Veirox Connect
Veirox Connect is a lightweight outbound connector that runs inside your private network and tunnels agent tool calls to resources unreachable from the public internet.
How it works
You install the connector binary on a bastion host or container inside your VPC. The connector opens an outbound WebSocket to the Veirox control plane — no inbound firewall rules needed. When the agent needs to run a tool (e.g. exec_sql, run_kubectl), the control plane routes the call through the connector to your private resource.
Enrolling a connector
veirox connector add prod-bastion --description "prod jumpbox" --label env=prod veirox connector enroll <uuid> --runtime systemd veirox connector list
Policies & audit
Each connector can have a deny-list of commands (--deny-command) and a context label set. All tool calls through a connector are recorded in the project audit log.