From ac31ee038b325c86a552c43fac6022a31fc9821f Mon Sep 17 00:00:00 2001 From: Gourav Kumar Dhiman Date: Tue, 20 Oct 2026 21:06:46 +0530 Subject: [PATCH] docs(user): the outside agents guide says which addresses agents can sign in over The guide said an agent on your own computers can use a LAN or Tailscale address. Over plain http that address lets the agent connect and register but not exchange its sign-in code, because the token endpoint is derived from the address and agents refuse to send credentials over http off localhost. Say which addresses work and point to Tailscale HTTPS. Co-Authored-By: Claude Sonnet 5.5 --- docs/user/outside-agents.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/user/outside-agents.md b/docs/user/outside-agents.md index 7cc6692e38f6..522f309247c7 100644 --- a/docs/user/outside-agents.md +++ b/docs/user/outside-agents.md @@ -19,9 +19,13 @@ https:///mcp The copied URL uses the route this device is connected over, so an agent on the same device can reach it. -- **An agent on your own computers** can use any address that computer reaches - the environment at: a LAN or Tailscale address, T3 Connect, or `localhost` on - the host. See [remote access](./remote-access.md). +- **An agent on your own computers** can use `localhost` on the host, T3 + Connect, or any `https` address, such as + [Tailscale HTTPS](./remote-access.md#tailscale-https). Signing in sends the + agent's credentials to the environment, and agents only do that over `https` + or to `localhost`. A plain-`http` LAN or Tailscale address, like + `http://100.x.y.z:3773`, lets an agent find the environment but not finish + signing in. - **A hosted agent**, such as ChatGPT or a bot running in the cloud, must reach the environment from the internet. Use the T3 Connect address. A Tailscale address only works from your own tailnet.