Run on your own hosts

Turn a Linux box into your own coding agent.

Your own Linux box becomes a confined, approval-gated coding agent.

  • Runs as unprivileged user
  • Confined to its workspace
  • Gated by approval ladder
  • Hosts unlimited, 2 agents each
  • Cost daily spend cap
  1. Install the provisioner — from the app over SSH, or a one-liner on the box.
  2. Add the SSH host — key-only auth; the host key is verified and pinned.
  3. Install the agent — pick a driving account (API or local, not subscription).
  4. Set the run envelope — start low on the four-rung ladder, raise with trust.
remote agents — chatbox
CrazyToad Remote Agents chatbox and overview

Chatbox, overview, live stream, daily log, and agent rail

remote agents — setup
CrazyToad Remote Agents setup without sensitive host details

Host setup with sensitive details redacted

What the agent can do on your box

Three verb classes, each with its own safety rung — the headline is full claude -p / codex exec loops on the host.

Read-only verbsRead files, list dirs, git status, run tests — even in observe/suggest.
Write & command verbsWrite files, apply patches, run commands — need an approve or auto-limited rung.
Orchestration verbFull claude -p / codex exec loops, confined as the work user.
Almost any brainAny model your accounts support — not the Gemini/Antigravity CLI.
Note
Autonomous, not unrestricted. Full coding loops, fenced in a per-agent workspace as an unprivileged user, deny-list always on. GitHub work goes through the gh CLI.

Confined by the OS, then again in software

The OS is the load-bearing wall — every write, command, and LLM loop drops to crazytoad-work; software guards layer on top.

Confined non-rootDedicated unprivileged crazytoad-work user owns the workspace.
Cwd-locked workspacePer-agent workspace; .., outside-absolute, and symlink escapes blocked.
Deny-list always on.env / .ssh / keys / credentials / /etc refused at every rung.
Privilege-drop fail-closedNo work user, no write — never a silent fallback to root.
Daily cost capOver-budget LLM work refused before dispatch; brain notified daily.
Zero telemetryCredentials ride guarded transport, redacted from commands and diagnostics.
Note
Remote model cost is explicit. Subscriptions don’t drive remote agents — use an API or local account; provider charges apply.

Three ways to install — on unlimited hosts

Every route runs the same idempotent provisioner: Rust ToadAgent binary, unprivileged work user, workspace, hardened systemd unit, locked-down box (UFW SSH-only, fail2ban, key-only SSH).

  1. From the app over SSH — Remote Agents → add an SSH host → Install / Connect; CrazyToad deploys everything for you.
  2. One-line, on the box — as root on the target:
    curl -fsSL https://github.com/crazylegs-dom/crazytoad-releases/releases/latest/download/install.sh | sudo bash
  3. Windows wrapper — drive the install over SSH:
    ./install.ps1 -HostName <ip> -User root -KeyPath <key>
Note
Unlimited hosts of your own. Re-running the idempotent provisioner on a host is safe.

Add an SSH host

Click Add SSH host. Key-only auth — no password field; keys live in the Manage vault.

NameRequired. Friendly label; becomes the host id.
SSH hostRequired. Hostname or IP.
PortDefaults to 22.
UserRequired. SSH user to connect as.
Stored keyPick a vault key, or “Paste new key…”.
Key idExisting vault key id, or blank to paste below.
New key labelLabel for a pasted key, saved to the vault.
Paste SSH keyPrivate key body, starting -----BEGIN OPENSSH PRIVATE KEY-----.
Warning
Installs are gated on the host key. On Save it is verified and pinned; no install until then. Private keys materialize only while connecting.

Install the CrazyToad Agent

Open Install CrazyToad Agent: managed install, or generic log tail. The managed agent streams health, answers Chatbox, and self-tests; the driving account comes from Accounts.

NameRequired. Display name for this agent.
HostInstall target; max 2 agents per host.
Agent typeManaged install, or generic log tail.
LLM accountDrives the agent; subscription accounts are disabled here.
Bridge commandRequired, absolute path. Default /usr/local/bin/crazytoad-agent stream.
Message commandOptional. Default /usr/local/bin/crazytoad-agent chat -q {{message}}.
PersonaThe agent’s system prompt.
Warning
Two limits. Subscription accounts can’t drive remote agents (use API or local), and each host holds a maximum of 2 agents. Keep the {{message}} placeholder in the Message command.

Set the run envelope

A four-rung ladder from least to most autonomy — start low, raise with trust, and list Protected paths it must always pause on.

observeWatches only — never changes anything.
suggestPlans and proposes — you run the changes.
approveActs, but pauses for your OK on risky work.
auto-limitedRuns routine work alone — stops at protected paths.
Protected pathsGlob patterns the agent must pause on, e.g. /etc/**, **/.env.
Note
Protected paths apply at every rung. Even auto-limited stops on them. Fence secrets with globs like /etc/** and **/.env.

Manual release install (advanced)

The managed route is canonical; offline rollouts use only the release-published binary and SHA-256 checksum — never a development source file.

  1. Verify the release — match the binary to the published SHA-256 checksum.
  2. Stage and probe — run health and provider checks against the existing config; live service untouched.
  3. Swap atomically — keep the old binary for rollback, replace, restart, confirm health, then register the host.
Note
The bridge is a wire protocol. crazytoad.remote-agent.v1 — newline-delimited JSON, 15s heartbeat. Once attached, Brain management catalogs its connections as live, planned, or error.
Related