Portveil

io.github.roybogsPublished by GitHub account roybogsv0.4.4Updated Oct 26, 2026

MCP server for Portveil: let AI assistants see your devices and move them between VPN locations.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Portveil MCP server that lets an AI assistant list the devices on a Portveil account and move them between VPN locations.

What you can do
List and inspect devices, locations, account plan and recent activity, including live speed and protection status for each device. Move a device to a country or city, or rotate it once to the next location. Start and stop scheduled rotation that moves a device every N minutes, optionally among chosen locations. Reconnect or disconnect a device's tunnel. Add, rename, update or remove devices, with tunnel files saved locally for phones and laptops.
When to use it
Useful when you manage several Portveil-protected devices or agent machines and want to change their VPN exit location, rotate locations on a schedule, or check which devices are unprotected, by asking an assistant instead of using the dashboard.
Requirements
Runs locally via npx (Node.js). Needs a Portveil account, the account ID in PORTVEIL_ACCOUNT_ID, and an API token in PORTVEIL_TOKEN with read or control scope. PORTVEIL_API optionally overrides the API base URL. Devices must run the Portveil app or agent with remote control on to be movable.
Before you install
The token in PORTVEIL_TOKEN grants access to your account; use a scoped token, not your account key, and revoke it in the dashboard if needed. Control-scope tools move, reconnect, disconnect, add and remove devices, and disconnect and remove are flagged destructive. Scheduled rotation keeps changing locations until stopped. The server sends requests only to the Portveil API.

Installation

In SourceWeft

  1. Open Portveil in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Portveil MCP server

Let an AI assistant see the devices on your Portveil account and move them between VPN locations.

"Move my scraper box to Finland." "Rotate every agent to a new location." "Which of my devices aren't protected right now?" "Rotate the scraper between the US and Finland every 15 minutes."

Moves are verified: a tool only reports success after the device has switched and the exit server in the new location confirms it sees that device.

Tools

ToolWhat it doesNeeds
list_devicesEvery device: protected or not, where it exits, live speed (↓/↑ Mbps), remote control on/offread
list_locationsThe locations you can move toread
get_deviceOne device's current state, including live speed and any rotationread
get_accountPlan and devices usedread
list_activityRecent moves, reconnects and changes, and which token made themread
move_deviceMove a device to a country or city ("Finland", "US", "Helsinki")control
rotate_deviceMove a device once to the next locationcontrol
start_rotationMove a device automatically every N minutes (5–10080), optionally among chosen locations. Portveil runs the schedule, so the assistant can closecontrol
stop_rotationTurn scheduled rotation offcontrol
reconnect_deviceRe-establish a device's tunnelcontrol
disconnect_deviceTurn a device's VPN off (flagged destructive: a hint that tells well-behaved assistants to check with you first)control
add_deviceAdd a device. Phones and laptops (WireGuard app): creates it and saves its tunnel files locally, key never shown in chat. Linux servers and agent machines: gives the exact commands to run on that machine, which makes its own key and registers itselfadmin (phones/laptops)
update_deviceRename a device and/or turn its remote control on or offadmin
remove_deviceRemove a device for good (flagged destructive)admin

Tool names changed in 0.3.0 to one verb_noun pattern: device_status → get_device, account_info → get_account, recent_activity → list_activity, set_rotation → start_rotation.

Devices can be named loosely ("scraper" finds "Scraper box"); an ambiguous name returns the choices instead of guessing.

Setup

No account yet? Start free with just an email, no card.

  1. In the Portveil dashboard, create an API token. Choose control scope to let the assistant move devices, or read to let it only look. Don't give it your account key.
  2. Note your account ID (acct_…).
  3. Add the server to your assistant:

Claude Code

bash
claude mcp add portveil -e PORTVEIL_ACCOUNT_ID=acct_… -e PORTVEIL_TOKEN=clt_… -- npx -y portveil-mcp

Claude Desktop (claude_desktop_config.json), Cursor (.cursor/mcp.json) and most other clients:

json
{  "mcpServers": {    "portveil": {      "command": "npx",      "args": ["-y", "portveil-mcp"],      "env": { "PORTVEIL_ACCOUNT_ID": "acct_…", "PORTVEIL_TOKEN": "clt_…" }    }  }}

Hermes Agent: Hermes only installs npm packages older than 14 days, so install into its own folder and run it with node:

bash
cd ~ && npm install --prefix ~/.hermes/mcp-servers/portveil [email protected]echo 'PORTVEIL_TOKEN=clt_…' >> ~/.hermes/.envhermes mcp add portveil --command node \  --env PORTVEIL_ACCOUNT_ID=acct_… 'PORTVEIL_TOKEN=${PORTVEIL_TOKEN}' \  --args ~/.hermes/mcp-servers/portveil/node_modules/portveil-mcp/dist/index.js

For Hermes to use it well (when to act, what to confirm first, how to add devices), also install the Portveil skill from ClawHub:

bash
hermes skills install roybogs/portveil

(Source: skills/portveil/SKILL.md.)

Devices must be running the Portveil app or the Portveil agent with remote control on. Devices using the plain WireGuard app are shown but can't be moved.

Security

  • Use a scoped API token. Every action it takes is recorded in your account's activity log with the token that made it, and you can revoke it in the dashboard at any time.
  • The server talks only to https://api.portveil.com (override with PORTVEIL_API). It stores nothing.

Development

bash
npm installnpm test        # builds, then runs the tests against a fake Portveil API

Source: README.md at commit 34328e5

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

7
  1. v0.4.4LatestOct 26, 2026
  2. v0.4.3Sep 27, 2026
  3. v0.4.2Sep 27, 2026
  4. v0.4.1Sep 26, 2026
  5. v0.3.0Sep 26, 2026
  6. v0.2.0Sep 25, 2026
  7. v0.1.1Sep 25, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts