We Shipped the Agent Mesh in March. Cloudflare Shipped It in April.
The verdict first: if you want a private network where your hardware, your agents and your people each enroll with their own identity and reach each other without a VPN login or a hand-built SSH tunnel, you can have it from us on any box you own — or from Cloudflare, on theirs. We shipped it first. Ours runs on your hardware. That is the whole difference, and it is the one that matters.
The timeline
| date | what shipped |
|---|---|
| 2025-11-24 | First cloudflared in our tree: a quick tunnel in front of one GPU so a phone could reach it |
| 2026-03-08 | Cloud agents reach the box over MCP — an agent in someone else's cloud calling tools on a machine in our office, identity as the only key |
| 2026-03-09 | AitherTunnel: per-node tokens, browser SSH, TCP forwarding, route management behind SSO; WireGuard peers with no key files on disk |
| 2026-03-26 | Edge nodes join with one command |
| 2026-04-14 | Our split architecture post: static site in front, live machine behind, agents in the mesh |
| 2026-04-14 | Cloudflare announces Cloudflare Mesh: nodes enroll with per-node tokens and get a mesh IP, "agents carry their own identity through the network", "VPNs require interactive login. SSH tunnels require manual setup", a Mac mini at home reachable from a phone |
| 2026-06-03 | A GPU in another room joins the mesh |
Same problem statement. Same enrollment model. Same headline scenario. Five weeks apart, and every one of our posts is dated.
We are not going to pretend that is a coincidence, and we are also not going to pretend it is a problem. Cloudflare validating the shape means we were right about the shape. The question a reader actually has is which one to run.
What ours does that theirs does not
It runs on your hardware. AitherTunnel is a service you host. The mesh control plane, the identity provider, the WireGuard peers, the SSH proxy — all of it is on the machine you own, behind a single outbound connection. Cloudflare Mesh is Cloudflare's control plane; your nodes run their client and get their IP.
Any box, no account, one command. pip install awtunnel && awtunnel up --port 8080 gives one local port a public URL with no account at all, and awtunnel down takes it away. That is the free tier, and it is the same command the first commit was.
Keys never touch disk. Our WireGuard peers are provisioned into memory and rotated; there is no key file on the node to leak.
GPUs are first-class. A node that joins brings its models with it. The mesh routes inference to the box that has the card, which is what a homelab with one 5090 and a laptop actually needs.
The whole thing is open. The tunnel brick, the route validator, the queue kind that gates who may open a hostname, the CI action — all in the open, all pip-installable.
How to run it
pip install awtunnel
awtunnel up --port 8080 # a public URL for one local port, no account
awtunnel status
awtunnel down # gone
For the managed version — named hostnames on our zone, the mesh overlay kept in sync, an audit line for every expose and retire, ten endpoints, metered by the hour an endpoint is open — AitherTunnel Pro is $19/month. The service behind it has run tunnel.aitherium.com without interruption since March.
Cloudflare gives you 50 nodes free on their fabric. We give you every node you own, on yours.