SSH · TCP · UDP · HTTP / machines behind NAT, CGNAT and firewalls
Hand out access to a machine you can't reach.
linkport publishes SSH, TCP, UDP and HTTP from a machine behind NAT onto one HTTPS link. A person opens that link and gets a terminal in a browser tab. An AI agent opens the same machine over MCP. Both pass the same policy, and you can revoke it.
Prepaid in crypto. No cards, no automatic renewal.
- Setup
- 1 command
- Open ports
- 0
- Agent access
- MCP · 15 tools
One command in. One link out.
$
about that pipe into sudo
Fetching the script doesn't consume the token, so you can read it first and install
after. It prints which user the service will run as before it does anything — and that
defaults to the user who invoked sudo, not
root. What it doesn't do yet →
01 / nothing comes in
Your firewall stays shut.
The agent dials out and keeps one TLS connection to the edge. Nothing on the machine listens for the internet. There is no inbound rule to write, no port to forward, no VPN to join, no dynamic DNS to babysit. Behind CGNAT or a corporate NAT, none of that changes.
you · your agent
Browser, ssh, MCP
linkport edge
Authorize, route
:443 · ALPN split
your machine
Agent, outbound only
→ 127.0.0.1:22
Both arrows leave. Nothing arrives at your machine uninvited.
- Transport
- TLS 1.3 on 443, ALPN linkport/1
- Multiplexing
- one connection, many client streams
- Liveness
- ping + 90 s deadline, reconnect with backoff
- Hops
- the edge terminates 443 itself, no extra proxy
02 / who is holding the link
One link. Two kinds of visitor.
The same URL serves a person and a program. The person gets a terminal in a browser tab. The program gets typed tools over MCP. Same authorization, same command policy, same audit trail — which is why the two panels below run the same two commands and get the same two answers.
a person · browser
Opens the link, gets a shell.
An xterm.js console served over the same HTTPS link. Nothing to install, nothing to configure, no private key to email. It works from a locked-down laptop, a borrowed machine or a phone.
$systemctl status caddy
● caddy.service — active (running)
$rm -rf /var/lib/postgresql
blocked by policy · read only
- Link password, account grants, or both
- Sessions recorded as commands or a full asciinema cast
- HTTP ports get their own link at
/h/<id>/
{
"mcpServers": {
"linkport": {
"url": "https://linkport.cloud/mcp",
"headers": { "Authorization": "Bearer lp_…" }
}
}
}Scoped API tokens: read · tunnels:write · connect
03 / desktop
A real SSH client, on your machine.
The browser terminal is the zero-install path: open the link, get a shell. linkport Terminal is the other one — a desktop app that signs in with the same account, talks SSH itself, and can reach a machine behind NAT over the same tunnel. It ships with Pro and Team. There is no free desktop client.
Same account
Sign-in opens the cabinet in your browser and shows a short code. Confirm it, and the app holds an ordinary session — no extra password, no API token to paste.
Full SSH
Keys, host checks and the session live in the app. Through a linkport tunnel the edge sees ciphertext, not a browser PTY. Direct SSH to a public host works the same way.
Pro and Team
The installer is public. Using the app is not: a prepaid Pro or Team plan has to be active, or the window stops at a paywall. When the period ends, so does access.
04 / anatomy
The link is the credential.
So it is built like one. Every link carries 256 bits of entropy, and every link can be narrowed further: a password, named accounts, a deadline, a use count, an IP allowlist. When you are done, rotate it or kill it. The tunnel underneath does not care.
https://linkport.cloud/s/b7f3a1c9d4e8062f5a7b3c1d9e4f8a02c6d5b9e13f7a4c8021d6e5b3f9a7c4d8
- Secret
- A 256-bit id. Not enumerable, not guessable, never reused.
- Password
- An optional password on the link, checked on every access before the session starts.
- Accounts
- Or grant by email, one address at a time — or to any signed-in linkport account.
- Expiry
- A time to live and a maximum number of uses, per link.
- Rotate
- Swap the id in place. The old URL dies, the tunnel keeps running.
- Revoke
- Kill the link. New connections are refused; a session already open ends when it disconnects.
- Raw ports
- TCP and UDP publications need a knock first, then an IP allowlist.
- Audit
- Link access is written to the log with who, when and from where.
05 / guardrails
The edge reads the command before your machine does.
Giving someone a shell is normally all or nothing. Here it is a policy. The browser terminal and the MCP tools both pass through the edge, so a command that is not allowed is stopped on the way in rather than reported after the fact — and the whole session is on the record either way.
ls -la /etc/nginx ✓ ranjournalctl -u api -n 200 ✓ rangit log --oneline -20 ✓ ransystemctl restart api ✗ blocked — not a read commandecho "" > /etc/hosts ✗ blocked — redirection writesrm -rf /var/lib/postgresql ✗ blocked — not a read commandwhere this stops
It is a hard stop on accidents and a speed bump on intent.
The filter reads a byte stream, not a parsed shell, and we would rather you learned its limits here than on a machine you cared about:
- Input typed inside a full-screen program — an editor, top, less — is not parsed.
- Neither is a line recalled from history, completed with Tab or pulled from reverse-search.
- Interpreter escapes go straight through: python -c, base64 | sh, a script you already uploaded.
- A native ssh client tunnelled over the link is a raw byte pipe with no filter on it.
- If the control plane is unreachable, the edge lets the session run rather than cutting you off.
Treat it as a policy that keeps honest work inside the lines, backed by a recording of everything that happened. If you need a real boundary, give the machine a read-only account — or do not publish it at all.
- Read only
- One switch per machine. Reading commands pass; anything that changes state, including a `>` redirect, does not.
- Allow and deny lists
- Name the commands you permit, or the ones you never want to see. Lists only narrow read only, they cannot widen it.
- Session recording
- Off, commands only, or the full session as an asciinema cast you can replay and download.
- End-to-end encryption
- The key is generated on the machine and never leaves it, so the server relays tunnel traffic as ciphertext. The browser terminal and HTTP proxy are off in this mode. MCP commands and file transfers still cross the edge in the clear — they ride the agent control channel, not the tunnel.
- Account security
- TOTP two-factor, API tokens with read / tunnels:write / connect scopes, and an audit log behind all of it.
06 / what goes through
Four protocols, one outbound socket.
ssh:
Browser terminal · linkport connect (WebSocket, drops into ssh as a ProxyCommand) · MCP
No raw port is opened for SSH
http:
Its own HTTPS link at /h/<id>/
WebSocket upgrade is a per-link flag
tcp:
A dedicated port on the edge
Knock first, then an IP allowlist
udp:
A dedicated port on the edge
Pro and Team plans
What people do instead, and what it costs them.
Open port 22, dynamic DNS
- Inbound rule
- Required
- Client to install
- An ssh client + a key
- A non-engineer can use it
- No
- An AI agent can use it
- Hand it your private key
- Command policy
- Whatever sshd can do
- Revoking access
- Edit sshd, rotate keys
A VPN mesh (Tailscale, WireGuard)
- Inbound rule
- None
- Client to install
- On every device, enrolled
- A non-engineer can use it
- Install, then enroll
- An AI agent can use it
- Once its host is enrolled
- Command policy
- None on the wire
- Revoking access
- Remove the node
An HTTP tunnel (ngrok, Cloudflare Tunnel)
- Inbound rule
- None
- Client to install
- None for HTTP
- A non-engineer can use it
- For web apps, yes
- An AI agent can use it
- HTTP only, no shell
- Command policy
- HTTP rules, not commands
- Revoking access
- Close the tunnel
Reverse tunnel to a jump box
- Inbound rule
- On the jump box
- Client to install
- An ssh client + a key
- A non-engineer can use it
- No
- An AI agent can use it
- Hand it your private key
- Command policy
- Whatever you script
- Revoking access
- Log in and kill it
linkport
- Inbound rule
- None
- Client to install
- None, a browser tab
- A non-engineer can use it
- Open a URL
- An AI agent can use it
- Native, over MCP
- Command policy
- Read-only and lists, at the edge
- Revoking access
- Revoke or rotate the link
Edge, control plane and MCP server in Rust; the dashboard is a SvelteKit app. Prometheus metrics on the edge and the API.
07 / plans
Priced per fleet, not per seat.
Every plan includes the browser terminal, MCP access, read-only mode, command filtering and the audit log. Pro and Team also include the desktop SSH client. What scales is how many machines you point at it. Plans are prepaid in cryptocurrency through Heleket — no cards, no automatic renewal, no refunds. Payment and cancellation are in the public offer.
Pro
$9.99/mo
or $83.92/yr
Five machines, ten publications each, UDP and 100 GB of traffic.
Get your first linkTeam
$29.99/mo
or $251.92/yr
Twenty-five machines and full session recording, for access someone else will audit.
Start with Team| Limit | Pro | Team |
|---|---|---|
| Machines | 5 | 25 |
| Publications per machine | 10 | 50 |
| Traffic per month(shown but not yet enforced) | 100 GB | 1 TB |
| Connections per link(shown but not yet enforced) | 10 | 100 |
| UDP publications(shown but not yet enforced) | Yes | Yes |
| Desktop terminal | Yes | Yes |
| Session recording(shown but not yet enforced) | — | Yes |
* Beta, and we would rather say so: machine and publication counts are enforced today. The starred rows are shown in your dashboard and metered, but not yet capped — so you will not be cut off mid-session while we finish billing.
08 / questions
What you'd want to know before running this on your box.
Do I have to open a port on my firewall?
No. The agent opens one outbound TLS connection to the linkport edge on port 443 and keeps it. Nothing on your machine listens for the internet, so there is no inbound rule, no port forward and no dynamic DNS to maintain.
Does it work behind CGNAT or a corporate NAT?
Yes. Because every connection is outbound, CGNAT, double NAT and restrictive corporate egress make no difference as long as the machine can reach port 443. That covers home servers, Raspberry Pis, office boxes and cloud VMs alike.
Am I really supposed to pipe your script into sudo?
You do not have to. Fetching the script does not consume the install token, so you can read it first and install after: curl -fsSL <link> -o install.sh, read it, then sudo sh install.sh. The POSIX sh script verifies the agent download, installs it in /usr/local/bin/linkport and writes a systemd unit. It prints the service user before making changes: the user who invoked sudo, or the current user (including root) otherwise. LP_RUN_AS can select an existing account explicitly. Browser and MCP commands inherit that account’s normal permissions. The installer leaves sudoers unchanged and does not add passwordless sudo.
How is this different from WireGuard or a VPN mesh?
A VPN puts a client on every device and joins them to one network. linkport puts a single service on a single URL. Nobody enrolls, nobody installs anything, and the person you share with never gets access to anything except the service you published.
Is SSH exposed as a raw port on the internet?
No. SSH publications are reached through the browser terminal, through a WebSocket tunnel that plugs into ssh as a ProxyCommand, or through MCP. A dedicated port on the edge is only opened for tcp: and udp: publications, and it is gated by a knock and an IP allowlist.
Can I let an AI agent use my servers safely?
That is what read-only mode and the command lists are for. Point an MCP client at linkport and the agent gets typed tools instead of your private key. The edge checks commands for the browser terminal and for MCP before they reach the shell, and every action lands in the audit log. Read the limits on that filter before you rely on it: it reads a byte stream, so it is a hard stop on accidents and a speed bump on intent, not a security boundary. On a machine that matters, pair it with an account that cannot do damage.
What happens if a link leaks?
The id alone is 256 bits, so it cannot be guessed or enumerated. On top of that a link can require a password or a signed-in account, and expire after a deadline or a number of uses. If you are still uneasy, rotate the id or revoke the link. Two honest caveats: the link password is currently stored and compared in plain text and is not rate limited, so treat it as a speed bump rather than a secret; and revoking refuses new connections but does not tear down a session that is already open.
Can the server read my session?
By default the edge terminates TLS, which is what makes the browser terminal and the command filter possible — you cannot have a server that enforces a command list and a server that only sees ciphertext at the same time. Turn on end-to-end encryption and the key is generated on the machine and never leaves it, so the tunnel payload is opaque to us; in that mode the browser terminal and the HTTP proxy are off by design. Even then, MCP commands and file transfers still cross the edge in the clear, because they ride the agent control channel rather than the tunnel. If none of that is acceptable, do not publish the machine.
How do I remove the agent?
sudo systemctl disable --now linkport-agent, then delete /etc/systemd/system/linkport-agent.service, /usr/local/bin/linkport, /etc/linkport and /etc/sudoers.d/linkport. The agent adds no user, touches no sshd config and writes no firewall rules. Deleting the machine in the dashboard revokes its links from the other side.
What happens to my machine if linkport goes down?
The links stop resolving and the agent retries with backoff until the edge answers again. Nothing on the machine changes: sshd, your services and your firewall are exactly as they were, because the agent only ever dialled out and proxied to local addresses.
How do paid plans work?
Pro and Team are prepaid: a month (30 days) or a year (365 days, 30% off). You pay a cryptocurrency invoice through Heleket; the plan starts after they confirm it. There is no automatic renewal — when the period ends the next signed-in request ends the paid plan. Existing machines stay connected; new ones require an active subscription. Pro and Team include the desktop SSH client; Free does not. Payments are final: there are no refunds. Payment and cancellation are in the public offer; the privacy policy lists what we store, including the email we send Heleket for the invoice.
What is the desktop terminal?
linkport Terminal is a desktop SSH client for Windows, macOS and Linux. It signs in with the same account you use in the cabinet: the app shows a short code, you confirm it in the browser, and the session stays on the device. Through a linkport tunnel it opens a real SSH session rather than the browser console. The installer is public; using the app requires an active Pro or Team subscription.
ready when you are
Your machine is two minutes from being a link.
Prepaid in crypto. No cards, no automatic renewal.