PortA VPN built for AI agents
Your agents browse, call APIs and scrape from machines you don't sit in front of. Portveil puts each of those machines on a WireGuard VPN you can steer from code: pick the country an agent's traffic comes from, switch it with one API call, and see which machines are actually protected.
Why a normal VPN doesn't fit agents
- Consumer VPNs are built for a person clicking a button. Agents need an API, not an app.
- Servers get cut off. A full-tunnel VPN on a remote box also carries your SSH session's replies and locks you out. Portveil's agent has a split-tunnel mode for exactly this.
- "Connected" isn't proof. Portveil only shows a device as protected when the exit server confirms it sees that device's tunnel.
How it works
- Install the Portveil agent on each Linux machine your agents run on. It registers with your account and keeps its tunnel up.
- Create a scoped API token in the dashboard: read to look, control to move devices. Never hand an agent your account key.
- Move machines between countries from the dashboard, the REST API, or an AI assistant through the Portveil MCP server. Every move is logged with the token that made it.
Switch an agent's location with one call
# move an agent's machine to Finland
API=https://api.portveil.com/v1/accounts/$ACCT
curl -X POST "$API/devices/$DEV/commands" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"type":"switch_server",
"server_id":"srv-eu-1"}'The device picks the command up within seconds, switches, and the new exit server confirms it. More in changing your IP with an API.
Built for fleets
- One dashboard for phones, laptops, servers and agents.
- Locations: United States and Finland today, with more coming. Every plan gets every location.
- Plans by device count: Builder covers up to 25 machines, Team up to 100.
- Clear rules: no spam, attacks, fraud or scraping that breaks a site's terms, including by agents. Outbound email (port 25) is blocked. See the acceptable use policy.
Questions
Can an AI agent control its own VPN connection?
Yes. Create an API token with control scope and give it to the agent. It can move devices between locations, reconnect or disconnect them, without ever seeing your account key. Every action is recorded in the audit log.
Will a VPN on a remote server cut off my SSH session?
A full tunnel can. Register the Portveil agent with --split-tunnel on remote servers so your SSH connection keeps working.
Which operating systems does the Portveil agent run on?
Linux, with wireguard-tools installed. Phones, Macs and Windows PCs join through the free WireGuard app and show up in the same dashboard.
How do I know an agent's traffic is really going through the VPN?
The dashboard marks a device as protected only when the exit server confirms it is receiving that device's tunnel traffic, not just when the app says it is connected.