Secure private networking and remote access

VPNs should be
as simple as SSH

For Agents and users alike. One binary turns your machines (laptop, server, cloud, or a Pi) into a private network you and your Agents can reach, run commands on, and search from anywhere. Just install, invite, connect.

Get Started How It Works Source on GitHub
$ curl -fsSL https://wirehop.org/install.sh | bash
macOS (Apple Silicon & Intel) · Linux (x86_64, ARM64, ARMv7)

WireHop is a tool, not a service. There is no company between you and your machines, and that includes us: nothing to sign up for, nothing that can be shut off. It is fully open source under MIT or Apache-2.0, so you can read every line, fork it, or ship it inside your own product.

Why WireHop?

Reach your machines, keep your keys, and let your Agents do the work.

No third party, ever

Your machines connect directly and privately, end-to-end encrypted. There is no coordination server to phone home to and no third party in your trust path. Your keys are generated on your machines and never leave them.

Works anywhere, one binary

One small download, no dependencies, no config. Punches through any NAT automatically, home, cloud, or a Raspberry Pi. Install, invite, connect, in under a minute.

Agent-ready today

Add one skill and your AI tools can reach, run commands on, and search across every machine, inside the limits you set. No integration to build, and nothing central to breach.

Also built in: encrypted file transfer, sessions that survive disconnects, secrets, and scheduled automation, with deeper tooling for fleet management, AI orchestration, and session audit (tap).

How WireHop compares

No accounts, no port forwarding, no third-party routing.

WireHop
SSH / Tailscale / ngrok
Third party in the middle
None: nothing to sign up for
Tailscale needs its coordinator; ngrok its servers
Account required
No
Tailscale, ngrok require accounts
Setup
One command, under a minute
VPN config, daemon, signup
Works through NAT
Automatically, anywhere
SSH needs port-forwarding
Private network
Built in
Tailscale only (separate tool)
Usable by AI agents
Yes: one skill, works today
None

Install, invite, connect

Up and running in under a minute. No accounts, no servers, no VPN config.

1 · Install

Run one command on the machine you want to reach. It installs WireHop and prints a one-time invite.

2 · Invite

Share the invite, or use it yourself. It's single-use and time-limited, and its role decides exactly what the new member can reach.

3 · Connect

Redeem it from your laptop with hop connect and you're in a secure shell. After that, it's just hop <name>.

Terminal
# On your server $ hop host Listening... Node ID: 5f4a8c... # Generate an invite $ hop invite Invite token: eyJ0eX... # On your laptop, first time, use the invite token $ hop connect eyJ0eX... Saved as known host: server # After that, just use the name $ hop server server $ _ # Run a command without opening a shell $ hop server -- ps aux # Copy files over the same encrypted connection $ hop cp -r ./project server:~/project

Let your Agents work on real machines

Your Agents can already reason and call tools. What they can't do is reach the machines you actually run. Add the WireHop skill and they can, within limits you set.

One skill, your whole fleet

Give your AI tool the WireHop skill and it can reach every machine on your network, run a command across all of them at once, and search their logs together, in plain language, inside the limits you set. It works today, over the same install, invite, connect you just saw. Nothing to wire up.

  • Works right now: no integration project, no API to build
  • Reaches any machine and runs commands across the whole fleet at once
  • Stays inside the limits you set, so it can't touch what you haven't allowed
  • No third-party service in the loop to breach or lock you in
See how it connects to your AI tools →
Your AI tool
# Add the WireHop skill to your agent, that's it $ hop mcp # Now, in plain language: "restart the API on every production box, and show me any errors from the last hour" → runs it across all production machines → searches every machine's logs, together → stops at whatever your rules don't allow

Your own private network, when you need it

WireHop also gives you a peer-to-peer private network. Setting up a VPN should be as easy as SSH or scp, so it is.

A WireHop warren: your machines connected peer-to-peer Three machines (a laptop, a server, and a Raspberry Pi) reach each other by name over direct encrypted peer-to-peer links with no central server. The Pi bridges a home LAN (printer and NAS) that cannot run WireHop. Your warren Your machines, reachable by name from anywhere. Peer-to-peer, no central server. ๐Ÿ”’ E2E laptop laptop.hop you ยท owner myserver myserver.hop always-on host pi pi.hop bridges the LAN โ†“ Home LAN ยท 192.168.1.0/24 devices that can't run hop, reached through pi printer .1.50 NAS .1.60 encrypted P2P link LAN bridge

Your machines, reachable by name

Invite a machine and it answers by name (myserver.hop) on a private address only your machines can reach, from anywhere. No port-forwarding, no VPN appliance, no coordination server in someone else's cloud. The tools you already use (SSH, scp, VNC) just work.

You can also bridge devices that can't run WireHop (a printer, a NAS, a whole home or office LAN) through one machine that's on it, or forward a remote port to your laptop like ssh -L. See the docs →

Terminal
# On a machine that's on your warren: make an invite $ hop invite Invite: eyJ0eX... # On the new machine: join with it $ hop connect eyJ0eX... Joined. You are 100.64.3.12 (laptop.hop) # Now your machines answer by hostname, from anywhere $ ssh myserver.hop $ scp report.pdf myserver.hop:~ $ open vnc://myserver.hop

Install

One command to download, verify, and install.

Build your install command

$ curl -fsSL https://wirehop.org/install.sh | bash
Advanced options

Client: reach hosts you're invited to, no sudo, no daemon, no VPN. Upgrade to the warren VPN anytime with hop connect <invite>.

Supported Platforms

💻
macOS
Apple Silicon (arm64) & Intel (x86_64)
🐧
Linux
x86_64, ARM64 & ARMv7