Multi-Machine Setup

Running Agents on Multiple Machines

Mission Control’s local-first design works great on a single machine, but as your workload grows, you may want to run agents on separate machines — a dedicated development server, a cloud VM, or multiple developer workstations — while keeping a single Mission Control instance as the coordinator.

The Multi-Machine Model

In a multi-machine setup:

• One machine runs the Mission Control server (the coordinator)
• Other machines each run one or more agent processes
• All machines need network visibility to each other

Agents on remote machines call back to the Mission Control webhook endpoint over the network, so Mission Control’s webhook URL must be reachable from every agent machine.

Using Tailscale for Private Networking

Tailscale is the recommended approach for connecting machines in a multi-machine Mission Control setup. Tailscale creates a private WireGuard VPN mesh between your machines using stable private IP addresses (100.x.x.x range), without requiring you to open ports or configure a VPN server.

To set up:

1. Install Tailscale on the Mission Control host and all agent machines
2. Authenticate each machine to your Tailscale account
3. Find the Mission Control host’s Tailscale IP: tailscale ip -4
4. Configure agents to call back to http://100.x.x.x:4000/api/webhooks/callback

Tailscale handles NAT traversal automatically, so agents behind home routers or corporate firewalls can reach Mission Control without any port forwarding.

Configuring Mission Control for Remote Agents

By default, Mission Control binds to localhost. To accept connections from remote agents, update the server binding in your environment configuration:

MC_HOST=0.0.0.0
MC_PORT=4000

If you’re using Tailscale, bind to the Tailscale interface IP instead of 0.0.0.0 to avoid exposing Mission Control to the public internet.

Security Considerations

• Use HMAC-signed webhooks (always enabled by default) to verify agent callbacks
• Restrict bearer token usage to known agent IPs using firewall rules or Tailscale ACLs
• Consider putting Mission Control behind a reverse proxy with TLS if your Tailscale network includes untrusted devices

Testing Connectivity

Before dispatching tasks to remote agents, verify the network path is working:

# From agent machine, test webhook reachability
curl -I http://100.x.x.x:4000/api/health

A 200 OK response confirms the agent can reach Mission Control.