Your iPhone, your Mac and your agent's machine, on one VPN

This guide puts all three on one Portveil account: your iPhone and Mac through the free WireGuard app, and the Linux machine your AI agent runs on through the Portveil agent, so the agent's location can be switched from the dashboard, the API, or an AI assistant like Hermes.

Before you start

• A Portveil plan or an early-access invite. After checkout we email a one-time setup link. Plans start at $7/month.
• Your account ID and account key from the setup page. Keep the key in your password manager: it's how you add devices.

1. iPhone

1. Install the free WireGuard app from the App Store.
2. On portveil.com/start, choose Phone or computer, name the device and create it. Its private key is made in your browser; Portveil never sees it.
3. In WireGuard, tap Add a tunnel → Create from QR code and scan both codes, one for the United States and one for Finland.
4. Turn one tunnel on. To switch countries, turn it off and the other one on.

2. Mac

1. Install WireGuard from the Mac App Store.
2. Create the device on the setup page the same way, and download both tunnel files.
3. In WireGuard, choose Import tunnel(s) from file and pick the files. Switch countries the same way as on the iPhone.

The tunnel files contain the device's private key. Don't share them. If you lose them, delete the device in your dashboard and create it again.

3. Your agent's machine (Linux)

This is the machine your AI agent runs on: a VPS, a home server, or the box running Hermes Agent. Run as root:

apt install -y wireguard-tools curl
curl -fsSLO https://portveil.com/downloads/portveil-agent
sha256sum portveil-agent   # compare with portveil.com/downloads/portveil-agent.sha256
chmod +x portveil-agent
export PORTVEIL_ACCOUNT_TOKEN='<your account key>'
./portveil-agent register --control https://api.portveil.com \
  --account-id acct_… --name agent-box --split-tunnel
./portveil-agent daemon

Keep --split-tunnel on remote servers so your SSH session keeps working. The dashboard marks the machine as protected only once the exit server confirms it sees its tunnel.

4. Let your AI assistant switch it

1. In the dashboard, create an API token with control scope. Never give an assistant your account key.
2. Add the Portveil MCP server to your assistant. For Hermes Agent:

   hermes mcp add portveil --command npx \
     --env PORTVEIL_ACCOUNT_ID=acct_… PORTVEIL_TOKEN=clt_… \
     --args -y portveil-mcp

   For Claude Code: claude mcp add portveil -e PORTVEIL_ACCOUNT_ID=acct_… -e PORTVEIL_TOKEN=clt_… -- npx -y portveil-mcp
3. Ask it: "Move agent-box to Finland." It reports success only after the machine has switched and the Finland exit confirms it, and the move is logged with the token that made it.

Questions