> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Communication & Security

> How the Myrmex software agent enrolls and communicates: cryptographic enrollment (RSA 4096, AES-256-GCM, TLS), a 24-hour installation token, a manual approval gate, and a persistent outbound-only encrypted connection.

import { CardGroup, Card, Note, Steps, Step, Tip } from '@mintlify/components';

The Myrmex **software agent** follows a Zero Trust model: a device must prove it's legitimate before it can talk to the platform, and every device is manually approved before it becomes active. Enrollment establishes that trust cryptographically; from then on, all traffic flows over a single encrypted, outbound-only connection.

<Note>
  This page covers the **software agent** installed on a host — how it enrolls
  and how it talks to the Myrmex platform.
</Note>

## Enrollment

Bringing a device online is a one-time handshake that ends with a manual approval you control:

<Steps>
  <Step title="Install with a temporary token">
    The installer carries a **24-hour installation token**. The token is reusable
    within that window — one token can onboard many hosts — but it expires
    afterward, so a leaked installer can't be used later. See
    [Deploying the agent](/documentation/agent-endpoint-security/installation) for
    the flow.
  </Step>

  <Step title="Generate a key pair">
    On first run, the agent generates an **RSA 4096-bit** key pair locally. The
    private key never leaves the device; the public key is sent to the platform
    for registration.
  </Step>

  <Step title="Register and prove identity">
    The platform validates the token, registers the public key, and issues the
    device a unique ID. The agent then signs with its private key to prove it
    holds the key that matches the registered public key.
  </Step>

  <Step title="Establish a session key">
    The platform issues an **AES-256-GCM** session key, encrypted to the device's
    public key so only that device can decrypt it. This key protects the data the
    agent sends.
  </Step>

  <Step title="Approve the device">
    A newly enrolled device appears as **unauthorized** and reports nothing until
    you approve it. This manual gate means a device only becomes active once you
    say so — approve it from its
    [detail view](/documentation/agent-endpoint-security/device-details).
  </Step>
</Steps>

## Cryptography

<CardGroup cols={3}>
  <Card title="RSA 4096-bit" icon="key">
    Asymmetric keys establish and prove each device's identity during enrollment.
  </Card>

  <Card title="AES-256-GCM" icon="lock">
    A symmetric session key encrypts the data the agent sends, with integrity and
    authentication built in.
  </Card>

  <Card title="TLS" icon="shield-halved">
    All traffic is carried inside a TLS transport, so even the encrypted payload
    is wrapped in a secure channel.
  </Card>
</CardGroup>

To keep sessions strong over time, the platform can request **key rotation (rekeying)**, and TLS session keys are not reused — even if one layer were compromised, the data stays protected by the layer beneath it.

## Transport

Once enrolled and approved, the agent maintains a **persistent, outbound-only encrypted connection** to the platform over TLS. The agent always **initiates** the connection outward on 443 — nothing connects *in* to the host — and both telemetry and the commands the AI agents send flow over that single channel.

<Tip>
  For the full network and firewall model — destinations, ports, SSL-inspection
  bypass, and outbound-link handling — see [Collector
  mode](/documentation/agent-endpoint-security/collector-mode#communication-architecture).
  The same outbound-only pattern applies to agents in endpoint mode.
</Tip>

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Deploying the agent" icon="download" href="/documentation/agent-endpoint-security/installation">
    Get an installation token and onboard a host.
  </Card>

  <Card title="Agent architecture" icon="sitemap" href="/documentation/agent-endpoint-security/architecture">
    The collect → enrich → respond model behind the agent.
  </Card>
</CardGroup>