Agent

The agent is a separate binary on your machine. It connects to the cloud by itself with the team's integration key and hands the canvas exactly what you listed in its config: database connections and folders. No inbound ports, tunnels or allow-lists are needed. There is neither a server nor an editor inside.

Setup

Issue an integration key in the team cabinet. The key can be revoked at any moment; the agent disconnects immediately.
Download the agent for your system on the Agent page.
Put agent.json next to it and run myetern-agent agent.json.

{
  "key": "mik_…",
  "cloud": "https://myetern.com",
  "name": "office",
  "connections": {
    "main": {"kind": "mysql", "host": "localhost", "port": 3306,
             "user": "reader", "password": "…", "database": "shop"}
  },
  "mounts": [
    {"name": "images", "path": "/srv/images", "mode": "ro"},
    {"name": "out",    "path": "/srv/out",    "mode": "rw"}
  ],
  "allowRemoteConnections": false,
  "allowBuild": false
}

Connection kinds: mysql, pgsql, sqlite. A folder in ro mode never accepts a write.

What shows on the canvas

The agent appears in the team list right after signing in.
A source with connection agent:office/main runs SQL on your machine.
Agent files in the menu: browse folders, pull files into attachments by hash, write generation results as a tree into an rw folder.
A project from files: languages parse a directory from your machine while the translator stays on the server.

Owner flags

allowRemoteConnections: let the cloud add connections from the cabinet. A double key: the flag is set by the machine owner, and on the cloud side only a team manager can do it. Such connections go to a separate file; the agent never rewrites your agent.json.
allowBuild: compile and run generated files sent by the cloud with your own compiler. The cloud never executes foreign code natively, so a cloud run goes either through the agent or in a wasm sandbox.

Commands, HTTP and language servers

Three sections of agent.json open the agent to external tools, each under the owner's own allow list:

"exec": {"allow": ["gh *", "dart *", "bash tools/dist/*", "docker compose *", "claude *"],
         "cwd": "/home/me/projects/app", "timeoutSeconds": 120},
"http": {"allow": ["https://tracker.example.com/"],
         "headers": {"https://tracker.example.com/": {"Authorization": "Bearer …"}}},
"lsp":  {"dart": "dart language-server --protocol=lsp", "php": "intelephense --stdio"}

exec runs commands of jobs, actions and trackers, http calls tracker addresses with headers that never leave the machine, lsp starts language servers for the editor. A full example with every section ships in the agent archive as agent.example.json. Details are in the chapters "Code on the canvas", "Project" and "Tasks and trackers".

Self-host: the agent is built in

A self-host server needs no separate agent. Put agent.json next to the server or point MYETERN_HOME_AGENT to it: the key and cloud fields are not required, the server issues itself a key for the session. The agent is called "home" or by the name from the config and can do everything the config describes. Other machines connect as regular agents: myetern-server agent add NAME prints the key once, then agent list and agent rm. "Data → 🤖 Agents…" shows who is online.

Rights

Reading files and databases through the agent, writing and building require the cap.file, cap.sql and cap.shell capabilities of whoever presses the button. Capabilities are granted by a team manager.

← Data, databases and files f2plw languages →