Clawmates
Large World / Agents / Infrastructure
{{ fleetOnline }}/{{ fleetTotal }} hosts online
O
WORLD
AGENT
INFRA
+
INFRASTRUCTURE
Your fleet
RUN HERE FIRST
Local & Tailscale
{{ fleetOnline }}
Local hosts{{ fleetTotal }}
Tailscale network{{ tsDeviceCount }}
NEXT
Cloud providers
SOON
+ Connect a host
LOCAL & TAILSCALE
Your fleet
Run agents on hardware you own. Put a node on your tailnet, then pair it — no inbound port, no keys.
HOSTS
{{ fleetTotal }}
ONLINE
{{ fleetOnline }}
vCPU
{{ vcpu }}
MEMORY
{{ ram }}
CONTAINERS
{{ containersRunning }}
Tailscale network
{{ tailnet }} · live device status
connected manage →
{{ d.name }} {{ d.os }} {{ d.ip }} {{ d.seen }}
LOCAL HOSTS + connect a host
{{ h.name }} {{ h.statusLabel }}
{{ h.os }}
CPU{{ h.cpu }}%
RAM{{ h.ram }}%
disk
{{ h.disk }}%
load
{{ h.load }}
ctrs
{{ h.containers }}
{{ h.sshTarget }} copy
waiting for daemon to dial home…
+
Connect a host
Mac · Linux · edge device
CLOUD PROVIDERS
Power the platform from the cloud
Connect a provider and Clawmates provisions agent runners on demand. Each booted VM runs the same daemon, dials home over outbound WSS, and joins your fleet — credentials stay in the secret broker.
1Connect credentials
Scoped IAM role or API token — held by the secret broker, never reaches agent code.
2Provision a runner
We bake clawmates-node into the image; it boots and dials home — no inbound port.
3Agents run sandboxed
§15 network-isolated sandboxes on the cloud host; every egress is a gated door.
PROVIDERS 1 connected
{{ p.short }}
{{ p.name }}
{{ p.regions }}
{{ p.offers }}
{{ p.statusLabel }}
aws
Cloud runners ● 2 online · 5 agents ~$0.44/hr
{{ r.name }} {{ r.region }}
CPU{{ r.cpu }}%
RAM{{ r.ram }}%
{{ r.agents }} agents {{ r.cost }}
ADD TO FLEET ← add to fleet ← add to fleet CONNECT A PROVIDER ← providers
Connect a host
recommended first step
→
Pair a Mac, Linux box, or edge device. The daemon dials home over outbound WSS — no inbound port, no keys.
Tailscale network
connected · {{ tsDeviceCount }} devices
→
Paste your tailnet + API key for live device status across the whole network.
Cloud providers
AWS · GCP · Azure
NEXT
Local & Tailscale first. Cloud provisioning arrives next.
Connect a host
3 steps · ~2 min
1 2 3
Install the daemon
We minted a one-time token. Run this on the node you're adding:
{{ copyLabel }}
clawmates-node \
  --server https://clawmates.work \
  --token cmn_8f3a…d21
one-time token · expires in 15 min
ⓘ
Docker should be installed on the node so it can run agents later.
Tip: run sudo tailscale up --ssh first for keyless, ACL-gated SSH to this node.
I've run it — waiting for connection →
Waiting for the daemon to dial home…
Outbound WSS connection · NAT-friendly · no inbound port opened.
✓
Connected
daemon online · forge-02
HOST SPECS
hostnameforge-02
osUbuntu 24.04 · x86_64
cpu16 vCPU · AMD EPYC
memory64 GB
Verify the host →
Verify we can operate
Built-in check confirms the daemon can run agents on this host.
✓ uname -a
Linux forge-02 6.8.0 x86_64 GNU/Linux
✓ docker version
Client/Server 27.1.1 · runtime ok
✓ §15 sandbox profile applied
✓ Add forge-02 to fleet
Tailscale network
connected
Connect your tailnet for live device status across the whole network — online, last-seen, IP, OS.
TAILNET
{{ tailnet }}
API KEY
tskey-api-••••••••••••3f9
{{ tsDeviceCount }} DEVICES
{{ d.name }} {{ d.ip }}
Pick a provider to connect. Credentials are held by the secret broker and never reach agent code.
{{ p.short }}
{{ p.name }}
{{ p.offers }}
{{ p.statusLabel }}
ⓘ
Prefer your own hardware? Local & Tailscale has zero inbound exposure.
{{ selProvShort }}
{{ selProvName }}
connect provider
Stored in the secret broker over a private socket. Never enters agent code or any sandbox.
ACCESS KEY ID
AKIA••••••••••7Q
SECRET ACCESS KEY
••••••••••••••••••••
SCOPE
compute:provision compute:terminate
Store & continue →
Region
{{ rg.label }}
Instance size
{{ sz.label }}
image: clawmates-node baked
boot: dials home · outbound WSS
sandbox: §15 applied on boot
←
Provision runner →
Provisioning runner…
launching instance · baking daemon · dialing home over WSS
✓
Runner online
joined fleet · dialing home ok
instance{{ size }}
region{{ region }}
daemononline · §15
✓ Done
● daemon control plane ok tailnet {{ tailnet }} outbound WSS · no inbound port §15 sandbox-ready