Skip to main content
The Myrmex software agent follows a Zero Trust model: a device must prove it’s legitimate before it can talk to the platform, and every device is manually approved before it becomes active. Enrollment establishes that trust cryptographically; from then on, all traffic flows over a single encrypted, outbound-only connection.
This page covers the software agent installed on a host — how it enrolls and how it talks to the Myrmex platform.

​
Enrollment

Bringing a device online is a one-time handshake that ends with a manual approval you control:
1

Install with a temporary token

The installer carries a 24-hour installation token. The token is reusable within that window — one token can onboard many hosts — but it expires afterward, so a leaked installer can’t be used later. See Deploying the agent for the flow.
2

Generate a key pair

On first run, the agent generates an RSA 4096-bit key pair locally. The private key never leaves the device; the public key is sent to the platform for registration.
3

Register and prove identity

The platform validates the token, registers the public key, and issues the device a unique ID. The agent then signs with its private key to prove it holds the key that matches the registered public key.
4

Establish a session key

The platform issues an AES-256-GCM session key, encrypted to the device’s public key so only that device can decrypt it. This key protects the data the agent sends.
5

Approve the device

A newly enrolled device appears as unauthorized and reports nothing until you approve it. This manual gate means a device only becomes active once you say so — approve it from its detail view.

​
Cryptography

RSA 4096-bit

Asymmetric keys establish and prove each device’s identity during enrollment.

AES-256-GCM

A symmetric session key encrypts the data the agent sends, with integrity and authentication built in.

TLS

All traffic is carried inside a TLS transport, so even the encrypted payload is wrapped in a secure channel.
To keep sessions strong over time, the platform can request key rotation (rekeying), and TLS session keys are not reused — even if one layer were compromised, the data stays protected by the layer beneath it.

​
Transport

Once enrolled and approved, the agent maintains a persistent, outbound-only encrypted connection to the platform over TLS. The agent always initiates the connection outward on 443 — nothing connects in to the host — and both telemetry and the commands the AI agents send flow over that single channel.
For the full network and firewall model — destinations, ports, SSL-inspection bypass, and outbound-link handling — see Collector mode. The same outbound-only pattern applies to agents in endpoint mode.

​
Where to Go Next

Deploying the agent

Get an installation token and onboard a host.

Agent architecture

The collect → enrich → respond model behind the agent.