Self-host an AI agent without exposing it (Hermes)
A self-hosted AI agent runs code and holds your credentials, so its WebUI is the last thing that should answer the open internet. The safe pattern is to keep the agent reachable from your phone and laptop over a private overlay, not an exposed public port. Cloak the agent's WebUI, enrol your own devices with MFA, and close the public port — you get the same anywhere-access without a login page for scanners to find.
Frequently asked questions
Can I reach a self-hosted AI agent remotely without exposing it?
Yes. Cloak the agent's WebUI and issue a member for each device you use it from. You reach it over a verified identity from anywhere, with no public port — exactly what the agent's own guidance recommends over an exposed WebUI.
Why not just put the agent's WebUI behind a login?
A login page is still reachable, still fingerprinted, and still exploitable if the app has a flaw. Cloaking removes the reachability entirely, so there's nothing for a scanner or a stolen token to reach in the first place.
What do I need to run it?
A small always-on host on the same network as the agent to run the connector (it dials out only — no inbound ports), and the Veil client on each device you connect from.
Sources: Veil — run Hermes Agent without exposure (this guide)