Server kit

This is what goes on the machine you want to drive. The agent is a single file, golem.exe. There is no installer: copy it wherever you want and launch it. It does not touch the registry, does not create services and leaves nothing behind except its own log next to it.

The agent carries no license and does not charge for connecting. Copy it to as many machines as you like. What is licensed is the client, at the other end (Installation).

If the server has nobody in front of it, the Guardian lets your technicians in without anybody starting the agent. It comes with Golem Company.

Looking for the program that lets someone help you with your computer? That is Golem Assist: one file, one button and twelve digits. It is on the Assistance page. The two side by side: Which one do I download?

Get-FileHash -Algorithm SHA256 "$HOME\Downloads\Golem-Server-1.6.0.zip"

What the kit brings

Which of the two .bat files

In one question: can this machine be reached from outside? A VPS, a server with a public IP, or a machine on the same network as the technician: the first one. A home PC, one connected through a phone, or one inside a company network: the second one, because there is no port to open there and the connection has to go out from this machine. The second one does not need administrator.

Launching it

Double-click the right .bat. On startup the agent prints a banner with the machine, the port, the audit log, the tools and, at the end, the golem_connect line, which it has already copied to the clipboard: just paste it (Ctrl+V) into Claude's chat, or into the email or message you send your technician.

The line is not saved to any file, and that is on purpose. The token changes on every run, so a line saved on disk is a dead line that looks alive. When you close the window or press Ctrl+C, the agent shuts down in an orderly way and writes that in its log.

The three ways to launch it

Three things about the tunnel

1. The address changes on every run, just like the token. Wait about ten seconds before pasting the line: the name appears on screen before DNS can resolve it.
2. Through the tunnel, nothing can take longer than 125 seconds. That is a Cloudflare limit: a run_powershell of more than two minutes, or a long wait, dies there. Launch the job in the background and ask about it in short rounds.
3. It is Cloudflare's free service, with no availability commitment. For helping a customer for a while it is plenty; for something that must be up at a fixed time, use the public IP with a fingerprint.

TLS and the firewall

TLS is on by default. The agent generates its own certificate on every run and the golem_connect line carries its fingerprint at the end; that is why you paste it whole. With --no-tls the token travels in the clear: fine for a LAN, not for the internet.

If you launch it as administrator, the agent adds its own inbound rule for its port (Golem-agente-8797) and removes it on the way out. From a normal console it cannot, says so and gives you the whole netsh command. With a tunnel there is nothing to open.

An agent with fewer hands

If on that machine you only want people to look, launch it with --read-only (or double-click Start - look only, server with public IP.bat). It publishes only the tools that look: host_info, files, screenshots, processes, the state of services and whatever FoxAgent inspects. run_powershell, writing files, starting or killing processes and the scripts in scripts\ are not published; service is, but it only answers action=status. For something finer there is --allow with a list of patterns, and the two go together: what matches and looks goes through.

golem serve --read-only

Your scripts and the machine's MCP servers

scripts\: every .ps1 you leave in that folder, next to golem.exe, is published as one more tool, with the description and parameters the script itself declares. It is read on startup.

golem.mcp.json: if there is an MCP server on that machine (FoxAgent, say), Golem starts it on launch and publishes its tools as <alias>__<tool>. It has the same shape as Claude's .mcp.json; write the full path, because Golem does not search the PATH:

{
  "mcpServers": {
    "foxagent": {
      "command": "C:\\Program Files\\FoxAgent\\FoxAgent.McpHost.exe",
      "args": []
    }
  }
}

If a server goes down, the next call relaunches it, at most once a minute. When the agent shuts down, it takes the servers it started with it.

What it writes down

golem-audit.log, next to the exe and in Spanish: one line per call: which tool, which arguments, how long it took, how it ended, and one per file moved, with its sha256. It carries no token, so it can be shown to anyone.

It also notes which license each client said it connected with, and the agent does not check it and turns nobody away because of it:

… [agente] -- sesion abierta -- el cliente dice: modo licenciado, id _GY9C452T (4c77b9d2)

Checking on it without a token

GET /health answers anyone who reaches the port, without credentials: status, version trimmed to major.minor and how many tools. GET /sessions gives how many sessions are alive. Neither returns tokens. Everything else requires the token. If you do not want to expose anything, start it with a tunnel or with --host 127.0.0.1.

Updating

Copy the new golem.exe over the old one and launch it again. Nothing on disk depends on the version. If it was running, close it first: a running executable cannot be overwritten.