The tunnel: what it does for you
Last reviewed: 16 Sep 2026
The tunnel is a small program on your machine that gives an agent living elsewhere (ChatGPT, Claude on the web, Claude Desktop) a way to read and change one folder on your computer, through Naetive. Claude Code does not need it; it works on your files directly.
What you get
Start it in a project folder and, while it runs, that agent can list, read, search and edit the files there and run commands there. What it reads travels to the agent the way pasting it would; nothing leaves your machine that the agent did not ask for, and nothing outside that folder is reachable.
| Without the tunnel | With the tunnel | |
|---|---|---|
| The agent reads and writes the understanding and the work | Yes | Yes |
| The agent reads and edits files in the project folder | No | Yes |
| The agent runs commands in the project folder | No | Yes, with the guards below |
| The agent's work shows on Work | Its calls | Its calls, commands and files |
How it works
The tunnel opens a connection from your machine out to Naetive and keeps it open. When an agent asks Naetive for a file or a command on your project, Naetive passes the request through that connection to the tunnel, which does the work in the folder and sends the answer back. Naetive is the relay; the tunnel on your machine is the thing that acts.
Since September the tunnel tells Naetive which project and which folder it serves, so a call for a project reaches the tunnel for that project or is refused by name; it survives Naetive's own deploys, reconnecting within seconds; and Naetive pings it every half minute so a dead connection is noticed at once.
What keeps you safe
- One folder. The folder you start it in is the boundary. Paths that try to climb out are refused, and the tunnel will not serve your home folder or anything above it.
- Commands are classified. Read-only commands run. Commands that delete or rewrite history are flagged as destructive in the reply the agent sees, and run; privileged ones (anything as another user, system changes) are blocked outright. Nothing pauses for your approval, so start the tunnel only in a folder you are happy for an agent to change.
- Your key never touches a command line. The launcher reads it from the file the installer wrote.
- Stop is instant. Ctrl+C ends the session and the agent's access with it. Regenerating your key stops any new session; a tunnel already running keeps its own session until you stop it or it expires within half an hour, so stop the tunnel too.
- It keeps little. A small file under
~/.naetiveremembers the session, the folder and the project so it can reconnect; run as a background service it also keeps a process id and a log.
When not to use it
If you would rather an agent never ran commands on your machine, do not start it; the agent can still give you commands to run yourself. Working in a sensitive folder? Stop it, or start it in a scratch folder.
See also
- Installing and starting the tunnel, the exact steps
- How to connect, for which agents need it