Your machine calls us. We never call it.
A small open-source connector runs next to your agents and opens one outbound connection to Orpheus. Everything you see and everything you send travels over that connection. No inbound port, no SSH key, no VPN.
The solid line is the only connection to your machine, and your machine starts it.
One prompt, one token, one machine.
You click Add server
Orpheus creates a connect token that works once, for 15 minutes, for your workspace only. We store only its hash.
The token is swapped for a credential
The
paircommand trades the token for a long-lived connector credential bound to that workspace and that server. The token is burned.The connector dials out
It opens a secure WebSocket to Orpheus and presents the credential. We check it, check it has not been revoked, and check your plan allows another server.
This is the prompt Orpheus gives you. Paste it to an agent on the machine, or run the commands yourself.
Example token. A real one is created when you click Add server.
A short, fixed list of messages.
The connector and Orpheus speak in JSON frames. The full list is in the connector reference.
- The list of exposed sessions and whether each is working or waiting
- Terminal output of the sessions you have open
- Transcripts and usage readings, if your policy shares them
- Text to type into an exposed session
- One of nine keys: up, down, left, right, enter, escape, space, tab, backspace
- A request to start a new agent session, from an allowed list
- No message runs a command. There is no exec frame.
A file on your machine has the last word.
The connector reads ~/.config/orpheus-connector/policy.json. It decides which tmux sessions are exposed, whether input is allowed, whether transcripts are shared and whether usage is read.
By default it exposes Claude Code and Codex sessions and no plain shells, and allows input for agent sessions only. The file is edited on the machine. Orpheus cannot change it.
Four checks before a keystroke leaves.
You are a member with the right role
Sending needs the operator role or above in that workspace. Viewers can watch but not type.
Your device was verified recently
If this device has not been verified in the last 12 hours, you confirm with a passkey or a fresh email code first.
You are inside the rate limit
There is a limit per user and per server.
It is written to the audit log
Every send, key, new session, pairing, revoke and role change is recorded.
And cutting it off.
The connector sends a heartbeat every 20 seconds and reconnects on its own if the network drops. Its credential rotates every 30 days over the open connection.
Revoke a server in Orpheus and its connection is closed at once. Or stop the connector on the machine. Either side can end it.