RS Palantir hosting and agent access

For the Mac mini → laptop walkthrough, see cross-device access.

Recommended starting point

Keep one observer service on the machine that runs most of the agents. Agents on that machine use WorldIntelClient, CLI or MCP over loopback. The 3D map renders in the human's browser; a domain or remote API host does not move that GPU work to the server or inherently increase frame rate.

If agents run on several hosts, use one always-on shared observer reachable through a private network. A small Linux VPS (initial candidate: 2 vCPU and 4 GB RAM, subject to measurement) can improve availability and reduce load on the desktop. Choose the region near the agents/game feed, then measure request latency, CPU, memory and SQLite growth at the intended query rate before sizing or scaling. Build the large upstream renderer locally or in CI and deploy the compiled output rather than building on the smallest runtime machine.

A domain provides a stable address and TLS routing. It does not make the upstream feed fresher, broaden the single detailed observation rectangle, expose missing inventory data, or increase browser rendering speed.

What works today

• Localhost HTTP, SDK and both MCP entry points work without an open browser.

• The server binds 127.0.0.1; Host and Origin checks accept its local origins.

• WorldIntelClient only accepts loopback HTTP URLs. RS_WATCH_URL can select a forwarded local port.

• An SSH local forward provides remote access without changing those boundaries. Run it from each agent host, using a host/account the operator has configured:

  sh

  1	ssh -N -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -L 127.0.0.1:5197:127.0.0.1:5197 USER@OBSERVER_HOST
  2	# In the agent environment:
  3	export RS_WATCH_URL=http://127.0.0.1:5197

  The forwarded local port must match the observer port because the server validates Host/Origin including that port. If 5197 is occupied locally, deliberately run the observer on a shared alternative such as 5198, forward 127.0.0.1:5198 to the host’s 127.0.0.1:5198, and set RS_WATCH_URL accordingly. Forwarding local 5198 to host 5197 is rejected.

A private network such as Tailscale can carry the SSH connection. Tailscale Serve can expose a private service URL, but direct domain access is not yet configured here: Host/Origin handling and client URL policy need an intentional deployment change. Keep the browser UI behind the same origin as its API and WebSocket routes.

Before a direct HTTPS/domain deployment

Implement authentication and per-agent access policy, trusted proxy/allowed-origin configuration, HTTPS/WSS URL support and WebSocket forwarding. Separate read-only observations from watch/waypoint/camera writes; camera commands affect one shared view. Add service supervision, durable storage, backups, request limits and health/freshness monitoring. Keep credentials and local observation databases out of Git.

Neither the HTTP query interface nor browser viewers have a fixed application count limit. Browser views share one upstream feed, and slow viewer connections are disconnected individually. Practical concurrency remains bounded by browser/GPU and server resources. Nevertheless, avoid every agent downloading /api/state repeatedly. Prefer bounded /api/intel queries, reuse a client, cap concurrency and poll around once per second only when the workflow needs fresh observations. Fleet-wide capacity has not been benchmarked; a successful single-agent request is not proof of hundreds of agents at that rate.

Packaging

Source and static definitions are in this standalone repository. Runtime observations live in data/intel.sqlite with its WAL files; the pinned renderer is built into vendor/rs-world/build, with terrain/cache assets under data/viewer-cache. The frontend is dist. These generated/runtime directories are ignored by Git and must be built or deliberately provisioned on a new host. Preserve existing observation data during migrations.

No hosting purchase, DNS change, public exposure or production bot migration is implied by this guide.

References: Tailscale Serve, private development-server access.