Your machines, services and AI agents — reachable from anywhere, exposed to no one.
NFLTR connects your own machines, services and AI coding agents across networks without opening ports or setting up a VPN.
A service on your laptop, a server behind a firewall or a machine at home usually cannot be reached from outside. The usual fixes are opening ports on a router, which exposes the machine, or running a VPN, which takes setup on every device.
NFLTR takes another route. Each machine makes one outgoing connection to a go-between server at nfltr.xyz, the relay, and the relay passes traffic between your machines and the people or programs that need them. Nothing on your machines accepts incoming connections.
-
Services and machines reachable from anywhere
A local web app gets a public address, and SSH or a database behind a firewall becomes reachable from your laptop.
-
AI agents on the machines that hold your work
Claude Code agents start on the laptops, servers and cloud machines that have your code, data and access, and report back to one place.
-
Keep the path on your own network
The relay that carries every connection can also run on a machine of your own. This is in beta.
-
Status
An hourly test shows whether the hosted service is working.
-
Blog
Notes from building nfltr: how each part works, what was measured and what went wrong.
Services and machines reachable from anywhere
A local web app gets a public address, and SSH or a database behind a firewall becomes reachable from your laptop.
The nfltr command runs next to a service and keeps one outgoing connection to the relay. nfltr http gives a local web app an HTTPS address that works while the command runs and stops when it stops. nfltr tcp forwards SSH, a database or another network service, so a machine with no public address and no open port can be reached. Its end-to-end encrypted tunnel serves only the client keys it lists: nfltr config client-key prints a laptop's, and --allow-client names it.
Web links are encrypted between the visitor and your machine, so the relay passes them along without being able to read them. The same command set can also send files and messages directly between two machines (nfltr p2p) and reach a private network through one machine on it (nfltr wg).
nfltr tcp 22 --allow-client "$LAPTOP_KEY"
-
Your software in your customers' networks
A .NET fleet whose agents sit behind customers' NATs and proxies, before and after the move to nfltr, measured end to end: what each machine stops running and listening on, what a customer's network team is asked, and where nfltr is not a fit.
AI agents on the machines that hold your work
Claude Code agents start on the laptops, servers and cloud machines that have your code, data and access, and report back to one place.
A machine joins once with nfltr node join and sets what agents on it may do: which repositories, which tools and how many agents at a time. You then describe a goal in plain words to a Claude Code session, the hub, which starts agents on the machines that have what the work needs, runs them in parallel and collects each result.
Every agent is a Claude Code process on one of your own machines, so code and data stay there. Results survive a closed terminal and arrive exactly once. The relay only carries messages; it runs no AI model.
claude mcp add nfltr -- nfltr mcp --toolset hub
claude "find out why last night's build failed"
-
Eight recorded runs
Eight terminal recordings of agents handling incidents and backlogs across a laptop and cloud machines.
Keep the path on your own network
The relay that carries every connection can also run on a machine of your own. This is in beta.
nfltr.xyz runs the hosted relay, and most people use that. In beta, the same relay can run on a Linux machine of your own with nfltr relay serve, so traffic between your machines never leaves your network. The agent features work on it; share links, SSH and database tunnels and the dashboard do not yet.
Programs written in Go can also connect to the relay directly with the Go SDK.
nfltr relay serve --data-dir /var/lib/nfltr-relay --tls-self-signed --tls-name relay.lan
Status
An hourly test shows whether the hosted service is working.
Every hour an automated test connects two machines through nfltr.xyz, starts a test job on each and checks that every result arrives exactly once. The test uses a stand-in instead of a real AI model.
The status page shows the share of tests that passed over the last 24 hours and 7 days, the latest failures and how long each took. One machine runs the test, so a gap means that machine was offline; the page marks itself out of date once its newest result is more than two hours old.
Blog
Notes from building nfltr: how each part works, what was measured and what went wrong.
Each post opens with the problem it is about, belongs to a series, and gives every measured claim its setup, its numbers, how to reproduce it and its limits. Failed experiments stay in the posts.
The open-source layers
Three of the layers under NFLTR are Go modules published on GitHub under the Apache-2.0 license: the stream multiplexer at the bottom, the relay's session core, and the SDK and wire protocol that programs use to talk to a relay. Each is versioned on its own.
-
link
Multiplexes many byte-stream sessions, each a
net.Connwith its own flow control, over connections you dial and secure; a slow reader stalls only its own session. Its submodules carry it over QUIC (quiclink) and gRPC (grpclink), and linkvet addsgo vetchecks for code that uses it. -
relay
The Go client SDK and wire protocol for the nfltr relay, for agents, clients and tools that talk to a relay; the
nfltrcommand is built on it. -
relay-core
The relay's session core as a Go module: agents behind NAT dial out to it over gRPC, and clients holding the same key open byte sessions to their ports, through HTTP ingress, SNI and link frontends.
nfltr/quic-go is NFLTR's fork of quic-go (MIT license). It carries a few fixes that link's QUIC transport needs, each its own commit with its test.
A first command in a few minutes
Installing puts the nfltr command on a Mac or Linux machine. After signing in at nfltr.xyz and saving an API key, the last command gives a local web app on port 8080 a public HTTPS address that works for as long as the command runs.
curl -fsSL https://nfltr.xyz/install.sh | sh
nfltr config add-api-key
nfltr http 8080 --share