The tunnel: what it does for you

Last reviewed: 28 Oct 2026

The tunnel is a small program on your computer that gives an agent living elsewhere (ChatGPT, Claude on the web, Claude Desktop) a way to read and change the project folders you shared, through Naetive. Claude Code does not need it; it works on your files directly.

What you get

Share a project once (the checkbox when you create it, or naetive share --project <name> on the computer), and the tunnel starts by itself in the background (on Windows you start it yourself); while it runs that agent can list, read, search and edit the files in the folders you shared. Your files stay on your computer: what the agent asks for travels to it, encrypted, the way pasting it would. Besides that, the connection tells Naetive which computer this is, which projects it shares and their folder paths, so Connect can show them. If you turn commands on, it can also run commands.

How it works

The tunnel opens a connection from your computer out to Naetive and holds it open. When an agent asks Naetive for a file or a command on your project, Naetive passes the request through that connection to the tunnel, which does the work in that project's folder and sends the answer back. Naetive is the relay; the tunnel on your computer is the thing that acts.

The tunnel belongs to the computer, not to a project. It tells Naetive which projects this computer shares, so a call for a project reaches the right computer or is refused by name. It survives Naetive's own deploys, reconnecting within seconds, and the connection is checked every half minute so a dead one is noticed at once. It updates itself.

What makes it safe

• Only what you shared. Each shared project is reachable in its own folder, and nothing else: not the folders around it, not your home folder. A folder that moves or disappears stops being shared; it is never swapped for another. Paths that try to climb out are refused.
• You decide, on the computer. A project is shared only by the checkbox at creation or by naetive share on that computer. A folder's name, or a link made by hand, never shares anything by itself. (naetive link is a label, not access.) naetive shares lists what this computer shares. If the list is changed some other way, Connect warns you.
• Commands are off until you turn them on. A command runs as you: it starts in the project's folder but can reach anything you can, including files outside the project. So commands are a separate permission per computer, held by Naetive rather than a file on the computer: naetive commands on asks, and you confirm in your browser, signed in to Naetive. naetive commands off, or Turn off on Connect, ends it within seconds. The tunnel checks with Naetive every minute; if it cannot get an answer for five minutes, commands are off. When on, privileged commands (as another user, system changes) are still blocked and destructive ones are flagged.
• Your secrets stay out of commands. Commands an agent runs get a short list of safe settings, never the tunnel's own key or other secrets.
• Your key never touches a command line. The launcher reads it from the file the installer wrote.
• A revoked key stops it. If this computer's key is revoked or replaced, the tunnel stops, says so in its window, and shares nothing until you approve the computer again on Connect (or run the install line there). Running commands is off at once too.
• Stop is instant. ~/.naetive/start-tunnel.sh --stop ends the session and the agent's access with it, and it stays stopped until you start it again (on Windows, Ctrl+C in its window). naetive unshare <name> stops sharing one project within seconds.

When not to use it

If you would rather an agent never touched files on your computer, leave the checkbox off and share nothing, so no tunnel runs; the agent can still give you changes to make yourself. Working in a sensitive project? Unshare it, or stop the tunnel.

See also

• Sharing your projects and starting the tunnel, the exact steps
• How to connect, for which agents need it