5dive connector

5dive gets no direct access to your server.It can’t run commands, log in, or read or upload files outside two chat folders. We hold no login: no SSH key, no password, no root, and the connector never asks for one.

• Opened to the internet:ports 80 and 443. Behind them, one small server that does nothing without your server’s connector key.
• What 5dive.app can do:list your agents, their org chart, projects and tasks; give them tasks and follow up; answer the questions and approvals your agents ask you; chat with them (and turn that chat on for an agent) and pass chat files through two folders; read your server’s version, time zone, AI account names, lead agent’s Telegram bot, and whether an update is out.
• What it can’t do: run commands, add or remove agents, change AI accounts or keys, install plugins, update or reboot the server, or log in over SSH.
• The one indirect path: your agents read the tasks and chats that arrive, and act with the permissions you gave them. So whoever controls 5dive.app could steer your agents, or approve what they ask you.
• What 5dive sees:your server’s IP, its disk, memory and uptime, the names of your agents, projects and AI accounts, your tasks, and the chats you send through it.
• The one key we keep: 5dive.app stores the connector key, because it uses it to call your server. It opens only the commands listed below.
• See it and stop it: sudo 5dive-connector log shows every call. sudo 5dive-connector disconnect deletes the key on both sides, your server first.

curl -4 -sSL https://api.5dive.com/connector/install.sh | sudo bash
sudo 5dive-connector connect

The install only puts files on the server: nothing listens yet. connect prints what it opens, then a code and a link. Open the link signed in to your 5dive.app account and enter the code. That is the moment you agree. The code works once, for 10 minutes.

Read this page on the server any time: 5dive-connector about.

• Port 443:Caddy, with a free Let’s Encrypt certificate for your server’s IP. Port 80 must be open too, for the certificate.
• Behind it, one small server on 127.0.0.1:3111(Python, standard library only). Every call needs your server’s connector key.

Nothing listens until you run connect.

Only these 5dive commands. There is no shell.

Everything else is refused: running commands, creating or removing agents, changing AI accounts, installing plugins, support access, SSH keys, reboot, updates. On your server the full list is exec_allowed in /usr/local/lib/5dive-connector/lib/connector-server.py.

sudo 5dive-connector log

Every call 5dive.app made to your server, refusals marked.

sudo 5dive-connector disconnect

Your server’s key is deleted first, so every call after that is refused, even if 5dive.app cannot be reached. Then 5dive.app deletes its copy.

sudo 5dive-connector disconnect
sudo rm -f /etc/systemd/system/5dive-connector.service /etc/systemd/system/5dive-connector-tls.service /etc/systemd/system/5dive-connector-ip.service /etc/systemd/system/5dive-connector-ip.timer /usr/local/bin/5dive-connector
sudo systemctl daemon-reload
sudo rm -rf /usr/local/lib/5dive-connector /etc/5dive-connector /var/log/5dive-connector /var/lib/5dive-connector-tls

Caddy stays installed. Remove it with sudo apt-get remove caddy if nothing else uses it.

Behind a home router, forward ports 80 and 443 to the server, or use a VPS with a public IPv4 address. connect tells you when it cannot be reached, and leaves nothing listening.

When your IP changes, there is nothing to do. Every 5 minutes the server checks its public IP, gets a certificate for a new one, and 5dive.app follows as soon as it answers there.