AI Agent Gateway#

LabTether's AI Agent Gateway lets AI agents, scripts, and automation tools control your entire homelab through a secure, programmatic API.

Three Ways In#

What Can It Do?#

LabTether exposes the core control-plane workflows programmatically. REST API v2 has the broadest coverage; MCP provides a curated, bounded tool set for AI clients; and the CLI focuses on common inventory and execution workflows. Some specialized console and connector operations do not yet have parity, so use the hub's built-in API reference and your MCP client's tool discovery as the authoritative contract for the installed version.

Current programmatic coverage includes:

• Run commands on any managed asset (exec)
• Manage files — list, read, write, upload, download
• Control services — start, stop, restart system services
• Docker operations — containers, stacks, images, volumes
• Infrastructure — Proxmox VMs, TrueNAS storage, PBS backups
• Monitoring — metrics, alerts, incidents, logs
• System info — processes, disks, network, packages, cron, users
• Home automation — Home Assistant entities and automations
• Fleet ops — groups, discovery, topology, failover, bulk operations

Quick Start#

1. Create an API Key#

In the LabTether console, go to Settings → API Keys (or use the API directly):

curl -X POST https://hub.local:8443/api/v2/keys \
  -H "Authorization: Bearer $LABTETHER_OWNER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-ai-agent",
    "role": "operator",
    "scopes": ["assets:read", "assets:exec", "files:*", "services:*"],
    "allowed_assets": ["server1", "nas1"]
  }'

Save the raw_key from the response — it's shown only once.

2. Use It#

REST API:

# Load the one-time key through your shell's secret manager or a hidden prompt.
read -r -s LABTETHER_API_KEY && export LABTETHER_API_KEY

# Check what you have access to
curl https://hub.local:8443/api/v2/whoami \
  -H "Authorization: Bearer ${LABTETHER_API_KEY}"

# Run a command
curl -X POST https://hub.local:8443/api/v2/assets/server1/exec \
  -H "Authorization: Bearer ${LABTETHER_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"command": "uptime"}'

MCP (Claude Desktop):

{
  "mcpServers": {
    "labtether": {
      "url": "https://hub.local:8443/mcp",
      "headers": {
        "Authorization": "Bearer ${LABTETHER_API_KEY}"
      }
    }
  }
}

CLI:

labtether-cli config set-host https://hub.local:8443
labtether-cli config set-key
labtether-cli exec server1 "uptime"

Security Model#

• Scoped API keys — each key has a role, explicit scopes, and optional asset allowlist
• TLS required — API keys are rejected on plain HTTP
• Per-key rate limiting — 600 req/min per IP, 3000 req/min global per key
• Full audit logging — every key creation, deletion, and exec operation is logged
• Constant-time auth — SHA-256 hashed keys with timing-safe comparison

See API Key Security for details.