Secure remote access for humans and AI agents

Remote access
without the headaches

One binary turns your machines — laptop, server, cloud, or a Pi — into a secure private network you and your AI agents can reach, run commands on, and search from anywhere. No accounts, no servers, and no company in the middle. Just install, invite, connect.

Get Started How It Works
$ curl -fsSL https://hop.keikai.ai/install.sh | bash
macOS (Apple Silicon & Intel) · Linux (x86_64, ARM64, ARMv7)

No accounts. No third party. No one in the middle. Your machines connect directly and privately — by design.

Why hop?

One binary. No accounts. No company in the middle — for you and the agents you run.

No third party, ever

Your machines connect directly and privately, end-to-end encrypted. Unlike Tailscale, there's no coordination server to phone home to, no account, no third party in your trust path. Your keys stay on your machines.

Works anywhere, one binary

One small download, no dependencies, no config. Punches through any NAT automatically, home, cloud, or a Raspberry Pi. Install, invite, connect — in under a minute.

Agent-ready today

Add one skill and your AI tools can reach, run commands on, and search across every machine — inside the limits you set. No integration to build, and nothing central to breach.

Also built in: encrypted file transfer, sessions that survive disconnects, secrets, and scheduled automation — with deeper tooling for fleet management, AI orchestration, and session audit (tap).

How hop compares

No accounts, no port forwarding, no third-party routing.

hop
SSH / Tailscale / ngrok
Third party in the middle
None — nothing to sign up for
Tailscale needs its coordinator; ngrok its servers
Account required
No
Tailscale, ngrok require accounts
Setup
One command, under a minute
VPN config, daemon, signup
Works through NAT
Automatically, anywhere
SSH needs port-forwarding
Private network
Built in
Tailscale only (separate tool)
Usable by AI agents
Yes — one skill, works today
None

Install, invite, connect

Up and running in under a minute. No accounts, no servers, no VPN config.

1 · Install

Run one command on the machine you want to reach. It installs hop and prints a one-time invite.

2 · Invite

Share the invite, or use it yourself. It's single-use and time-limited, and its role decides exactly what the new member can reach.

3 · Connect

Redeem it from your laptop with hop connect and you're in a secure shell. After that, it's just hop <name>.

Terminal
# On your server $ hop host Listening... Node ID: 5f4a8c... # Generate an invite $ hop invite Invite token: eyJ0eX... # On your laptop, first time, use the invite token $ hop connect eyJ0eX... Saved as known host: server # After that, just use the name $ hop server server $ _ # Run a command without opening a shell $ hop server -- ps aux # Copy files over the same encrypted connection $ hop cp -r ./project server:~/project

Give your AI agents safe hands, today

Agents can reason and call tools, but they still can't safely reach the machines you actually run. Add the hop skill and yours can — immediately, with no integration to build.

One skill, your whole fleet

Give your AI tool the hop skill and it can reach every machine on your network, run a command across all of them at once, and search their logs together — in plain language, inside the limits you set. It works today, over the same install, invite, connect you just saw. Nothing to wire up.

  • Works right now — no integration project, no API to build
  • Reaches any machine and runs commands across the whole fleet at once
  • Stays inside the limits you set, so it can't touch what you haven't allowed
  • No third-party service in the loop to breach or lock you in
See how it connects to your AI tools →
Your AI tool
# Add the hop skill to your agent — that's it $ hop mcp # Now, in plain language: "restart the API on every production box, and show me any errors from the last hour" → runs it across all production machines → searches every machine's logs, together → stops at whatever your rules don't allow

Your own private network, when you need it

Hop also gives you a peer-to-peer private network. Setting up a VPN should be as easy as SSH or scp, so it is.

A hop warren: your machines connected peer-to-peer Three machines (a laptop, a server, and a Raspberry Pi) reach each other by name over direct encrypted peer-to-peer links with no central server. The Pi bridges a home LAN (printer and NAS) that cannot run hop. Your warren Your machines, reachable by name from anywhere. Peer-to-peer, no central server. ๐Ÿ”’ E2E laptop laptop.hop you ยท owner myserver myserver.hop always-on host pi pi.hop bridges the LAN โ†“ Home LAN ยท 192.168.1.0/24 devices that can't run hop, reached through pi printer .1.50 NAS .1.60 encrypted P2P link LAN bridge

Your machines, reachable by name

Invite a machine and it answers by name (myserver.hop) on a private address only your machines can reach, from anywhere. No port-forwarding, no VPN appliance, no coordination server in someone else's cloud. The tools you already use — SSH, scp, VNC — just work.

You can also bridge devices that can't run hop (a printer, a NAS, a whole home or office LAN) through one machine that's on it, or forward a remote port to your laptop like ssh -L. See the docs →

Terminal
# On a machine that's on your warren: make an invite $ hop invite Invite: eyJ0eX... # On the new machine: join with it $ hop connect eyJ0eX... Joined. You are 100.64.3.12 (laptop.hop) # Now your machines answer by hostname, from anywhere $ ssh myserver.hop $ scp report.pdf myserver.hop:~ $ open vnc://myserver.hop

Install

One command to download, verify, and install.

Build your install command

$ curl -fsSL https://hop.keikai.ai/install.sh | bash
Advanced options

Client: reach hosts you're invited to, no sudo, no daemon, no VPN. Upgrade to the warren VPN anytime with hop connect <invite>.

Supported Platforms

💻
macOS
Apple Silicon (arm64) & Intel (x86_64)
🐧
Linux
x86_64, ARM64 & ARMv7