths — managed relay or self-hosted coordination server.