What AgentOfMe Protects
AgentOfMe protects a single OpenClaw management entrypoint, not arbitrary localhost services.
AgentOfMe is designed for cloud-deployed OpenClaw instances. The protected target is the OpenClaw management or Control UI HTTPS access path.
Ingress model
An ingress is the smallest protection boundary and an Organization quota item. Billing belongs to the Organization plan, not to an individual ingress.
Each ingress maps to:
- one domain
- one local upstream port
- one protected OpenClaw management entrypoint
This keeps the authorization, certificate, and runtime model predictable.
Not a tunnel
AgentOfMe does not create NAT traversal, relay traffic, or expose arbitrary localhost services to the internet.
If the server cannot receive public traffic for the ingress domain, AgentOfMe does not try to bypass that networking boundary.
Access methods
Browser users authenticate through the AgentOfMe login flow. Machine clients can use Ingress Access Tokens for approved scripted access paths.