AI Agent Platforms

Access your agent’s Control UI from anywhere — when you’re away from home, on your phone, or sharing with a collaborator. One command gives you a secure public URL with SSO access control.

Why HLE for Your Agent

The Control UI binds to 127.0.0.1:18789 by default — great for security, but it means you can’t access your agent when you’re away from home. The usual workarounds (SSH tunnels, Tailscale) require setup on every device. HLE gives you a public HTTPS URL with SSO built in — just share the link and control who can log in with --allow.

Method	Setup	Auth	HTTPS
SSH tunnel	Manual, per device	SSH key only	No
Tailscale Serve	Install on all devices	Tailscale identity	Yes
HLE	One command	SSO (Google/GitHub) + `--allow`	Automatic

Quick Start

1. Install the skill

# OpenClaw
openclaw skill install hle-tunnel

# PicoClaw
picoclaw skill install clawhub://hle-tunnel

# Nanobot / IronClaw — auto-discovered from ClawHub

2. Set your API key

# Set the environment variable so the agent can use it
export HLE_API_KEY=hle_your_key_here

# Or run the interactive login (opens browser)
hle auth login

3. Ask your agent

Describe what you want in natural language — via WhatsApp, Telegram, Discord, Slack, or the Control UI:

# Access your agent UI remotely
"Expose my Control UI so I can access it from my phone"

# Share with a collaborator
"Expose my agent UI and allow friend@gmail.com to access it"

# Expose a homelab service
"Create a tunnel to my Grafana on port 3000 and allow dev@company.com"

The agent runs the hle CLI and returns the public URL (e.g. https://my-agent-x7k.hle.world). Anyone you --allow can log in via Google or GitHub SSO — no account sharing needed.

Common Examples

Remote access to your agent

# Just for you (SSO, only your account can access)
hle expose --service http://localhost:18789 --label my-agent

# Share with a friend
hle expose --service http://localhost:18789 --label my-agent \
  --allow friend@gmail.com

# Share with multiple collaborators
hle expose --service http://localhost:18789 --label my-agent \
  --allow dev1@company.com --allow dev2@company.com

Homelab services

# Home Assistant — allow yourself remotely
hle expose --service http://localhost:8123 --label ha \
  --allow google:alex@gmail.com

# Grafana — share dashboard with your team
hle expose --service http://localhost:3000 --label grafana \
  --allow dev1@company.com --allow dev2@company.com

Run with Docker

If you prefer Docker or your agent already runs in a container, you can run HLE as a container too:

# Run the HLE container (headless)
docker run -d \
  --name hle \
  -e HLE_API_KEY=your_key_here \
  -v hle-data:/data \
  ghcr.io/hle-world/hle-docker:headless

# Expose the agent's Control UI running on the host
docker exec hle hle expose \
  --service http://host.docker.internal:18789 \
  --label my-agent \
  --allow google:alex@gmail.com

See the full Docker guide for Compose, web UI, and environment variables.

Supported Platforms

The hle-tunnel skill is published on ClawHub. One skill covers four platforms: OpenClaw, PicoClaw, Nanobot, and IronClaw.

What Your Agent Can Do

Expose the Control UI — access your agent from anywhere, on any device
Share with others — use --allow email to grant SSO access to specific people
Expose local services — Home Assistant, Grafana, Jupyter, dev servers, anything on localhost
Access control — SSO via Google/GitHub, PIN codes, HTTP Basic Auth, temporary share links
List & manage — list active tunnels, revoke share links, update access rules

Troubleshooting

Agent can’t find `hle` command

The skill will attempt to install hle-client via Homebrew or uv. If that fails, install manually: pip install hle-client or brew install hle-world/tap/hle-client. Ensure the binary is on the agent’s PATH.

WebSocket errors in the Control UI

The Control UI uses WebSocket connections for real-time chat and events. HLE proxies WebSockets by default, so this should work out of the box. If you see disconnection errors, check that your agent is still running locally on port 18789.