automagik-si/arca

Infrastructure for AI agents. Yours, end to end.
Arca turns the machines you already own into your own cloud.
Quickstart · Guide
## Works today, and not yet
Arca is an alpha. Read this before you install.
| Works today | Not yet |
| Install with one line. curl -fsSL https://get.automagik.si/arca \| sh on a Linux machine (x86_64, glibc 2.34 or newer) with a running Incus your user can reach. It installs one release, runs the node as your own user's service, and leaves a node that only looks: an assistant with its token reads your projects, instances, host readings and alerts, and changes nothing. | No program for ARM, and no installer for a Mac: the installer stops on anything but Linux on x86_64. On another architecture it names building from source. It does not install Incus or give your user access to it. It was run for real on one machine that already had Incus and Arca, and not on a machine that never had either. |
| Connect an assistant on the same machine. The installer opens the node's MCP door at http://127.0.0.1:7471/mcp (or the next free port up to 7480), for this machine only and only with a token, and prints the one line that adds it to Claude Code. An assistant with a shell can use arca call instead. sh install.sh --no-door opens no port at all. | The installer opens no address another machine can reach. An assistant on another machine needs a tailnet or reverse-proxy listener, added to the config by hand: "Tailnet listener" and "Proxy listener" in the guide. |
| Turn on changes in one step. arca init --enable-changes, or --enable-changes on the install line. It asks before it writes (on the install line, the flag is your yes), writes only the keys the config lacks, names every token that would not wait for your approval, and keeps the config as it was. arca init --watch-only goes back, and removes nothing. | That step does not turn on virtual machines (the workspace and the GitHub and GitLab runner pools), tenants, or taking over a service that already runs on the machine. Each is set in the config by hand: "Turning on changes" says what the step does not do. |
| Approve on the machine itself. The step names an approval page at http://localhost:7471/approve (the port is the door's), with no domain and no certificate. You enrol a passkey with a setup code from the machine's screen, or from arca setup-code in a terminal, and approve each proposal there. From another computer the page opens through one ssh -L line. | Approving from a phone, on a machine with no name. A phone cannot open that page: it needs the node reachable under a name with a certificate, on a tailnet or a domain, set by hand. That page is for a machine where every account is trusted, and it was driven by a test browser's virtual passkey, not yet by a real passkey manager: read this first. |
| Know where you are. arca status says in words whether the node only looks or may change things, which doors are open, which page approves and whether it is open, whether a passkey is trusted, and ends with two lines: Next:, the one thing to do, and More:, where the rest is. arca status --security says the rest: what Arca may touch, and who can reach what. | It speaks for the unix socket, the door on this machine and the approval page. A tailnet or proxy address is named from the config file and not checked. |