Now available in WireZTNA

Temporary network access
for AI agents.

Give AI agents, external consultants, or any collaborator temporary, scoped access to private resources. One binary. One WebSocket. Auto-expires.

No VPN enrollment. No credentials to rotate. No admin tickets. The user who already has access delegates a subset of it — with full audit trail and configurable security policies.

terminal

# 1. Register (free tier — self-service, no portal)
$ wzctl register --broker https://freetier.wireztna.com --email you@example.com --save
  Registered. Credentials saved to ~/.wzctl/config.json
# 2. Generate a publisher token (defines what CIDRs are reachable)
$ wzctl token --broker https://freetier.wireztna.com --cidrs "10.0.2.0/24" --name my-server
  https://freetier.wireztna.com/enroll/pub_a7c3f...
# 3. On the private server: enroll publisher
$ sudo ./wireztna-publisher install --token "<url_from_wzctl_token>"
  Publisher enrolled. Tunnel active.
# 4. Connect — daemon mode for CI/Docker/agents
$ wzctl connect --broker https://freetier.wireztna.com \
    --publisher pub_a7c3f --target 10.0.2.30 --port 5432 \
    --ttl 30m --local-port 5432 --daemon
  Connected. Listening on 127.0.0.1:5432
  Expires in 29m58s
# 5. Use it — any tool that speaks TCP
$ psql -h localhost -p 5432 -U app production
  production=# SELECT count(*) FROM orders;

The access problem everyone ignores

Someone outside your perimeter needs to reach something inside it. Today, the options are bad.

🔑

Share credentials

Paste a DB password in Slack. Pray they delete it after. They won't. It leaks in 3 months.

👤

Create a temp account

File a ticket. Wait for IT. VPN enrollment. 2FA setup. They need it for 30 minutes. The account lives forever.

🌐

Expose to the internet

Open a firewall rule "temporarily". Forget to close it. Shodan finds it in 4 hours.

How wzctl works

Two modes, one binary. The free tier is self-service from zero. The Pro tier adds delegated access passes — an admin or authorized user creates a scoped pass and shares it with the recipient.

Free Tier Self-service — you set up everything yourself

Register via CLI

Run wzctl register. Self-service, no portal. Credentials saved locally.

Generate a token

Run wzctl token --cidrs to create a publisher enrollment URL.

Enroll publisher

On the private server, install the publisher with the token.

Connect

Run wzctl connect --daemon. Resource on localhost. Auto-expires.

Pro Delegated access — a user creates a pass, recipient connects

User creates a pass

Via the Web UI or wzctl pass create. Scoped to host:port, with TTL.

Share the pass

Send the pass ID to the consultant, CI job, or AI agent. It's a short opaque token.

Recipient connects

Runs wzctl connect --pass. No registration needed. Resource on localhost.

Pass expires

Connection closes. Audit log written. Zero cleanup. No zombie accounts.

  Collaborator / AI Agent                          Your private infrastructure
  ┌─────────────────────┐                          ┌──────────────────────────┐
  │  wzctl connect  │      WebSocket (443)     │  WireZTNA Broker         │
  │  localhost:5432  ───┼──────────────────────────►│  validates session       │
  │                     │◄─── TCP relay ──────────► │  opens TCP in namespace  │──► PostgreSQL
  │  5 MB static binary │      TLS via Cloudflare  │  full audit trail        │    10.50.1.100:5432
  └─────────────────────┘                          └──────────────────────────┘
                                                            │
  No NET_ADMIN. No WireGuard.                               ▼
  No credentials. No VPN.                           Publisher network (private)
  Works from containers, CI, sandboxes.             ────────────────────────────

Built for machines. Works for humans.

The same mechanism serves AI agents operating autonomously and human collaborators working on a deadline. One protocol, two worlds.

AI agents & automation

→ Ops bots debugging a production K8s cluster — scoped to the API server, expires in 30 min
→ Coding agents (Cursor, Copilot Workspace) querying staging databases to validate generated SQL
→ MCP servers connecting to internal APIs as tool backends for LLM agents
→ CI/CD pipelines running integration tests against private services without VPN in the runner
→ RAG data extraction — temporary read access to internal databases for knowledge base updates

                        # In your AI agent's bootstrap:

                        wzctl connect --broker $BROKER --publisher $PUB \

                          --target 10.50.1.200 --port 6443 --ttl 10m \

                          --local-port 6443 --daemon &

                        kubectl --server=https://127.0.0.1:6443 get pods

Human collaborators

→ External consultants — 2-hour access to PostgreSQL for a performance audit. Done. Gone.
→ Vendor support engineers — access to your internal service to investigate an open ticket
→ Freelancers — connect to an internal API during a delivery window without full VPN onboarding
→ Auditors — read-only access to Kibana or logs for a compliance review
→ Cross-team engineers — ephemeral access to another team's microservice for integration testing

                        # Consultant runs this. Nothing else.

                        wzctl connect --broker $BROKER --publisher $PUB \

                          --target 10.50.1.100 --port 5432 --ttl 2h \

                          --local-port 5432

                        pgcli -h 127.0.0.1 -p 5432 -U readonly

For the AI agent ecosystem

Secure AI Agents

Expose internal APIs, MCP Servers, and enterprise tools to AI agents — without VPNs, public endpoints, or credential sharing.

The problem nobody is solving well

The entire AI agent ecosystem — OpenAI Agents SDK, Claude Code, Cursor, Docker MCP, LangGraph, CrewAI, AutoGen — increasingly depends on MCP (Model Context Protocol) to connect agents with tools. But most enterprise tools live behind private networks. Today your options are: expose them to the internet (dangerous), run the agent inside the VPN (complex), or give up on private tool access entirely.

wzctl solves this in one line:

                        # Your MCP server connects to an internal API via wzctl

                        wzctl connect --broker $BROKER --publisher $PUB --target 10.0.2.5 --port 8080 --ttl 30m --local-port 8080 --daemon &

                        # Claude, GPT, or any agent calls MCP tools that hit localhost:8080

                        # No public endpoint. No VPN on the agent host. Auto-expires.

MCP Servers

Give your MCP server access to internal databases, APIs, or services — without exposing them publicly. The agent calls MCP tools; tools reach private infra through the tunnel.

Coding agents

Cursor, Copilot, Windsurf, Claude Code — let them query staging databases, hit internal APIs, or access private package registries. Scoped, temporary, audited.

Ops & infra agents

Autonomous ops bots diagnosing incidents, checking K8s clusters, querying Prometheus, or running playbooks against private infrastructure. Time-boxed by design.

RAG pipelines

Data extraction agents that need temporary read access to internal databases or document stores for knowledge base indexing. No standing credentials.

Agentic workflows

LangGraph, CrewAI, AutoGen multi-step workflows that need to interact with private services at specific steps. Each step gets its own scoped pass.

Sandboxed execution

Agents running in Docker, Firecracker, E2B, or any sandbox with no NET_ADMIN. Only needs outbound HTTPS — wzctl runs unprivileged.

Why this matters now

Every AI agent framework is converging on MCP for tool access. But the transport layer assumes tools are either public or running locally. Enterprise tools are neither. wzctl bridges this gap: your MCP server runs anywhere (cloud, laptop, CI), and reaches private resources through a scoped, time-limited, auditable tunnel. No VPN on the agent host. No public endpoints. No credentials to leak.

Security without the security theater

Delegation is powerful. Uncontrolled delegation is dangerous. That's why every layer has explicit admin controls.

Publisher-level delegation flag

Admins explicitly mark which publishers allow delegation (delegable: true). Private data publishers stay protected by default. No flag = no passes can target it.

Per-user delegation permission

Only users with can_delegate: true can create access passes. The admin grants this selectively. New users can't delegate by default.

Hard TTL cap

Admin configures max TTL per tenant (e.g., 2 hours). Users can request less, never more. Passes cannot be renewed — create a new one with a new audit entry.

Scope ceiling enforcement

A user can never delegate more than they have. If you can reach 10.50.1.100:5432, you can delegate exactly that. Not the whole /16. Not other ports.

Real-time admin notifications

Every pass creation generates an audit event visible in the dashboard. Admins can revoke any pass instantly — active WebSocket connections are terminated within 1 second.

Traffic caps and connection limits

Optional per-pass limits: max bytes transferred, max concurrent connections. Prevents exfiltration even if the scope is legitimate. Auto-closes on threshold.

Enterprise tier: approval workflows

For regulated environments: passes can be created in pending_approval state. An admin reviews and approves before the pass becomes usable. The TTL doesn't start counting until approval. Full compliance with SOC 2, ISO 27001, and least-privilege audits.

Why not just create a VPN account?

Because temporary access should be temporary. Not "temporary until someone remembers to revoke it."

	Full VPN account	Access Pass
Setup for recipient	Enrollment, login, client install, config	One binary, one command
Scope	Everything in their group	Specific host:port only
Lifecycle	Permanent until admin revokes	Auto-expires. Zero cleanup.
Who provisions it	Admin (ticket, approval chain)	The user who already has access
Audit context	Generic "user accessed network"	Who delegated, why, for how long, what they did
Requirements	WireGuard, NET_ADMIN, root/admin	Outbound HTTPS. That's it.

Download wzctl

Static binary. No runtime, no dependencies. Works in any environment.

Linux amd64 Linux arm64 macOS arm64 (Apple Silicon) macOS amd64 (Intel)

Or install via Go: go install github.com/wireztna/wzctl@latest

Get started in 5 minutes

Download wzctl, register, deploy a publisher, connect. Full step-by-step guide with examples for Docker, CI/CD, and macOS.

Free Tier quick start guide

Integration examples

Works anywhere you can run a binary or import a package.

// MCP tool: give an AI agent access to a private database
// The agent calls this tool, gets temporary access
const tunnel = await wireztna.connect({
  pass: process.env.WIREZTNA_PASS,
  broker: process.env.WIREZTNA_BROKER,
  localPort: 5432
});
// Now connect to localhost:5432 as if it were the private DB
const db = new Client("postgresql://localhost:5432/app");

Temporary network access for AI agents.