Away from home

Pairing on the same Wi-Fi just works. This page is about everywhere else.

How remote access works

When the Bridge starts, it also brings up Pounce’s own secure peer-to-peer tunnel (built on iroh). The pairing QR carries everything your phone needs to find that machine again — so after one scan, Pounce reaches it from any network: cellular, hotel Wi-Fi, wherever.

• No VPN, no port-forwarding, no static IP. The tunnel dials your machine directly by its identity, not its address.
• On your Wi-Fi, the tunnel isn’t used — the app talks to the Bridge directly over the local network and stays fast.
• End-to-end between your devices. There’s no Pounce relay account and no cloud inbox; your code and conversations move between your phone and your machine.

You don’t configure any of this. If you’ve paired, it works.

Pair a server over SSH

The pairing QR doesn’t care whether you can walk over to the machine. SSH into any box and run:

ssh my-server
npx use-pounce

The QR prints right in your terminal. Scan it, and that server’s agents are in your pocket — even though your phone and the server share no network at all.

Or let the desktop app do it

On the Mac app, Connect → Add a machine over SSH does all of the above for you. Give it a host — an ~/.ssh/config alias works, jump hosts and keys included — and it connects, runs the CLI over there, and adds the machine. If the server asks for a password, a key passphrase, or whether you trust its host key, it asks you right in the window.

SSH is only used to set the server up. After that the machine is reached the same way a scanned QR would reach it, which is why a server you add on your Mac also turns up on your phone.

Staying LAN-only

Prefer to keep a machine reachable only on your own Wi-Fi? Start the CLI with:

npx use-pounce --lan

The QR then pairs for local-network use only, and no tunnel is started. (If the tunnel binary isn’t available for some reason, the Bridge quietly falls back to LAN-only mode on its own.)

Security notes

• Every machine pairs with its own random token, minted on that machine. The QR is a credential — treat it like one, and don’t post screenshots of a real pairing code.
• Off-network access uses a direct peer-to-peer identity to reach home; requests without your token are rejected.
• Quit the Bridge (or pounce stop) any time to take a machine fully offline.