Connect
In Cmdop, connecting a machine means the agent makes an outbound connection to its relay and keeps it open; nothing dials in. That is why a joined machine works from behind NAT or a firewall with no port forwarding and no VPN, and why “online” means “its connection is live” rather than “a port is open”.
“Connect” covers four distinct outcomes. They have different reach and different credentials, so start by picking the one you actually want.
The four connect outcomes
| Goal | Command | Reach |
|---|---|---|
| Make this machine reachable | cmdop join then cmdop start | This host |
| Open a terminal on another machine | cmdop connect <machine> | Machines reachable at their own relay door |
| Ask another machine’s agent for work | cmdop fleet <machine> | Any online joined machine |
| Run one command | cmdop connect exec <machine> -- <cmd> | This host |
cmdop start does not “connect you” to anything — it makes this machine
available to its relay. Reaching a different machine is cmdop connect.
The reachability rule worth knowing first
A machine appearing in your roster does not mean you can open a terminal on it. Remote terminal attach dials the target’s own relay door and authenticates there. Two consequences:
- A machine whose relay is LAN-only or loopback-only is not remotely attachable, even though it is online and reachable through the console.
- Your own machine’s credential is not honoured at another machine’s door. That door requires its own authentication, plus its connection PIN when armed.
Working through the browser console has no such restriction — the relay routes to any online joined machine.
cmdop connect exec is scoped to this host today: it resolves its target
through the relay running here and has no path to another machine’s public door.
Do not treat it as a cross-host or CI execution API. See
One-shot execution.
Common questions
How do I connect to a machine behind NAT?
Join the machine to Cmdop and start its agent. The machine dials out to the relay and stays online through that outbound connection, so you do not need a public IP address, port forwarding, or a VPN. If an assistant needs to operate that machine, use the machine behind NAT guide.
Why can I see a machine but not open a terminal on it?
Fleet presence and terminal attach are different paths. A machine can be online through the console while its own relay door is not remotely attachable, or while its connection PIN is still required. Use Interactive attach for terminal rules and Fleet MCP tools when an assistant should operate the machine through Cmdop instead.
What is the difference between cmdop connect and cmdop fleet?
cmdop connect is the terminal-oriented path. cmdop fleet addresses a
machine’s agent and is the same product boundary exposed to Claude Code or
Codex through MCP. For AI-agent work across machines, start with
Give an assistant fleet access.
Related
- Authentication and PINs
- Run an AI agent on a server without SSH
- Remote work — the concept behind all of this.
Cmdop