Tailnet Agent Mesh - Reaching Your Agents from Anywhere

An always-on agent you can reach from your pocket. Two patterns: a vendor-hosted agent you remote-control from your phone (Cursor cloud agents, Codex in the ChatGPT app), or your own Mac on a Tailscale tailnet that you SSH into from anywhere - with Agent Cookie - Session State Sync for the Agent's Second Mac syncing your auth so the agent acts as you and pp-clis giving it cheap service access.

The shape of the capability

The agent does not have to run where you are. You dispatch and supervise from your phone; the work happens on a host that has your credentials, your tools, and a persistent session. There are two ways to get there, and they compose.

Pattern 1 - Vendor-hosted, phone as remote control (zero infra)

• Cursor cloud agents run in isolated cloud VMs (cloned repo, deps, secrets, network), not on your laptop. Dispatch and monitor from cursor.com/agents on any device, install it as a PWA on iOS/Android, or trigger via Slack @cursor, GitHub/Linear comments, or the API. Cursor 3.0 (2026-04-02) added an Agents Window listing every local + cloud session, with local↔cloud handoff mid-task. Source: cursor.com/docs/cloud-agent + cursor.com/blog/agent-web, 2026-06-01
• Codex in the ChatGPT mobile app is the phone control surface: start, steer, approve, and check in while Codex keeps working on a laptop, Mac mini, or remote computer. OpenAI's current mobile page explicitly frames it as Codex on iOS/Android connected to the user's existing files, plugins, project state, and configuration; desktop apps, logged-in Chrome sessions, and local files remain on the host. Source: OpenAI Codex Mobile, 2026-07-03

OpenAI's remote-connections docs make the security boundary concrete: remote connections use SSH to start and manage the Codex app server; app-server transports should not be exposed on shared/public networks; use a VPN or mesh networking tool when the host is outside the current network. That turns the @redtachyon screenshot into a correct architecture, not just a neat demo: Codex mobile as the control plane, Tailscale as the private reach layer, and host machines as the execution plane. Source: OpenAI Codex remote connections, 2026-07-03

These are the no-setup path: the vendor owns the host, your phone is a thin client.

Pattern 2 - Self-hosted on your tailnet (you own the host)

Tailscale is a mesh VPN on WireGuard: install it on each device, sign in once, and every device gets a private 100.x.y.z address + MagicDNS name and can reach the others directly, encrypted, over any network - no port forwarding, no public exposure. The free Personal plan covers an individual. Source: dev.to/jagafarm, 2026; dev.to/didof, 2026

The recipe ("so Claude Code can come with you"):

1. Tailscale on your phone + the agent-host Mac (a Mac mini / always-on Mac), same account.
2. SSH from the phone (Termius/Prompt/blink) to the Mac's tailnet IP or MagicDNS name, or serve a tailnet-bound web terminal. Bind to the 100.x address, never 0.0.0.0.
3. tmux so the session survives the phone backgrounding/dropping.
4. Run Claude Code, Codex, or any pp-cli on the Mac; it acts on your repos and services.

macOS Tailscale-SSH gotcha: only the brew install tailscale formula (unsandboxed daemon) can act as a Tailscale-SSH server; the App Store and --cask tailscale-app builds are sandboxed and cannot. Use the formula on any Mac you want to SSH into, then tailscale up --ssh for key-less, identity-based SSH (no key management, no ~/.ssh juggling). Source: juri.dev/notes/tailscale-ssh-macos, 2026

The VPS version is the same shape with cheaper always-on compute: rent a box, SSH in, install Claude Code/Codex/Hermes, keep the session in tmux, then close public ingress with Tailscale, Cloudflare Tunnels, and provider firewalls. Pieter Levels' bookmark is useful because it is not abstract advice; the artifact shows a remote shell doing nginx config validation, block-page checks, and loopback verification from a VPS-hosted Claude Code session. Source: X/@levelsio, 2026-06-28

@zack_overflow's follow-up gives the operator checklist version: rent Hetzner/OVH-class compute, let Claude configure dotfiles, packages, swapfile, and zswap, block inbound traffic, use Tailscale SSH, and keep work inside tmux or the Claude/Codex SSH surface. The self-reply anchors why this persists despite hosted background agents: a roughly $100/month OVH box can provide 6+ dedicated CPUs and 32GB+ RAM while remaining exactly configurable to the user's preferred packages and machine shape. Source: X/@zack_overflow self-thread, 2026-06-28

Tailscale's own Codex guidance now also includes the LLM-provider side of the mesh: route Codex through Aperture by setting a Codex-compatible model provider in ~/.codex/config.toml and using an Aperture base_url; Aperture injects credentials and logs usage while WireGuard keeps the http:// Aperture hop encrypted inside the tailnet. That is separate from phone-to-host control, but it completes the same private-control-plane pattern. Source: Tailscale Aperture Codex docs, 2026-06-27

The @0xSero stack-ranking bookmark is useful as adoption evidence because it ranks Tailscale ahead of VibeProxy and Codex App in an AI-operator stack: private reachability first, subscription/API proxying second, agent control surface third. The artifact reply points to another X status about the setup, but anonymous fetches currently return a Jina 451 block; keep the source as the root tweet plus the recorded artifact-reply URL, not as independently inspected setup details. Source: X/@0xSero and enriched artifact-reply review, 2026-07-04

How the pieces compose

phone ──Tailscale──> agent-host Mac
                       ├─ agent runtime (Claude Code / Codex / Hermes)
                       ├─ Agent Cookie  → your cookies + per-CLI tokens, synced from your laptop
                       └─ PrintingPress pp-clis → token-efficient, offline service access

• Tailscale = the private network that lets your phone reach the host from anywhere.
• Agent Cookie - Session State Sync for the Agent's Second Mac = the auth layer: continuously syncs your Chrome cookies + per-CLI bearer tokens to the host (over the same tailnet), so the agent wakes up authenticated as you instead of facing a login wall.
• Printing Press - Agent-Native CLIs from a Single Prompt pp-clis = how the agent touches services cheaply (local SQLite mirror, compound commands, ~100x fewer tokens than MCP).

Together this is the practical build-out of the Persistent Sandbox Thesis and always-on agent idea at personal scale: a self-evolving agent on a box you own, reachable from your pocket, authenticated as you.

Security posture

Private-network-first (tailnet, not the public internet); key-less Tailscale-SSH bound to your identity; bind any web terminal to the 100.x address only; tmux for durable sessions. In the vendor patterns, credentials never leave the host. For Agent Cookie, scope the allowlist tightly - the host holds live credentials. Source: samwize.com, 2026-02-08; agentcookie.dev, 2026-06-01

---

Timeline

• 2026-07-04 | Source-reviewed @0xSero's stack-ranking bookmark. Preserved it as field evidence that Tailscale is the first layer in an AI-operator stack, before VibeProxy and Codex App; the linked setup status remains source-blocked by anonymous X/Jina 451, so no extra setup claims were promoted. Source: raw/x-bookmarks/enriched/2063241834864795695.json
• 2026-07-04 | Deep-reviewed @zack_overflow's VPS + Tailscale SSH self-thread. Added the concrete operator checklist: Hetzner/OVH-style compute, agent-managed dotfiles/packages/swap/zswap, blocked inbound traffic, Tailscale SSH, and tmux or Claude/Codex SSH for persistence. Source: raw/x-bookmarks/enriched/2071342318301716954.json
• 2026-07-03 | Deep-reviewed @redtachyon's Codex mobile + Tailscale artifact. The local screenshot shows Codex mobile listing multiple online tailnet hosts (ariel@spark1, raspi, and another device) with terminal/device icons. Updated the page with current OpenAI Codex mobile docs, Codex remote-connections guidance, and Tailscale Aperture's Codex configuration path. Source: X/@redtachyon, 2026-05-15; Source: OpenAI, 2026-07-03; Source: Tailscale, 2026-06-27
• 2026-06-01 | Page created at Kevin's request to research/notate the "reach your agent from your phone" capability. Captured the two patterns (vendor remote-control: Cursor cloud agents + Codex ChatGPT app; self-hosted tailnet), the macOS Tailscale-SSH formula gotcha, and how Tailscale + Agent Cookie - Session State Sync for the Agent's Second Mac + Printing Press - Agent-Native CLIs from a Single Prompt compose. Installed Tailscale 1.98.3 (formula) locally; tailscale up --ssh handed off to Kevin (needs his login). Source: User, 2026-06-01
• 2026-06-12 | Community validation from dev-tools bookmark absorption: @redtachyon ("Codex mobile app can now manage all my devices through tailscale. Incredible. OpenAI won.") is a concrete Pattern-1 sighting — the ChatGPT/Codex app as a thin client over a tailnet-reachable host (3,315 likes, 1,260 bookmarks); and @0xSero ranks Tailscale #1 "most important software in my stack" ahead of an AI-subscription proxy (VibeProxy) and the Codex App (2,109 likes, 2,248 bookmarks). Source: X/@redtachyon, 2026-05-15; Source: X/@0xSero, 2026-06-06
• 2026-06-30 | Added Pieter Levels' Claude Code-on-VPS bookmark as field evidence for the self-hosted pattern: remote box, SSH/tmux, Tailscale/Cloudflare Tunnel/private firewall posture, and agent work from any client. Source: X/@levelsio, 2026-06-28