ClankerSpanker

Run the gateway, then open the product

The website is the control plane. The gateway stays on your machine. Nothing you send to an agent is uploaded to this site.

Run the gateway

Requires Node 20+ and the agent CLI you want to drive (grok, claude).

git clone https://github.com/nightmoose/ClankerSpanker.git
cd ClankerSpanker/host
npm install && npm run build && npm start

Run it in the background from the repo with ./scripts/install-service.sh (macOS launchd, or Linux systemd --user).

The gateway listens on loopback and this machine's Tailscale addresses. Do not publish port 8787 on the public internet. The default port is 8787; change it with bindPort in ~/.grok-dispatch/config.json.

Connect this page

On the computer running the gateway, open http://127.0.0.1:8787/setup and copy the host token. That page only answers on the host machine.
In Chrome, open https://clankerspanker.tech/.
In Settings, leave Host URL as http://127.0.0.1:8787 (or the port you set) and paste the token. For a gateway on another machine, see the tailnet steps below.
Allow Chrome's loopback permission when it asks. The session list then loads from your gateway, not from this website.

The token is stored in this browser only. WebSocket updates use a single-use ticket. The token is not placed in the socket URL.

Only Chrome can reach a gateway on this computer (http://127.0.0.1) from this site. In Firefox and Safari, connect over your tailnet instead (next section), or on the computer running the gateway open http://127.0.0.1:8787/app/ yourself. This site does not redirect you there.

Connect from another device, in any browser

Use this for an iPhone, an iPad, another laptop, or Safari and Firefox on the gateway machine itself. tailscale serve gives the gateway an HTTPS address that only your tailnet can reach. TLS ends on your own machine. This website does not join your tailnet and does not relay anything.

Pick a machine name you don't mind being public. Turning on HTTPS gets a certificate for <machine>.<tailnet>.ts.net, and every certificate is published in the public Certificate Transparency logs. If the name gives away something private (your name, a client, a project), rename the machine first in the Tailscale admin console (Machines → the machine → Edit machine name).
Enable HTTPS for the tailnet. In the Tailscale admin console, open DNS, make sure MagicDNS is on, and enable HTTPS Certificates.
Turn on the serve listener. In ~/.grok-dispatch/config.json on the gateway machine, add a port that is not bindPort, then restart the gateway:
```
"serveBindPort": 8788
```
The gateway then also listens on 127.0.0.1:8788, and only there. That port refuses every request that did not come through tailscale serve from a signed-in tailnet user, and it never serves the setup page or the token.
Point Serve at that port, not at 8787.
```
tailscale serve --bg 8788
```
It prints the address, https://<machine>.<tailnet>.ts.net.
Make sure Funnel is off. Run tailscale serve status. The entry must say tailnet only. If it mentions Funnel, turn Funnel off for that port before you go on. Funnel would put the address on the public internet. The gateway refuses Funnel traffic anyway, but don't rely on that alone.
Connect. On the other device (signed in to the same tailnet), open https://clankerspanker.tech/. In Settings, set Host URL to the https://…ts.net address and paste the host token from the setup page on the gateway machine. Chrome asks for local network access because the address is on your tailnet; allow it. Safari and Firefox connect without that prompt.

Through the tailnet address you can run and watch agents. Profile secrets, API keys, MCP sign-in, and creating or deleting profiles stay on the gateway machine itself. Tagged devices are not supported on the serve address, because Tailscale does not tell the gateway who is calling from them.

Other clients

These talk to the gateway directly. They do not use this website.

macOS: the native app in ios/ClankerSpanker. See the repository README.
Linux: the Electron app in desktop/.
iPhone: the phone scheme in the same ios/ project, paired from the setup page on the host machine.

Previews

Do not paste a host token into a *.vercel.app preview. A preview is a different origin. It cannot read a token stored on https://clankerspanker.tech, and the gateway does not allow that origin to read its API.