Agent Device Cloud
Sign in

Device connector

Install and pair

The installer verifies a platform archive, preserves existing identity during upgrades and starts a user service.

macOS / Linux
curl -fsSL https://devices.example.com/install.sh | sh -s -- \
  --url https://devices.example.com --code 'PAIRING_CODE'
Windows PowerShell
[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
$p=Join-Path $env:TEMP 'adc-install.ps1'
Invoke-WebRequest -UseBasicParsing -Uri 'https://devices.example.com/install.ps1' -OutFile $p
& "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File $p `
  -Url 'https://devices.example.com' -Code 'PAIRING_CODE'

What pairing creates

  1. 01

    Verify the release

    The installer selects the platform archive and verifies its committed SHA-256 digest before extraction.

  2. 02

    Create a device identity

    The Connector creates an Ed25519 key locally and exchanges the one-time pairing code for a device ID.

  3. 03

    Start the user service

    launchd on macOS, systemd --user on Linux or a current-user Scheduled Task on Windows keeps the outbound connection available after terminal exit.

Access modes

  • noneNo access exposes no folders.
  • selectedSelected folders exposes only explicitly added paths.
  • homeHome directory exposes the connector user's home.
  • fullFull device trust exposes the filesystem using the connector user's OS permissions. On Windows it covers the user's system drive.

Full access is not a sandbox. Prefer selected folders for ordinary Agent work and use a dedicated OS account for higher-risk automation.

Lifecycle commands

adc-node
adc-node status
adc-node roots add "/path/to/workspace" --label Workspace
adc-node roots list
adc-node mcp list
adc-node access home
adc-node access full
adc-node access none
adc-node logs
adc-node restart
adc update --check
adc update
adc-node rotate-key
adc-node uninstall

Changes to access and folders reload automatically. Removing access cancels affected running work.

Connection and recovery

The Connector opens an authenticated outbound WebSocket for wake signals. A wake carries no task payload; it triggers the signed poll endpoint, which claims durable work from PostgreSQL. Reconnect performs an immediate poll and a 30-second fallback covers lost signals.

  • Sleep or network loss pauses availability; reconnect is automatic.
  • An active task renews a bounded lease and stops when authorization is lost.
  • Capabilities and local configuration reload without re-pairing.

Upgrade or retire a device

adc
adc update --check
adc update
adc-node status
adc-node unpair --confirm <NODE_ID>
adc-node uninstall

Updates preserve pairing, exposed folders and durable receipts. Deleting a device in the console revokes its server identity; unpair locally before enrolling the same machine as a new device.

Local MCP Providers

The Connector can discover tools from local stdio or Streamable HTTP MCP servers. Provider credentials remain in the local device configuration; registering a Provider does not grant Agent access.

adc-node
adc-node mcp add github --name GitHub --stdio npx \
  --args '["-y","@modelcontextprotocol/server-github"]' \
  --env-file ~/.config/adc/github-mcp-env.json

adc-node mcp add internal --name Internal \
  --http https://mcp.internal.example/api \
  --headers-file ~/.config/adc/internal-mcp-headers.json

adc-node mcp list
adc-node mcp remove github

Use the same Provider ID on multiple devices to aggregate an identical tool. Schema changes create a new tool ID, and every dynamic tool requires explicit authorization, a target device and an idempotency key.