Hypha Mesh
Connect a machine · one static binary, no runtime

Bring a machine
onto the mesh.

A machine joins your workspace by running myco — a single self-contained binary with no Node, Python or Docker required. Once its daemon is up, that machine shows up in Mycolab: you can spawn agent sessions on it, browse and transfer its files, expose its local ports to public URLs, and run scheduled work — from a browser, anywhere.

Start with step 1 What is Mycolab?

Two steps

About a minute on a fresh machine, and nothing to copy between them. Works on macOS, Linux and Windows. Both steps run on the new machine; you approve it in a browser — any browser, including the one on your phone.

1

Install the binary

One command in Terminal — Apple Silicon or Intel, both covered:

curl -fsSL https://mycolab.hypha.run/install.sh | sh

Installs to /usr/local/bin/myco (uses sudo only if that directory is not writable). No root needed if you set PREFIX=$HOME/.local/bin.

If macOS blocks it. The installed binary is not notarized yet, so Gatekeeper may say “myco cannot be opened because the developer cannot be verified”. The script-installed copy normally runs fine — that warning is for binaries carrying a download quarantine flag, which curl | sh does not set. If you downloaded the archive by hand from a browser and hit it, clear the flag: 
xattr -d com.apple.quarantine /usr/local/bin/myco
or open System Settings › Privacy & Security and choose Open Anyway.

One command in your shell — x86_64 or arm64, any distribution:

curl -fsSL https://mycolab.hypha.run/install.sh | sh

The Linux builds are musl-static, so they run on Debian, Ubuntu, Alpine, or a distroless container alike — no glibc version to match and nothing to install first. Installs to /usr/local/bin/myco; set PREFIX=$HOME/.local/bin to avoid sudo.

No security prompt to clear. Linux does not gate unsigned binaries, so there is nothing to bypass. If myco is not found after installing to a custom PREFIX, that directory is not on your PATH — add it to your shell profile.

In PowerShell (Windows 10 or 11, x86_64). Native — no WSL, no Docker:

irm https://mycolab.hypha.run/install.ps1 | iex

Both Intel/AMD (x86_64) and arm64 machines — the installer detects which you have and fetches the matching build. Installs to %LOCALAPPDATA%Programsmycomyco.exe and puts it on your PATH for the current user — no administrator rights needed. Prefer to do it by hand? Download the zip and unpack it anywhere on your PATH.

If Windows blocks it. The binary is not code-signed yet, so Microsoft Defender SmartScreen will warn the first time:
  • “Windows protected your PC” — click More info, then Run anyway.
  • A downloaded zip is “blocked” — right-click the file, Properties, tick Unblock, then OK before unpacking. Or in PowerShell: Unblock-File .myco-x86_64-pc-windows-gnu.zip
  • Running scripts is disabled — the irm | iex line above needs no policy change, but if your organisation has locked it down, use the zip instead.
We are working on signing; until then these prompts are expected and are not a sign that anything is wrong.

Prefer a direct download on any platform? See the table below. The installer will not silently overwrite an existing myco — it asks, or refuses when piped; pass FORCE=1 to replace it or NAME=myco2 to install alongside.

2

Log in and start the daemon

On the same machine:

myco login
myco daemon start
myco daemon status   # should report the daemon running

myco login prints a URL, a short code and a QR code, and opens your browser if it can. Approve it, and the machine picks up its own credential within a few seconds. There is nothing to copy back.

Over SSH, or on a box with no browser? The same command works: scan the QR with your phone, or open the printed URL on any device you are logged in on and type the short code. Add --no-browser to skip the launch attempt. Credentials are written to ~/.mycolab/credentials.json.

# the whole thing, start to finish
curl -fsSL https://hypha.run/install.sh | sh
myco login
myco daemon install   # run at boot (launchd / systemd), instead of 'daemon start'
Approve a machine that is already waiting

How the login works

The machine keeps its own secret

It generates a long random code and never shows it. Approving in the browser records your consent and returns no token; the credential goes to whoever holds that code, which is the machine. The short code you type does nothing on its own.

The credential expires in a day

It rotates itself, so the disk never holds a long-lived admin key. Revoke a machine from Machines — by name, not by token id.

CI uses a token instead

No browser, nobody to click. Mint a scoped token from CI & automation tokens and pass it as myco login --token ….

Keep it running

A server you walk away from needs two things the quick-start skips.

Survive a reboot

myco daemon install registers the daemon as a system service — launchd on macOS, systemd on Linux — so it comes back after a restart. myco daemon uninstall removes it. Plain daemon start does not survive a reboot.

Expiry stops being your problem

A machine connected with myco login refreshes its own credential, so the old failure — the token quietly expires, the machine stops appearing, and the only sign is a log line — does not happen. A machine still using a pasted --token does expire on schedule: if one goes quiet with no other explanation, suspect the token, and re-run myco login to move it off the paste entirely.

Check on it

myco daemon status on the box, or just look for the machine in Mycolab — presence there is authoritative, derived from the live connection rather than self-reported.

Share what is running on the machine

Two commands cover almost everything: one for a directory of files, one for a port something is already listening on.

myco expose <port>

Turns a local server into a public https://tl-*.hypha.run URL over the mesh's built-in tunnel — WebSockets included, no firewall changes, no port forwarding. It uses the credential the machine picked up at login; there is nothing else to sign in to. One service, one port.

myco serve <name> <dir>

Publishes a directory — a build, a report, a static site — at its own hostname, so an app's absolute paths work with no rebuild. Private by default: the URL is an unguessable hostname, and anyone holding it can read it. Use --owner or --access a@x,b@y when that is not what you want, or --public when it is.

If a tunnel command fails oddly

An error mentioning a different login command, or a frontend host you never configured, means a different binary of the same shape is earlier on your PATH. Check with which -a myco and myco --version. myco is a single static binary — no Node, no Python, no separate login step beyond myco login.

Direct downloads

Statically linked, dependency-free. The Linux builds are musl-static and run on any distribution — Debian, Ubuntu, Alpine, or a distroless container alike.

macOSApple Silicon · arm64myco-aarch64-apple-darwin.tar.gz macOSIntel · x86_64myco-x86_64-apple-darwin.tar.gz Linuxarm64 · staticmyco-aarch64-unknown-linux-musl.tar.gz Linuxx86_64 · staticmyco-x86_64-unknown-linux-musl.tar.gz Windowsx86_64 · 10 & 11myco-x86_64-pc-windows-gnu.zip Windowsarm64 · Snapdragon / Surfacemyco-aarch64-pc-windows-gnullvm.zip

On macOS and Linux, unpack and put it on your PATH: tar xzf myco-<target>.tar.gz && sudo mv myco /usr/local/bin/. On Windows, unpack the zip and put myco.exe anywhere on your PATH — and see the Windows notes in step 1 if SmartScreen blocks it.

What the machine can do once connected

Everything below is driven from the browser, against the machine you just connected.

Run agent sessions

myco session spawn claude -d ./project — or spawn one from Mycolab. The agent runs on your machine, with your files and your tools; the browser is only the window onto it.

Browse and move files

Read, upload and download from the machine's disk over a streaming tunnel — not a control channel — so large files work without buffering.

Share a local port

myco expose 3000 gives a dev server on your laptop a public HTTPS URL, WebSockets included. No firewall changes, no port forwarding.

Serve static files

myco serve report ./out publishes a directory — private to your account by default, public on request.

Supervise processes

Declare long-running processes in YAML with keep-alive and health probes: myco process apply proc.yaml.

Schedule work

Cron lives server-side, so a schedule still fires while the machine is briefly down, and runs when it comes back.

Serve several workspaces

myco machine start --workspace <workspace> adds a second workspace beside the one you signed into — its own credential, its own connection, the same machine in both lists, and no second browser approval. Add --no-agent to give that workspace a shell here and no agent sessions; the role is per workspace. myco workspaces shows what this computer serves.

You're connected — what now?

Open Mycolab to see the machine, spawn an agent session on it, browse its files, and drive everything from the browser.

Open Mycolab How the mesh works

Run myco --help for the full command surface. Everything on this page is the shipped CLI — no preview flags.