Install guide

Add a Private agent under Agents.

Embed the connector in your product startup, or paste the one-liner for a quick ops test.

Inject agent_id and token at deploy time. Whoever runs the agent never runs a CLI.

Open the agent for Summary, Reachability, Outcomes, and Incidents.

pip install "agent-status-sdk[tunnel]"

import os
from agent_status.tunnel import expose_http

expose_http(
    agent_id=os.environ["AS_AGENT_ID"],
    token=os.environ["AS_TUNNEL_TOKEN"],
    target="http://127.0.0.1:8080",  # your agent’s local HTTP
    blocking=False,
)
# … start your agent as usual

pip install -q "agent-status-sdk[tunnel]" && agent-status expose --agent-id <uuid> --token rtun_… --target http://127.0.0.1:8080

docker run -d --restart unless-stopped --name agent-status-connector \
  --add-host=host.docker.internal:host-gateway \
  -e RORA_TUNNEL_TOKEN=rtun_… python:3.12-slim \
  bash -c 'pip install -q "agent-status-sdk[tunnel]" && agent-status expose --agent-id <uuid> --token "$RORA_TUNNEL_TOKEN" --target http://host.docker.internal:8080'

Ordered hop from an independent node to your private agent. Your side only runs an outbound connector.

1. 1

   Independent nodes

   Outside-in

   Distributed nodes originate the probe. Your VPC never opens inbound. This is the attestation path, not a claim that users can reach the agent.

   Evidence

   HTTP GET/POST from distributed nodes

2. 2

   Probe URL

   Public

   Nodes hit Carmel’s public relay URL. This is not your VPC address — do not open inbound firewall for it.

   Evidence

   https://rora-tunnel.carmel.so/probe/{agent_id}

3. 3

   Tunnel relay

   Carmel

   Relay holds your connector’s WebSocket and forwards each probe. Orchestration only — nodes still originate.

   Evidence

   wss://rora-tunnel.carmel.so/ws/connect

4. 4

   Your connector

   Outbound

   Process you run next to the agent. Dials out with the portal rtun_ token. Must stay running.

   Evidence

   agent-status expose --agent-id … --token rtun_…

5. 5

   Private target

   Your network

   Connector proxies the probe to an HTTP URL only your network can reach.

   Evidence

   --target http://127.0.0.1:8080 (or private IP / hostname)

6. 6

   Your agent

   HTTP

   Any framework behind that URL is fine — it must answer HTTP. No public URL required.

   Evidence

   Private HTTP response → back through the same path