Installing and starting the tunnel

Last reviewed: 16 Sep 2026

The tunnel lets an agent that lives elsewhere (ChatGPT, Claude on the web, Claude Desktop) read and change one folder on your machine, through Naetive. This page is the exact steps; The tunnel explains what it is and how it keeps you safe.

Open source. The program that runs on your machine is in the Naetive repository; read what you are installing.

Before you start

The one-click installer from Connect put the tunnel on your machine and your key where it reads it. You need nothing else. (Windows: the installer sets up the tunnel too.)

Step 1: Start it in the project folder

cd ~/projects/my-project
~/.naetive/start-tunnel.sh

The folder you start it in is the only folder the agent can reach. Prefer to name it explicitly, from anywhere:

~/.naetive/start-tunnel.sh --root=~/projects/my-project --project=my-project

--project is the project's slug (the part after /p/ in the Naetive address bar). Without it, the tunnel reads the pin the export wrote in the repository; if there is none it still runs, says the folder is not tagged, and its work is not filed under a project. The tunnel refuses to serve your home folder or anything above it.

You should see:

Tunnel session created
Connected to Railway tunnel
Tunnel is running! Press Ctrl+C to stop.

Leave the terminal open. Ctrl+C stops it and the agent loses access at once.

Step 2: Ask the agent to use it

In ChatGPT or Claude, open a new chat (or reconnect the connector) and ask it to list the files in the project. The answer should show the files in your folder, and the tool reply carries "_source": "tunnel".

Step 3: See it on Connect

Connect, Local services shows the tunnel as running. Work's Who's here shows the agent while it works.

Several projects

Start one tunnel per project folder, each with its own --project. A call for a project reaches the tunnel serving that project. If two tunnels are open and neither is labelled for the project of a call, the call is refused with a message naming both folders, so an agent never works in the wrong repository.

When Naetive deploys

Naetive restarts several times a day. The tunnel notices, reconnects on its own within seconds, and renews its session if needed. If a call fails in that moment, the agent sees a plain error; the next call works.

If it does not connect

"Unauthorized" when starting: your key changed. Re-run the installer from Connect.
The agent's reply says no tunnel is connected for your account: the tunnel is not running. Start it in the project folder. If it names two folders and refuses, two tunnels are open and neither is tagged for this project: restart the right one with --project.
The agent sees the wrong folder: you started the tunnel elsewhere. Stop it and start it in the project folder.