Capabilities
From agent version 1.0.24, the agent is built as a hardened Core runtime with optional capabilities layered on top. Earlier agents were a single build that included every feature. Splitting them means a device only carries the code for the features it actually uses, which keeps the attack surface as small as the deployment allows.
Capabilities are fixed when the agent is built. They are not runtime switches: a binary either contains a capability or it does not. To change the capabilities on a device, reinstall the agent and choose a different install type.
Core
Core is the hardened base runtime. It is present on every agent and cannot be removed.
Core always includes:
- Deployment: Receiving and running containerised programs deployed from Magnum Coder
- Logging: Local and cloud-backed log collection
- Device control: Starting, stopping, and monitoring programs
- Horizon Zero Trust: Zero Trust request forwarding
WARNING
Core does not include CloudLink. An agent installed as Core has no WireGuard tunnel and is not reachable over a CloudLink VPN network. If you need remote VPN access to the device, choose Advanced or Custom at install time.
Optional capabilities
| Capability | What it adds |
|---|---|
| CloudLink | Encrypted WireGuard tunnel for secure remote access to the device. For more information, see CloudLink. |
| Remote terminal | Interactive browser shell that runs as root on the device. For more information, see Remote Terminal. |
Install types
You choose an install type when adding a device, or when reinstalling an existing one. The install type is a preset over the capability set.
| Install type | Capabilities | Use when |
|---|---|---|
| Core | None | Security is the priority and the device does not need remote VPN or shell access. |
| Advanced | CloudLink and Remote terminal | You want the full feature set, matching how agents behaved before 1.0.24. |
| Custom | Any partial selection | You need some capabilities but not all, for example CloudLink without the remote terminal. |
The install type is not stored against the device. It is derived from what the agent reports it actually has installed, so a device that was reinstalled outside the platform still reports its true state. No capabilities reads as Core, every capability reads as Advanced, and any other combination reads as Custom.
Capability states
On the Agent Settings page, each capability shows one of three states. For more information, see Agent Settings.
| State | Meaning |
|---|---|
| Not installed | The capability is not built into the agent on this device. |
| Enrolling | The capability is installed and is still completing its device-side setup. |
| On | The capability is installed and ready to use. |
CloudLink is usable as soon as it is installed, so it moves straight to On. The remote terminal completes a key exchange with the platform after installation, so it can sit at Enrolling briefly before it becomes available.
Variant names
The platform names each build by its variant, which is the word base followed by the capabilities it carries, in alphabetical order.
| Install type | Variant |
|---|---|
| Core | base |
| CloudLink only | base+cloudlink |
| Remote terminal only | base+terminal |
| Advanced | base+cloudlink+terminal |
You will see the variant in two places: on the Version tab of Agent Settings, and on the download options for a release. You can also check it from the device:
cd /opt/mutexer/agent
sudo ./agent versionINFO
Not every release publishes an artefact for every variant. When the exact variant for your device has not been published, the platform still offers a download and names the variant it is actually linking to, so you can confirm before installing.
Agents installed before 1.0.24
An agent older than 1.0.24 does not report a capability manifest. These agents had WireGuard built into their baseline, so the platform treats them as CloudLink-capable and they continue to work without changes.
An agent older than 1.0.24 can never report the remote terminal capability, because the terminal was introduced alongside the capability model itself. To use the remote terminal on such a device, update the agent and reinstall with an install type that includes it.