For a brand-new Hetzner / Vultr / DigitalOcean / OVH box. Tested on Debian 12 and Ubuntu 22.04+.
- Grab root SSH access to the fresh box.
- Your Mac needs:
- Homebrew
- iTerm2 (not the built-in Terminal — we rely on iTerm's tmux
-CCintegration) sshwith ControlMaster- Remote Login (sshd) enabled: System Settings → General → Sharing → Remote Login
git clone https://github.com/buildingopen/moto.git ~/moto
cd ~/moto
cp .env.example .env
$EDITOR .envFill in at minimum:
MAC_USERAX41_HOST(the new box's public IP)AX41_USER=rootAX41_SSH_KEY=~/.ssh/id_ed25519(or whatever key has root access to the new box)
./install.sh macThis adds ~/.local/bin/moto, sources shell functions into ~/.zshrc, adds a
Host ax41 block to ~/.ssh/config, and loads the launchd agent for the
reverse tunnel.
The easy path (recommended):
./install.sh server-remoteThis rsyncs the repo to $AX41_HOST:/opt/moto and runs server/install.sh
remotely as root.
The first-time install will:
- Install
tmux,socat,sshfs,xvfb,earlyoom, Docker, Google Chrome - Drop scripts into
/root/and/usr/local/bin/ - Write the systemd units and enable them
- Mount the Mac's
~/.claudeat/mnt/mac-claude - Generate an SSH key on the server if missing, and print the public key
If the installer printed a new public key, add it to your Mac's
~/.ssh/authorized_keys:
# On the Mac:
echo 'ssh-ed25519 AAAA... moto-server-hostname' >> ~/.ssh/authorized_keys# On the Mac:
launchctl kickstart -k gui/$UID/sh.buildingopen.moto.reverse-tunnelVerify from the server:
ssh ax41 'ssh mac hostname'
# → should print your Mac's hostname# On the Mac:
moto doctorEvery check should be green. If reverse tunnel is down, the SSH server on
your Mac is likely not running, or your ~/.ssh/authorized_keys doesn't have
the server's key.
moto new hello/world
# → iTerm opens a new tab with Claude Code running on the server.From now on, moto up will always restore your full set of sessions into one
iTerm window.
If you want agents to use Google / LinkedIn / GitHub as a logged-in user, see browser-login.md.
If you want outbound agent traffic on a residential IP, see proxy.md.