Edge Connector

The Edge Connector runs tools on your own infrastructure. It connects outbound via WebSocket to the nara Tool RPC server, so agents can execute EDGE tools against systems inside your network — no inbound ports or firewall changes required.

Architecture

The connector consists of two processes:

• Launcher — a supervisor that keeps the runtime alive and updates it automatically. It polls a check endpoint (default https://app.nara.de/api/edge/check, every 600 seconds) and applies updates atomically, rolling back if the new runtime fails to start.
• Runtime — the long-lived connector. It authenticates, connects to the Tool RPC server over WebSocket, registers and executes tools, syncs tool bundles, serves health endpoints, and shows a system tray icon on Windows.

A separate edge-connector CLI handles authentication, tool code generation, and bundle management — see the CLI reference.

Downloads

Download packages from Admin > Edge Connector (/admin/edge-connector). Choose between the Runtime full package and the standalone CLI, then select your platform and architecture (x64 or ARM64):

Platform	Formats
Windows	MSI (service) or ZIP
macOS	PKG
Linux	tar.gz

Installation

macOS

1. Download the PKG from Admin > Edge Connector and run the installer.

2. The installer registers a LaunchAgent (com.nara.edgeconnector in ~/Library/LaunchAgents), so the connector starts automatically at login.

3. Authenticate the connector via the browser device flow, or run edge-connector auth. See Configuration & authentication.

Windows

1. Download the MSI or ZIP. The MSI installs the connector as a Windows service; the ZIP variant registers an EdgeConnector entry under the registry Run key for autostart.

2. Start the connector and complete browser authentication. A tray icon shows connection status and offers a Login item while unauthenticated.

Linux

1. Download and extract the tar.gz to your install directory.

2. Start the launcher. Autostart is registered as a systemd user unit (edge-connector.service).

3. Authenticate with edge-connector auth, or use cloud deployment credentials (DEPLOYMENT_ID and DEPLOYMENT_SECRET) for headless servers.

Note

Autostart can be disabled with the EC_DISABLE_AUTOSTART environment variable, and the tray icon with EC_DISABLE_TRAY.

Security

• Outbound-only connectivity — the connector initiates the WebSocket connection to the Tool RPC server; nothing connects into your network.
• Token storage — the auth token is stored at <installDir>/auth-token.json with file mode 0600.
• Protected built-in tools — the diagnostics tools getSystemInfo, getResourceUsage, and getTopProcesses cannot be overridden by custom implementations.
• Verified bundle updates — bundle syncs compare checksums before download, swap the dist directory atomically, and the launcher rolls back automatically if an update fails.