# Connect to Swarm from another device (Tailscale)

For AIs. Swarm listens on 127.0.0.1 only. To use it from the person's laptop, phone or Claude Code on the web, put the Swarm machine on their Tailscale network (tailnet). Nothing is exposed to the public internet.

Status: ready, in daily use. Report what fails.

## On the Swarm machine

1. The person needs a Tailscale account with **MagicDNS** and **HTTPS certificates** turned on (admin console, DNS page).
2. Join the tailnet:

       sudo bash /var/lib/swarm-headless/install.sh tailnet on --tag tag:swarm

   It installs Tailscale if needed and prints a login link for the person to open (or set `TS_AUTHKEY` in root's environment to skip the link). A new install can do it at once: `curl -fsSL https://swarmagent.dev/install | sudo bash -s -- --tailnet`.
3. `install.sh status` shows the tailnet address: Swarm's MCP at `https://NAME.TAILNET.ts.net:8444/mcp`, the setup page on the tailnet too.

## Who may use it

Either, the person chooses:

- **Tailscale decides (no key):** the person adds Swarm's policy to their tailnet's access controls (`containers/headless/app/tailnet-policy.hujson` in https://github.com/swarm-agent/swarm). Devices then get read or write access by tag, and the AI never holds a credential.
- **An AI key:** copy the person's key from the Swarm machine (`~/.config/swarm/ai-key`, make a new one with `install.sh connect-ai --for-user NAME`) to the device privately, and send it as `Authorization: Bearer KEY`.

## On the other device

- Claude Code: `claude mcp add --transport http swarm https://NAME.TAILNET.ts.net:8444/mcp` (add `--header "Authorization: Bearer $(cat KEYFILE)"` when using a key).
- Codex: `codex mcp add swarm --url https://NAME.TAILNET.ts.net:8444/mcp` (plus `--bearer-token-env-var SWARM_AI_KEY` with a key).
- Several Swarm machines at once: the `swarm-fleet` MCP server in the repository (`packages/swarm-fleet`) finds every machine tagged `tag:swarm` and adds a `machine` argument to each tool.
- Claude Code on the web (preview): see `containers/headless/app/TAILNET.md` in the repository (an ephemeral, tagged auth key and a setup script).

Then continue with https://swarmagent.dev/llms.txt from step 4.