A dynamic private subnet for your team — end-to-end encrypted, live, and scoped project by project. Your ports, your databases, your machines: reachable by your team and your agents, and by nobody else.
curl -fsSL https://n3t.ai/install.sh | bashBoth machines open the connection themselves, so there is never an inbound flow for a firewall to block — and no agent ever accepts a connection from outside the mesh. When a direct path between two machines is possible it forms on its own; when it fails, a relay carries the traffic, and the difference stays invisible.
n3t mcp install --client claude-code registers a local MCP server.
Claude Code starts n3t mcp over stdio on your laptop. That process
talks to n3t-agent on a Unix socket. The password, the DSN, and
any .env stay off that path.
Stored as file:/path or env:VAR, never in the signed state, never on the laptop that asked. n3t-agent there opens Postgres. Claude gets rows, not a DSN. A client-side .env is exactly the file an agent reads without asking.
Queries ride the same private subnet as your teammates (100.64), end-to-end encrypted. Nothing is opened inbound. If the service type is unknown, agents are denied — a guessed port is not a database.
A Claude Code session in a repo with .n3t only sees that project. Staging does not see prod. The agent inherits membership, read-only, and every query is in the log.
We do not parse SQL. n3t setup postgres prints a role with default_transaction_read_only. Writes die in the engine. That is stronger than a regex on DELETE.
A VPN answers one question: is this person allowed on the network. Once they are in, they can reach everything the network routes — and nobody holds the list of what that is.
| TRADITIONAL VPN | n3t | |
|---|---|---|
| SCOPE | You are in the tunnel, so you can reach everything routed on the other side. | Only the targets of the projects you belong to. One port at a time. |
| GRANT / REVOKE | A ticket, a firewall rule, SSH keys that stay. | n3t share, n3t invite, n3t revoke — including live sessions. |
| CREDENTIALS | Connection strings copied onto laptops. | The secret never leaves the exposing machine. The agent gets a handle, not a password. |
| AI AGENTS | The agent inherits your whole tunnel, plus your files. | It inherits the project it runs in, read-only, and every query is in the log. |
| Command | What it does |
|---|---|
curl -fsSL https://n3t.ai/install.sh | bash | Installs n3t and n3t-agent (macOS/Linux). Windows: irm https://n3t.ai/install.ps1 | iex. |
n3t login | Starts the agent, keeps it at boot, opens Google. Email is the identity. --force to switch account. |
n3t status · n3t version · n3t rollback | Mesh, machines, exit proxies, update state. Rollback restores agent N-1. |
n3t create ringover | Creates your workspace. You are the first member. |
n3t members · n3t invite · n3t revoke | Who is in. Invite adds them to every share. Revoke kills open sessions. |
n3t use ringover | Sets the workspace so you can omit it. Also a .n3t file in the repo. n3t use --clear. |
n3t ports | Local listeners, type detected. You pick what to expose. |
n3t share 5432 | LAN on the mesh: http://machine.ringover.n3t.ai:5432 in a normal browser. unshare to stop. share all relays Bonjour. |
n3t ls | Shared (mesh) and internet catalog, per workspace. Filter matches name, machine, kind. |
n3t routes | Mesh routes like ip route. n3t route add 8.8.8.8 --via machine / route del via an exit proxy. |
n3t sock 1080 · n3t proxy 8080 | Exit proxy on the mesh: SOCKS5 or HTTP/HTTPS CONNECT. Other machines use this host to get out. |
n3t publish 3000 | Internet, HTTP by default. --udp for a dedicated public port. Separate from share, so a database never goes public on a typo. unpublish to stop. |
n3t file ./dist · n3t get · n3t chat | Ephemeral file or folder (10 min), claim with get --list / --id. Chat is live, no history. |
n3t mcp · n3t mcp install · n3t setup postgres | Claude Code / Cursor see the schema, never the password. |
$ curl -fsSL https://n3t.ai/install.sh | bash $ n3t login ✓ ludx@eternite.org · the agent joins the mesh projects: eternite $ n3t ports process bind port kind shared note postgres 127.0.0.1 5432 postgres Ringover 0.0.0.0 3000 http listening on all interfaces $ n3t share 3000 sharing http://macbook-ludo.eternite.n3t.ai:3000 http · web $ n3t sock 1080 sharing macbook-ludo.eternite.n3t.ai:1080 socks · exit proxy other machines: SOCKS5 macbook-ludo.eternite.n3t.ai:1080 $ n3t proxy 8080 sharing macbook-ludo.eternite.n3t.ai:8080 http-proxy · exit proxy other machines: HTTP/HTTPS proxy macbook-ludo.eternite.n3t.ai:8080 $ n3t file ./dump.sql ✓ offered dump.sql (482193 bytes) for 10 minutes id 8f2c1a9e from ludx@macbook-ludo/eternite announced to 4 machines $ n3t get --list 8f2c1a9e ludx@macbook-ludo/eternite file dump.sql 482193 bytes $ n3t get --id 8f2c1a9e ✓ received /Users/kev/dump.sql $ n3t ls eternite.n3t.ai shared ├─ api-1.eternite.n3t.ai:8080 http deploy@api-1 web ├─ db-prod.eternite.n3t.ai:5432 postgres deploy@db-prod database ├─ kev-mbp.eternite.n3t.ai:5173 http kev@kev-mbp web ├─ macbook-ludo.eternite.n3t.ai:1080 socks ludx@macbook-ludo exit proxy ├─ macbook-ludo.eternite.n3t.ai:3000 http ludx@macbook-ludo web ├─ macbook-ludo.eternite.n3t.ai:8080 http-proxy ludx@macbook-ludo exit proxy └─ studio.eternite.n3t.ai:3000 http lea@studio web
Open source. Agent Apache-2.0, server AGPL. The spec ships with the repo.