# Computers

A computer connects your own machine to Kortix through a permissioned tunnel.

Canonical page: https://kortix.com/docs/connect/computers

A computer is your own machine — laptop, desktop, or server — connected to
Kortix through a permissioned reverse tunnel. A computer is not a sandbox. A
sandbox is a disposable cloud machine that Kortix creates for a
[session](/docs/work/sessions). A computer is a machine you already own, and
it stays connected across sessions.

This feature is experimental. Before you connect a machine, enable **Agent
Computer Tunnel** in Customize → Experimental.

## Connect a machine

1. Open the project's Computers page in the dashboard.
2. Run the command the page shows you, for example
   `npx --yes @kortix/agent-tunnel@latest connect --api-url <url>`.
3. Approve the connection.

## Grant access

You grant access per capability: filesystem, shell, or desktop. You can scope
each capability to allowed paths, commands, or desktop features. The agent
gets only what you grant. A call to an ungranted capability creates a
permission request. You approve or deny each request on the Computers page.

## How the agent reaches a computer

Connecting a machine creates one `computer`
[connector](/docs/connect/connectors) that fronts every machine you connect.
The agent calls `computer.list_computers` to find machines, then
`computer.fs.read`, `computer.shell.exec`, or `computer.desktop.cua.*` to act
on one. You control who can use the `computer` connector from the project's
Connectors page.

A computer has no credential. The live tunnel connection is the credential.
Per-machine access control lives in the tunnel permission layer, not in a
stored secret.

You configure computers from the dashboard, not from `kortix.yaml`. Connecting
a machine creates the connector automatically — you never add it by hand.