How an AI agent reaches a computer behind NAT

The cloud agent cannot simply dial your laptop

Home routers, office firewalls and mobile networks commonly prevent unsolicited inbound connections. A cloud agent may have a shell in its own environment, but that shell cannot read a file on your private laptop merely because both machines are online. Some connection mechanism must bridge the two environments.

Options include a VPN, an SSH entry point, a local agent or an outbound connector. ADC chooses the last approach: the target device starts TLS connections to a known service, and the agent submits authorized tool requests to that service. No public inbound port is required on the target device.

Outbound access is still a real requirement. A network that blocks the service, TLS or WebSocket upgrades can prevent or delay delivery. This architecture is not a way around every firewall and does not expose a general network tunnel.

Trace one file read

The agent submits file.read with a target and path. The service checks the caller's access and stores a durable invocation. An authenticated outbound WebSocket can notify the Connector that work is available. The signal is dispatch.available; it contains no command, file path or authorization decision.

The Connector then uses signed HTTPS polling to claim the task. In PostgreSQL deployments, dispatch claiming is atomic. The device validates the request and reads the file locally, then reports the result. The caller follows the same jobId. Duplicate wake signals do not mean duplicate tool requests.

Separating the notification from stored task state lets a missed wake be recovered without losing the invocation. It also keeps an open WebSocket from becoming the authority for execution: the signed request path and durable task state still decide what work is available.

Reachability and authority are separate

Connectivity only makes delivery possible. The account must own the device or hold valid shared access; the Agent grant, device policy, selected folders and live capabilities must all allow the request. The Connector validates local scope again before execution. A broad cloud grant cannot open a locally unexposed folder.

The device private key stays local, but requested arguments and results pass through the control plane. TLS protects transport; it does not make tool data end-to-end encrypted between the agent and device. Choose an official or self-hosted service according to who may process those requests and results.

Expect sleep, restart and packet loss

A sleeping laptop cannot execute tasks. After connectivity returns, the Connector reconnects with backoff, polls immediately, and uses a slower 30-second fallback poll when wake delivery is unavailable. Pending work must still satisfy its original deadline and current authorization; reconnecting does not renew the task's lifetime.

If a command ran before the connection dropped, follow the original task and inspect its receipt. A missing response can mean unknown outcome, not a command that never ran. ADC's current tool path uses the service for dispatch and results; this article does not describe an implemented peer-to-peer data path.