Skip to main content
The Myrmex software agent follows a Zero Trust model: a device must prove it’s legitimate before it can talk to the platform, and every device is manually approved before it becomes active. Enrollment establishes that trust cryptographically; from then on, all traffic flows over a single encrypted, outbound-only connection.
This page covers the software agent installed on a host — how it enrolls and how it talks to the Myrmex platform.

​
Enrollment

Bringing a device online is a one-time handshake that ends with a manual approval you control:
1

Install with a temporary token

The installer carries a 24-hour installation token. The token is reusable within that window — one token can onboard many hosts — but it expires afterward, so a leaked installer can’t be used later. See Deploying the agent for the flow.
2

Generate a key pair

On first run, the agent generates an RSA 4096-bit key pair locally. The private key never leaves the device — it stays in a file with restricted permissions — and the public key is sent to the platform for registration.
3

Register and prove identity

The platform validates the token, registers the public key, and issues the device a unique ID. The agent then signs with its private key to prove it holds the key that matches the registered public key.
4

Establish a session key

The platform issues an AES-256-GCM session key, encrypted to the device’s public key so only that device can decrypt it. This key protects the data the agent sends.
5

Approve the device

A newly enrolled device appears as unauthorized and reports nothing until you approve it. This manual gate means a device only becomes active once you say so — approve it from its detail view.

​
Cryptography

RSA 4096-bit

Asymmetric keys establish and prove each device’s identity during enrollment. Their strength rests on how hard it is to factor large numbers, and 4096 bits keeps that margin as computing power grows.

AES-256-GCM

A symmetric session key encrypts the data the agent sends, with integrity and authentication built in.

TLS

All traffic is carried inside a TLS transport, so even the encrypted payload is wrapped in a secure channel.
To keep sessions strong over time, the platform can request key rotation (rekeying), and TLS session keys are not reused — even if one layer were compromised, the data stays protected by the layer beneath it.

​
Transport

Once enrolled and approved, the agent maintains a persistent, outbound-only encrypted connection to the platform over TLS. The agent always initiates the connection outward on 443 — nothing connects in to the host — and both telemetry and the commands the AI agents send flow over that single channel.
For the full network and firewall model — destinations, ports, SSL-inspection bypass, and outbound-link handling — see Collector mode. The same outbound-only pattern applies to agents in endpoint mode.

​
Where to Go Next

Deploying the agent

Get an installation token and onboard a host.

Agent architecture

The collect → enrich → respond model behind the agent.