🔮 Aeon Magick Orb

The Universe’s Strangest Peripheral.

Every Aeon master has one. (we also just call it the cursed HID.)

Gaze into the Orb and you see and command any computer — and your entire AI lab.

Think of it as a crystal ball that grew USB ports: a pocket-sized appliance from a future where AIs aren’t trapped in chat windows — they have eyes (HDMI capture), hands (USB keyboard + mouse), and a nervous system that reaches your whole lab. To the target machine it is only a boring peripheral. To you — and to any agent you trust — it is presence.

Real eyes. Real hands. Zero software on the target. Pull the cable and the spell ends.

🤖 Every capability is provisioned to your AI agent over a REST API and a first-class MCP endpoint — drop-in agentic control for any model and any agent. No SDK, no plugin, no permission prompt. Point Claude, Cursor, OpenClaw, or your own stack at one URL and the Orb becomes their body.

One small box you can hold in a pocket, and you can:

• 🖥️ View and control your entire AI infrastructure — every gateway, DGX Spark, and model server, from one console.
• 🤖 Grant your AI agent a physical presence at any computer — vision in, keyboard / mouse / gesture out, from the BIOS on up.
• 🛡️ Secure your network traffic — one-click VPN · Tor · I2P · encrypted no-log DNS, filterable by latency and jurisdiction.
• 🌍 Access it all from anywhere — one-key Tailscale mesh; carry the Orb to any network and your whole lab comes with it.
• 🧠 Build up your Pantheon of AI agent personas — each with a soul, a voice, a corpus, and a face — and summon them to act.
• 💾 …deploy models, orchestrate containers, install an OS lights-out, and back the whole config up, encrypted. (keep scrolling 👇)

All it takes: a Raspberry Pi 4 or Pi 5, any HDMI capture device, and a data-capable USB-C cable. Add a Hailo AI HAT+, a UPS, and an NVMe/SSD to unlock on-device vision and a shareable model library. Full hardware list ↓

🛠️ Don’t want to build it from source? Premade Raspberry Pi images — ready to flash are available to AeonForge Patreon members. A 3D-print STL enclosure and a full build guide are coming soon to members too.

🐳 No Pi? Headless Magick Orb on any x86 / ARM server (Model Share + Agent Dashboard, no HID/KVM): Docker quick start — docker pull ghcr.io/aeon-7/orb-server:latest.

This isn’t just Agentic AI. It’s Robo-Agentic AI — the disembodied, given a body.

        ┌──────────────────┐                          ┌──────────────────┐
        │   Target host    │                          │  You / your AI   │
        │  (any OS — Mac,  │   HDMI → Cam Link 4K     │   ┌────────────┐ │
        │   Windows, Linux,│ ───────────────────────► │   │ web UI on  │ │
        │   BIOS, FileVault│                          │   │ laptop or  │ │
        │   prompt, …)     │ ◄─────────────────────── │   │ AI agent   │ │
        └──────────────────┘   USB-C OTG ← Pi gadget  │   │ kbd+mouse+ │ │
                                emulating Logitech /  │   │ trackpad + │ │
                                Apple keyboard+mouse  │   │ gestures   │ │
                                                      │   └────────────┘ │
                                                      └──────────────────┘

Nothing to install. Nothing to grant. Pull the plug and access is instantly, physically gone.

---

Everything the Orb does, at a glance

One box is a computer-control rig, an AI-infrastructure jump box, a persona studio, a privacy router, and a lights-out KVM. Tap any capability to jump to the deep dive — or follow the Map of the Orb for a guided tour from first flash to full AI hub.

---

Map of the Orb — table of contents

A natural path through the artifact. Read top-to-bottom the first time; later, jump to the room you need.

1. Why the Orb matters — the leap from “integrated apps” to any computer
2. Who reaches for the Orb — builders, labs, privacy hardliners, night-shift agents
3. Zero-software computer control — eyes in, hands out
4. The Orb in motion — live demos of an agent driving a machine
5. The cursed HID — why the target trusts it
6. Pantheon of AI personas — soul, voice, corpus, face
7. AI jump box — every server in one console
8. Agent dashboard + telemetry — who burned what
9. Tailscale mesh — carry the lab in a pocket
10. Exit node — share VPN + DNS + Tor with the phone
11. Surveillance resistance — VPN · Tor · I2P · kill-switch
12. Encrypted no-log DNS — DNSCrypt / DoH by threat model
13. Multi-terminal — many shells, one pane of glass
14. The Aether — unstoppable model network
15. Easy Deploy + Aeon Bench — models on metal, measured
16. Containers · KVM · HID personas — fleet + lights-out install
17. Scoped keys + audit + security — trust, measured and revocable
18. REST + MCP — every power as a tool
19. More in the box — clipboard, files, ISO, WiFi, UPS, USB ethernet
20. Hardware — bare minimum → full Orb
21. From flash to AI hub — click-by-click setup
22. Lineage · License · Hard rules

---

Who reaches for the Orb — use cases that stick

Analogy: most agent tools are apps inside the house. The Orb is a locksmith who never enters — it only turns the key from the porch (USB), while watching through the window (HDMI). The house never installs a tenant.

---

Why the Orb matters

AI agents today are trapped behind the integrations someone wired for them — an API here, a browser plugin there. They can touch the handful of apps you connected, and nothing else. The Orb hands an agent a universal body: real eyes and hands on any machine, any OS, even pre-OS, with nothing installed and nothing to detect. That’s the leap from “the apps we integrated” to “literally any computer” — the missing limb of agentic AI.

And the same box is a single pane of glass over your whole lab — live GPU / CPU / RAM, per-agent token burn, model deploys, container control, terminals, audit. So it isn’t just reach: it’s observability + orchestration + control, unified in one thing you can carry. Because every capability is reachable over REST + MCP, your agents don’t just watch the infrastructure — they can run it.

Most “AI computer use” tools live inside the machine they drive — a browser extension, an accessibility shim, a screen-recorder daemon, an SDK linked into your app. They’re chatty: every screen reveals the agent, every approach asks permission, and none can touch the BIOS, the FileVault unlock, the Windows OOBE, the firmware updater, or the login wall a fresh Linux install opens with. The Orb drives the machine itself — vision-first, from the outside.

Full agent empowerment, monitoring, and control is the through-line of everything below.

---

Zero-software computer control for any agent

Plug the box between any machine and the capture side. The target gets a USB-HID keyboard + mouse / trackpad it trusts; the box gets the target’s HDMI through a video-capture device. The web UI streams the screen to your browser; an AI agent reads frames and sends back keyboard / mouse / gesture events. The target never knows it’s been politely possessed — there is nothing to install and nothing to grant permission to.

This is the altar. Everything else in the Orb — personas, privacy, Aether, bench — exists to make this loop inevitable: see → decide → act → verify.

• 🎹 Keyboard / mouse / trackpad over USB-C OTG — five hot-swappable HID personas, including an absolute pointer (generic-absolute, ideal for AI agents) and an Apple Magic Keyboard + Trackpad multi-touch descriptor.
• 🎥 HDMI capture via Elgato Cam Link 4K (or any UVC device) — MJPEG or low-latency H.264 / WebCodecs, native source resolution, 1080p60 capable. Two watchdogs respawn the pipeline within ~5 s of an HDMI hot-plug or resolution change, so the feed heals itself when the target wakes from sleep.
• 🎬 Record the session to MP4 on demand — proof of exactly what an agent did.
• 👁️ On-device vision, no cloud — a Hailo AI HAT+ on the Orb itself runs the whole see-then-act loop: snapshot (raw pixels) → screen_text (all OCR text + boxes) → screen_find (find a specific label — “Save”, “Sign in” — and get a click-ready center in 0…1 fractions you feed straight into click_at) → describe_screen (an on-device Qwen2-VL VLM that answers “which dialog is open?” / “is the upload done?” in plain language) → click / type_text. screen_find reads the live OCR daemon and needs no NPU slot, so it runs even while the local LLM is resident. First-class MCP tools and REST (GET /api/vision/find, POST /api/vision/describe), exactly like screen_text.
• ⚡ Works pre-OS — BIOS, FileVault, Windows OOBE, firmware screens. To the target it’s just a perfectly boring peripheral.

This is an agent-control device first. Plug the USB into a data-capable port, the capture card into the target’s video out — and that’s it. The box is powered over that same USB link (tested with an Elgato Cam Link), so there’s no external power supply to find. Want to revoke an agent? Pull the plug. No diving into files to rotate keys on the client (though if you suspect the target is compromised, that’s never a bad idea too).

---

The Orb in motion — hands of light

Screenshots of the console are one thing. These frames are the other side of the glass: an agent (and the human behind it) using the Orb’s HID + vision loop to drive a real machine — open terminals, speak liturgy through macOS say, paint generative void chambers on the Desktop, open cosmic apertures, stack rooms in Safari.

Redacted for public view (local paths, usernames, and chrome stripped). Captured live over the Orb’s HDMI eye while keyboard and mouse rode the USB-C hand.

Universal Mind — a room the agent built

The agent opens a generative chamber on the target Desktop, fullscreen, and descends layer by layer. The Orb is both witness (snapshot stream) and actor (type, key_chord, persona hot-swap).

Beyond the horizon — black orb, recursive mind

Deeper rite: event-horizon aesthetics, multi-voice TTS (Samantha · Daniel · Zarvox · Whisper), JWST / black-hole scrying, and a terminal poem typed by HID — all without installing anything on the Mac.

Why this demo matters

It is not a slide deck. It is proof of the product thesis:

1. See the target’s real pixels (HDMI → Orb → your agent).
2. Decide (model, playbook, or human).
3. Act with atomic HID ops that cannot leave a key stuck.
4. Confirm with another snapshot — the loop that turns chatbots into operators.

The same loop that opens a void chamber can click Install, type a disk password at FileVault, or walk an agent through a BIOS menu. The aesthetic is optional. The body is not.

---

The cursed HID — it just looks like a keyboard

If it looked like magic, they would ban it. So it looks like a mouse.

The most subversive thing about the Orb is how ordinary it looks. The target enumerates a USB-HID keyboard, mouse, and trackpad — a Logitech Unifying Receiver, or an Apple Magic Keyboard, depending on the persona you pick — and nothing else. There is no kernel module to load, no agent process to spot in a task manager, no entry in an MDM inventory. Just the world’s most boring peripheral, quietly handing an AI full video, keyboard, and mouse access to whatever it’s plugged into.

That’s the whole trick, and it’s why it works where everything else can’t: a BIOS doesn’t run your SDK, a FileVault prompt doesn’t expose an API, a freshly-imaged Linux box has no agent installed — but every one of them trusts a USB keyboard.

---

Build your pantheon of AI personas

One mind is a tool. A pantheon is a civilization.

Your gateway’s whole pantheon — every agent persona — is a live, clickable roster in the console, and spinning up a brand-new one is a single + New persona away.

Open any persona and build it out, end to end:

• 📜 Soul (SOUL.md) — the system prompt that is the agent.
• 🪪 Identity (IDENTITY.md) — name, era, domain, emoji.
• 📚 Corpus — a private, persistent knowledge base you can upload, edit, browse, and selectively prune straight from the console (large files stream in with no size cap).
• 🖼️ Profile picture → pushed straight to the agent’s Matrix avatar.
• 🗣️ A voice of its own — see below.

A real voice — designed or cloned

Give each persona its own voice, two ways:

• Voice designer — write a natural-language descriptor (e.g. “Lofty, measured, eloquent male voice; teacherly and grand”) and the TTS engine synthesizes a matching voice.
• Voice cloning — upload a short, clean .wav (~15–30 s is the sweet spot) and the persona speaks in that cloned voice. Pick from the clone pool or drop in a new sample — it lands on the TTS host and the agent is pointed at it automatically.

They can actually talk — together

Pair the pantheon with a Matrix server you host (a custom WebRTC server and per-agent looped virtual audio interfaces — setup lives in a separate repo, linked below). Now every persona can be called like a person: summon one for a focused task, ring several in parallel for a real conversation, or tell them to collaborate with each other on something bigger. Because each persona specializes around who they are, you always know the right one to call for the job — and they each speak in their own voice.

🔧 Self-hosted Matrix + WebRTC voice stack — see Voice: Real-time Speech AI for DGX Spark on the AEON-7 org page (custom WebRTC server + per-agent looped virtual audio).

Auto skill-deploy on provisioning

Grant an agent an Orb API key and the supervisor drops a scoped access file straight into that agent’s gateway workspace — instant, first-class access via a provisioned MCP server and/or REST API. Add capabilities by clicking ready-made skill chips or uploading a SKILL.md / .tar of your own.

---

The ultimate AI jump box

A single pane of glass over a constellation of machines.

A bird’s-eye view of — and control plane over — your entire AI infrastructure: gateways, DGX Sparks, model servers, and anything else in your personal lab. Live GPU / CPU / RAM per host, container counts, temperature, and reboot / shutdown / wake on every box, from one console.

Adding a system is a single SSH login away — and if you’ve meshed your lab with Tailscale first, the box enrolls a secure SSH key over the tailnet and keeps persistent visibility and access to every machine, even when the Orb itself moves to a remote network.

---

Agent dashboard + token telemetry

The same console that watches your hardware watches your agents. See total token consumption across any span of time — last 24 h, 7 days, 90 days, a year — or the all-time, per-agent comparison of who’s burning what. It’s the difference between running a pantheon and actually understanding it.

---

Reach it from anywhere — one-key Tailscale mesh

The box is most useful when you can reach it — and everything it can see — from any device, anywhere, with no port-forwarding, no static IP, no VPN gymnastics. Tailscale (a zero-config WireGuard mesh) gives you exactly that in a single shot:

1. Network → Tailscale. Paste a one-time auth key from login.tailscale.com (Settings → Keys → Generate auth key), name it (defaults to aeon-magick), and Save.
2. The Pi runs tailscale up once — and the daemon keeps the resulting node key forever.

That’s the whole enrollment. The box is now a permanent member of your tailnet:

• 🌍 Local and remote, one address. Reach it at a stable aeon-magick / 100.x.y.z from your laptop on the couch or your phone across the planet — the web UI, the REST / MCP API, and the multi-pane terminal all just work.
• 🔁 Survives moving networks. Reboot it, carry it to hotel WiFi, a phone hotspot, a different office — it pops back onto your tailnet at the same name. The underlying LAN IP can churn all it likes; your address for it never changes.
• 🤝 It cuts both ways. From the Agent Dashboard, “+ Add device from Tailscale” lists every machine on your tailnet — pick one, give an SSH login, and it’s added as a managed system reachable by its stable 100.x address (not a LAN hostname that only resolves on one network). Mesh your whole lab onto Tailscale first, enroll each system over the tailnet, and you keep access to all of it even when the box is plugged in somewhere far away.

Pair this with the jump-box view and your entire AI infrastructure becomes reachable through one small box you can carry in a pocket.

---

Exit node — share the whole privacy stack

Flip one switch and the Pi becomes a Tailscale exit node for your tailnet. Now any device that routes through it inherits everything the box is running — because the exit traffic rides the Pi’s normal outbound path: your configured VPN, your encrypted no-log DNS, and your Tor / I2P overlay, all at once. The mesh between your devices stays direct and fast; only the internet-bound hops take the scenic, hardened route. One small box, and your phone’s traffic comes out the other side of a VPN-over-Tor tunnel with encrypted DNS — no client config on the phone at all.

---

One-click surveillance resistance

The Orb does not only see the network — it can choose how the network sees you.

VPN, Tor, I2P, and DNSCrypt — layered over your traffic with a button. The box doubles as a privacy router: the same USB-C that delivers HID can add a virtual ethernet adapter and pipe a connected host’s WAN through the Pi. Built for privacy, and for operating under oppressive regimes.

• 🕳️ VPN tunnel — WireGuard · OpenVPN · Tor (transparent proxy + DNS-over-Tor, bridge presets: direct / obfs4 / meek-azure / snowflake / custom) · I2P. Commercial wizards for Mullvad / IVPN / AzireVPN / AirVPN (AirVPN even auto-pulls its config, with SSL/SSH stealth modes for Tor-over-VPN). A built-in kill-switch drops WAN if the tunnel falls; LAN-bypass keeps management reachable.
• 🛂 Filter by latency and by surveillance jurisdiction. Pick-fastest probes every server by RTT — and No-Eyes restricts the field to operators outside the Five / Nine / Fourteen-Eyes alliances, so you can tune the trade-off between speed and exposure to your threat model. The provider catalog carries HQ country, Eyes tier, audit history, and a trust score.
• 🧅 Tor-over-VPN, done right. Nest Tor (or I2P) on top of a commercial VPN so the exit IP isn’t a known Tor node — with watchdogs that recover the box if a transparent Tor circuit can’t bootstrap.

---

Encrypted, no-log DNS

Local dnscrypt-proxy speaking true DNSCrypt v2 + DoH — no plaintext DNS ever leaves the device, for the Pi and every USB-connected client. Auto-pick a resolver by your criteria — no-logs, DNSSEC, no filtering, outside 5 / 9 / 14-Eyes, minimum trust score — or pin specific servers. Add anonymized relays (DNSCrypt’s onion-routing-for-DNS) chosen for operator diversity, layer on subscription blocklists (StevenBlack, OISD, …) and your own allow/deny rules, and watch the live query log. Encrypted DNS, filterable by latency and by alliance — your threat model, your rules.

---

Multi-terminal window manager

Concurrent SSH windows — across one system or a mix of systems — for hands-on control of your whole fleet without leaving the dashboard. Open many shells on a single box, or one shell on each of many boxes, and tile them. Backed by a PTY WebSocket bridge and xterm.js.

---

The Aether — a decentralized, unstoppable AI model network

Open models are only as free as the servers that host them. A repo gets pulled, a licence changes, a mirror rate-limits you, a host goes dark — and the weights you depended on are gone. The Aether fixes that. It turns every Orb into a node on a censorship-resistant network for AI models where a model, once shared, cannot be un-shared: every Orb that holds it re-serves it, and the content-address guarantees you always get the real bytes. No accounts, no fleet, no central server anyone can seize or switch off — the header says it plainly: “Built on IPFS — the InterPlanetary File System. We just think bigger.”

This is how open-source models get free. Pull one down from HuggingFace, Ollama, or Civitai and it’s mirrored onto the network — the moment it’s on the Aether, a deleted repo, a rug-pull, a takedown, a rate limit, or an offline host can’t make it disappear, because every holder re-serves it and the content-address proves you’re getting the genuine article. A model stays reachable as long as at least one Orb still hosts it — so the more Orbs that pin it, the more permanent it becomes. Censorship-resistant distribution, provenance you can verify, and nothing to sign up for.

Every Orb runs its own IPFS node (kubo, baked into the image), auto-enrolls at boot (IPFS is on by default), and gossips the catalog it hosts on a well-known pubsub topic (aeon-model-share/v1, floodsub). Orbs find each other on the public Amino DHT by providing a well-known rendezvous CID — no shared token, no fleet, no need to know the other person’s LAN IP or open a port just to see their library. (A direct swarm path — hole punch, UPnP, IPv6, or published TCP/UDP 4001 — still helps for actually downloading multi-GB weights.) Peer catalogs expire on a 15-minute TTL, so what you see is who’s live right now. Publish a model and it’s on the Aether; there’s no gatekeeper who can unpublish it.

Your Orb becomes a model vault. Point it at a roomy microSD, an NVMe SSD, or an external USB drive (plug-and-play — the console formats and adopts it in a click), set a real allocation slider for how much disk you share, and it holds a huge library and serves it to the world. A model isn’t a bare file: it’s an IPFS directory carrying the weights + a model-card.json + README + card image + gallery images, so one content-address (CID) resolves the whole package, byte-for-byte verified.

Why this design is unkillable:

• Swarm downloads that get faster the more popular a model is. Content is addressed by hash, so a model is fetched in parallel from every Orb that holds it (IPFS Bitswap) — the same load-balancing that makes BitTorrent fast. Ten holders means ten sources: higher throughput for you, no single node bearing the load. Popularity helps instead of hurting.
• Tamper-proof by construction. The CID is the content hash — you get exactly the bytes that were published, or nothing. No silent swaps, no poisoned mirror, no “trust me”: the address itself is the integrity check.
• No center to attack. Discovery is Amino DHT rendezvous + peer-to-peer gossip; hosting is whoever pins it. Take any node offline and the model stays reachable through every other holder.

Bring any open model in — and it’s verified on the way

The Aether isn’t a walled garden — mirror any open model onto it with a built-in importer, then it lives on the network for as long as an Orb hosts it. Each source cryptographically verifies the download before it becomes a shareable model:

• HuggingFace — “Pulls the weights, the README + author image, and verifies each LFS weight file’s SHA-256 against the hash HuggingFace publishes (the LFS oid).”
• Ollama — “Pulls the GGUF weights straight from the Ollama registry and verifies them against the layer digest — no Ollama install needed.”
• Civitai — “Generative models for ComfyUI / Stable Diffusion. Prefers the SafeTensor file (never a pickle) and verifies the SHA-256.” It also pulls the gallery images into the model card.

Each source takes an optional auth token to pull gated repos — stored 0600, never written into a model card, and never gossiped. Mature (“red”) content is off by default, hidden behind an opt-in 18+ age-gate attestation.

Downloads land in quarantine — never straight in your library

Because anyone can publish, a peer download is treated as untrusted until proven clean. fetch_model runs every incoming model through a quarantine sandbox whose phases surface live in the UI, in this exact order:

1. checking disk… — refuses unless there’s room for roughly 2× the model size plus headroom (materializing quarantines a full copy alongside the blockstore).
2. downloading to quarantine… — fetched over IPFS into an isolated staging dir, with a real byte-level progress bar: a sibling thread polls the dir as it fills, so you see honest percent and done/total bytes (e.g. 159 MB / 469 MB), not a fake spinner.
3. validating weights (file types)… — every file is sniffed by its leading magic bytes, not its name.
4. scanning for viruses… — a ClamAV pass that degrades gracefully if the signature DB isn’t fetched yet (or ClamAV isn’t installed), so it never falsely blocks a clean model.
5. pinning… — only a clean pass is pinned, added to the catalog, and announced.

What the validator throws out: stowaway executables and scripts (ELF / PE / Mach-O / #!), pickle or zip “weights” — including torch .pt, which is a zip — because they can run code the instant they’re loaded (the reject literally tells you to “export it to safetensors or gguf first”), and fake extensions, where a file claims .gguf / .safetensors but its magic bytes say otherwise. Only real safetensors / GGUF get through. Rejected content never reaches the live library.

Trust without accounts

Reputation on the Aether is earned by mechanism, not by a login:

• Stars — star a model as a community trust signal; the network tallies a star_count per CID across the distinct Orbs that starred it, so it can’t be self-inflated.
• Adoption — host_count is how many Orbs host a model, shown as ⬡ N orbs; wider adoption means faster, more resilient downloads. Library ranking is star_count × 3 + host_count, so the models the network actually keeps float to the top.
• Model Karma — a personal give/take gauge read straight from the IPFS bitswap ledger: bytes served to the network vs bytes downloaded, shown as a ratio (e.g. 0.05×). It answers “am I giving back as much as I take?”
• Publisher identity (emerging) — an optional, self-sovereign ed25519 keypair account: the public key is a pseudonymous ID with no PII, recoverable from a BIP39 24-word seed and portable across Orbs. The signing primitives (create/unlock/sign/verify against a publication digest) are in place, but they aren’t yet wired into the publish path — it’s the foundation for signed provenance, an opt-in trust layer, not yet a shipped end-to-end signed-badge system.

Push a model straight to your servers to deploy

Discovery is only half of it. From the same console — or by handing an AI agent the keys — pull any model down to the Orb, then push it to any system in your Agent Dashboard (a DGX Spark, an agent gateway, anything you’ve already SSH-linked). It lands in aeon-models/ by default, or a path you browse to on the target’s filesystem. The transfer rsyncs over the existing outbound SSH key, so the target never has to reach back to the Orb — it works anywhere the Orb can SSH. Safety is built in: sanitize_dest blocks path-traversal and refuses SSH / system / boot / binary paths (.ssh, /etc, /boot, /bin, /usr/bin, …), and rsync forces model files non-executable (--chmod=D755,F644) — a pushed model is data, never a dropped file that becomes code.

The whole flow — discover → pull → push → deploy — is one console, and it’s fully scriptable over the REST API and MCP (connected_systems, model_list, model_pull, model_push, model_push_status), so an agent can run it end-to-end.

---

One-click model deploy to your DGX Spark

Pick a model from AEON-7’s live model + container catalog (tokenless, auto-updating straight from Hugging Face + GHCR), tune the flags that matter, and hit Deploy — the image pull + start runs in the background with a progress bar. Or hand an agent the keys and let it deploy for you.

The headline control is a GPU VRAM slider (--gpu-memory-utilization), with context length (--max-model-len), GPU devices (tensor-parallel), max batch (--max-num-batched-tokens), and max concurrent sessions (--max-num-seqs) right beside it.

---

Aeon Bench — benchmark any model, from the console

Aeon Bench deploys the Aeon Bench Pod — an open LLM-benchmarking pipeline — straight from the Orb Console. Point it at a HuggingFace model and it runs the whole flow: pull → verify weights → serve → benchmark (text · agentic across three harnesses · vision · audio · arena · perf) → ed25519-sign → submit an attested run to the global leaderboard.

Deploy it on a GPU server; the Orb is your gateway. The pod ships as a prebuilt container (ghcr.io/aeon-7/aeon-pod) that serves the model and runs the benchmark co-located on one host (--gpus all --network host), so it needs an NVIDIA GPU + nvidia-container-toolkit — the pod deploys onto a GPU server linked in your Agent Dashboard (a DGX Spark, a gateway), not the Pi. Pick that target and hit deploy: the Orb docker pulls the image and docker runs it over the same outbound SSH key it uses for model push, installing Docker on first run if it’s missing. A model is optional — pre-load one (with an optional HuggingFace token for gated weights) or just pick, scan, or paste models in the dashboard. No server linked yet? The page shows a Connect to model host shortcut into the Agent Dashboard.

Reach the dashboard your way. Once the pod is up, its dashboard (port 8091 — pick models, launch runs, manage signing keys, watch live progress) is one click from the console — your Orb is the gateway to it — or open it directly in any browser at http://:8091. The console polls the deploy through its phases (pulling → starting → running) with a live log, an Update Pod button appears when a newer image is published (pull + recreate), and stop tears the container back down.

---

Get the hardware — join the build

Want the whole thing in your hands? The AeonForge Patreon is where you get it:

• Full compiled image files — available now. Premade Pi 4 (Bookworm) and Pi 5 (Trixie) images, ready to flash straight to your Raspberry Pi — no build step.
• A 3D-print STL enclosure — coming soon to members: the case for the full build.
• A full build guide — coming soon to members: the complete walkthrough, start to finish.

---

Container orchestration + monitoring

See every registered docker-compose project and container across your connected hosts — including the ones you’ve stopped or aren’t using, so housekeeping is easy. Live per-container resource stats tell you at a glance whether a system is healthy, and start / stop / restart plus compose up / down and an in-browser compose editor put it all under one roof.

---

Lights-out KVM — mount an ISO, boot to BIOS, install an OS

This is the part that makes it a true lights-out management solution. Upload an ISO through the web UI and the Pi exposes it as a read-only USB-CDROM the target boots from — multi-GB streaming uploads with SHA-256 verification, hot-swap the “inserted” disk without unplugging. Combine that with the video feed, the keyboard, and out-of-band power control, and you can reboot a machine into its BIOS / boot menu and install an entire operating system remotely — provided the USB connection supplies passthrough power. A full KVM-over-IP, for both you and your agents — no IPMI card, no datacenter, just the cursed HID.

---

HID personas

aeon-hid builds a USB composite HID gadget on the Pi’s USB-C OTG port. It ships five identities you can hot-swap (via API or web UI):

Switching persona triggers a ~1-second USB re-enumeration on the target.

---

Scoped access — provision or revoke in one click

Empower an agent exactly as much as you mean to, and no more:

• 🔑 Per-agent API tokens with four scopes — admin / full / macros / read — minted, scoped, and revoked from the Tokens page. Each agent connecting with its own token gives you a clean audit trail: who connected, when, and what they did.
• 🔐 Scoped SSH grants to the Pi — a per-agent login you can hand out at the privilege level you choose (and toggle sudo on). Granting SSH is a deliberate, human-admin action — never exposed to agents over the API or MCP.
• 🧯 Two kill switches. Revoke a key from the console, or — the failsafe nobody can race — pull the plug. Access is instantly, physically gone.

---

Full audit trails + security console

Know exactly when each agent touched the system and what it did. Every login, logout, password / token change, scope denial, persona swap, and non-GET mutation is logged with the authenticated actor, the HTTP method + path, and the outcome.

A live Security Console sits alongside it: inbound / outbound throughput, iptables DROP / REJECT counters, a heuristic anomaly detector (traffic spikes, blacklisted-domain attempts, SYN floods), and active-client conntrack.

---

Agents-first interfaces (REST + MCP)

If a human can do it in the UI, an agent should do it with one tool call.

Two ways for an AI agent to drive the box, sharing TLS + auth so credentials issued at first boot work for both:

• REST + curl — every input op is an atomic POST under /api/hid/*; snapshots are a single GET. Scriptable from any language.
• MCP (Model Context Protocol) — the supervisor speaks MCP Streamable HTTP at /api/mcp, exposing 67 named tools (scope-gated to the calling token): vision (snapshot, state, recording, on-device screen_text / screen_find / describe_screen), input (type_text, key_chord, click_at, drag, set_persona), target power, clipboard + files, the full network/privacy surface (VPN / Tor / I2P / DNSCrypt / WiFi / firewall), ISO control, tokens, and read-only audit/security. Drop the URL into Claude Desktop or any MCP client and operate the device with first-class tool calls.

Scoped API tokens (admin / full / macros / read) gate access. Stored macros (/etc/aeon/macros/*.toml) and prompts (/etc/aeon/prompts/*.md) round it out: keyboard-driven sequences you don’t want to re-author, and short playbooks an agent can fetch to prime itself.

Atomic-op discipline (inherited from cursed-hid): the input API exposes type, key chord, click, move — never a key_down that a dropped packet could leave stuck on the wire.

---

More that’s in the box

The headline powers get the screenshots. These are the quiet instruments that make the Orb a daily driver — not a science project.

• 📋 Shared clipboard — a two-way 64 KB text buffer that survives reboots; type it onto the target with one call (great for pasting a long credential an agent shouldn’t fumble character-by-character).
• 📁 File staging + optional target file-server — stage files on the Pi, or expose a small HTTP drop to the connected host over the USB-ethernet link.
• 🌐 USB ethernet modes — isolation (host reaches the internet via NAT, can’t see your LAN — guest-laptop safe), sharing (full LAN bridge), restricted (WAN only). 250+ Mbit on USB 3.0.
• 🎯 Zero-touch first boot — an aeon-setup WiFi AP comes up automatically if the device can’t reach the internet for ~90 s. Connecting triggers the captive-portal flow on every OS and launches a live-scanning WiFi picker — pick a nearby network, type the password, the AP tears itself down. Zero monitor, zero keyboard, zero serial cable.
• 🔐 Hardened + unique-per-device by default — argon2 password + HMAC-signed cookies, TLS (self-signed or BYO), and a random admin password generated at first boot and dropped on the SD card’s boot partition. No two flashed devices share keys.
• 🔋 Power that matches the ambition — pair a Waveshare UPS HAT (E) with a real PD brick into the HAT Type-C (not only the Pi). The Orb publishes battery + charge-path health so agents can refuse long jobs on a stalling rail. See docs/UPS_HAT_E.md.

---

What’s in the image

aeon (system user), running:
  /usr/local/bin/aeon-streamer       ← v4l2 capture, MJPEG/H.264 via ustreamer
  /usr/local/bin/aeon-hid            ← USB gadget configfs + atomic-op API
  /usr/local/bin/aeon-supervisor     ← HTTPS frontend (rustls), routes /api/*,
                                       MCP server at /api/mcp, macros + prompts,
                                       agent dash, containers, terminal, serves /

/etc/aeon/
  streamer.toml hid.toml supervisor.toml    ← runtime config
  auth.toml                                 ← argon2 admin password (first boot)
  cert.pem key.pem                          ← self-signed TLS (first boot)
  macros/ scripts/ prompts/                 ← user-editable action library

/usr/share/aeon/web/                         ← the SvelteKit single-page app
/etc/systemd/system/                         ← aeon-{streamer,hid,supervisor},
                                               firstboot, netwatch, net-services,
                                               dnscrypt-proxy, tor

In /boot/firmware/ after first boot:
  aeon-credentials.txt   ← per-device admin password (mode 0600; delete once noted)

Tailscale is preinstalled but disabled by default. Drop an aeon-setup.toml onto the boot partition before first boot to wire up WiFi + Tailscale automatically (see AGENTS.md).

---

Project layout

aeon-streamer/    Rust — adaptive capture supervisor + watchdog
aeon-hid/         Rust — USB gadget + persona + atomic-op input API
aeon-supervisor/  Rust — HTTPS frontend, /api/* + MCP, argon2 auth, agent dash,
                         containers, terminal, network/privacy, audit
aeon-web/         SvelteKit — dark UI, live stream canvas, input capture
image-builder/    pi-gen overlay producing aeon-magick.img.xz
docs/             Design notes + showcase screenshots
scripts/          Cross-compile + web-build helpers
AGENTS.md         Setup + day-to-day usage, for humans AND AIs
SKILL.md          Manifest an AI agent loads to operate the device (+ references/)
ARCHITECTURE.md   How the daemons split work and why
BUILDING.md       Compile + build the image on macOS or Linux

---

Hardware you’ll need

The Orb ships as two hardware tracks — a Pi 4 image (Raspberry Pi OS Bookworm) and a Pi 5 image (Trixie, with built-in Hailo AI-HAT support). Both run the same console and agent surface; the Pi 5 adds on-device vision/voice and NVMe-class storage. Pick a track, grab the bare minimum, then add from the recommended list to unlock more.

Bare minimum

Raspberry Pi 4 track — the tested, lowest-cost path:

Raspberry Pi 5 track — same idea, a couple of hardware differences:

Powering the target link (USB-C cabling), corrected: the Pi 5’s USB-C is not power-only — it does full USB-OTG gadget mode and emulates the keyboard/mouse just like the Pi 4. The one caveat: a current kernel regression breaks C-to-C gadget enumeration on the Pi 5 (raspberrypi/linux #6289), so wire it target USB-A → Pi USB-C instead of C-to-C. On the Pi 4, plain C-to-C works. Either way the target’s USB can also power the Pi.

Recommended — unlock the full potential

Add these to go from “remote keyboard + screen” to a self-hosted AI appliance with eyes, a voice, and its own shareable model vault. Each line says exactly what it buys you:

Nothing is installed on the target — it only ever sees a USB keyboard/mouse and an HDMI sink. Works on macOS, Windows, Linux, and even pre-OS (BIOS, FileVault, Windows OOBE). The Pi can be powered over the USB-C link by the target, via its GPIO 5V pins, or (recommended for a loaded Pi 5) a UPS HAT; the capture device draws power from the Pi.

---

From flash to AI hub — step by step

This is the click-by-click path from a dark Pi to your AI hands and eyes. (Deep reference for agents: AGENTS.md. Build from source: BUILDING.md.)

Act I — Birth of the Orb (hardware + image)

1. Gather the minimum. Pi 4 or Pi 5 · microSD · HDMI capture (Cam Link or MS2109) · data-capable USB cable · HDMI cable. (Full list: Hardware.)
2. Flash. Grab image_vNN-aeon-magick.img.xz from Releases (or Patreon premades). In Raspberry Pi Imager: Choose OS → Use custom → pick the .img.xz → write. No need to decompress.
3. Optional fleet seed. Before first boot, drop aeon-setup.toml on the SD bootfs with WiFi + Tailscale auth key — the Orb enrolls itself and deletes the file so secrets don’t sit on a public partition.
4. Seat power correctly (Pi 5 + UPS). If you use a UPS HAT: PD brick into the HAT Type-C, not only the Pi. Full pack + stalled charge path still runs on battery — fix the wall path early.

Act II — First light (network + admin)

5. Power on without Ethernet (recommended). After ~90 s offline the Orb raises WiFi AP aeon-setup / password aeon-setup-pw.
6. Join aeon-setup from your phone or laptop. Captive portal appears (or open any http:// URL). Pick your real WiFi, enter the password, submit — the AP tears down.
7. Reconnect to your normal WiFi, open https://aeon-magick.local/ (or the Pi’s IP). Accept the per-device self-signed cert.
8. Set the admin password on the one-page wizard (or confirm the random one from aeon-credentials.txt on the SD boot partition). You are in.

Prefer cable? Ethernet works; WiFi is often lower latency for the stream on Pi 4.

Act III — Give it eyes and hands (wire the target)

9. Hands: data cable target USB-A → Pi USB-C on Pi 5 (A-to-C; avoid C-to-C gadget bugs). Pi 4 may use C-to-C if the cable is data-capable.
10. Eyes: target HDMI out → capture device → Pi USB (or CSI bridge on Pi 5).
11. Open the home page / — you should see the live feed. Top bar: capture resolution, FPS, HID persona.
12. Click the canvas to focus. Move mouse, type. If keys feel “wrong,” open the persona menu and switch to generic-absolute for pixel-perfect agent clicks (or apple-magic-stable on a Mac host).

Act IV — Make it your AI hub

13. Network → Tailscale. Paste a one-time auth key → Save. The Orb keeps a stable 100.x address wherever you carry it.
14. Agent Dash (/agent). Add a system (SSH or + Add from Tailscale). You now have metrics, terminals, containers, and deploys for that box.
15. API Keys (/tokens) or Agent → Provision. Mint a read or full token for an agent. Name it after the agent — the audit log will thank you.
16. Point the agent. REST: https:///api with Authorization: Bearer …. MCP: https:///api/mcp (Basic or bearer; TLS may be self-signed). Load SKILL.md so the model knows the rites.
17. First agent loop. state → snapshot → reason → click_at / type_text → snapshot again. On Hailo: try screen_find?query=Save then click_at on the returned center.
18. Optional privacy cloak. Network → enable DNSCrypt criteria → VPN wizard (AirVPN for stealth / Tor-over-VPN) → Tor split-tunnel. Flip exit node if the phone should inherit the stack.
19. Optional pantheon. Agent Dash → + New persona → Soul / Identity / voice / corpus → Provision API key + SSH grant as needed.
20. Kill switch drill. Revoke the token or unplug USB-C. Access is gone. That is the point.

Act V — Daily practice

Zero software on the target. Full control from your browser or your AI. Unplug or revoke — the spell ends.

Screenshots in this README were captured from the live UI and redacted (IPs, tokens, hostnames, homeserver names, private paths) by scripts/capture-screenshots.cjs. Re-run against your own Orb:

AEON_URL=https:// AEON_PASS='your-admin-password' \
  node scripts/capture-screenshots.cjs

---

Lineage

Descended from cursed-hid, an ESP32-S2 dongle that emulated a Logitech Unifying Receiver and accepted only logical operations over WebSocket — never raw press/release primitives that could leave a key stuck if a packet dropped. The Orb inherits that lesson. It borrows configfs USB-gadget patterns and the ustreamer v4l2 capture loop from PiKVM — but we’re not a fork; we’re a sibling project with a different goal: agent-grade computer control, not remote KVM administration.

Support the work

AEON-7 models, drafters and tools are built and trained independently, on my own hardware. If they’re useful to you, please consider supporting development:

Become a member on Patreon → patreon.com/cw/AeonForge7/membership

Milestones unlock bigger work: reaching 500 paid supporters will fund fine-tuning larger models and bigger project releases. Supporters also get early access to new releases, such as the AEON DFlash2 drafter.

License

MIT. See LICENSE.

Find this project

Topics / tags (GitHub): raspberry-pi · ai-agents · computer-use · mcp · agentic-ai · kvm · usb-hid · usb-gadget · privacy · tor · vpn · tailscale · dnscrypt · self-hosted · hailo · edge-ai · remote-control · homelab · open-source

If you are searching for AI computer use without installing spyware on the target, Raspberry Pi KVM for agents, MCP hardware control, or portable AI lab jump box — you are in the right temple.

---

Hard rules (non-negotiable)

This software exists to drive the user’s own computers, the user’s own accounts, the user’s own services. It is not a tool to bypass fraud controls, automate access to other people’s accounts, or evade device-attestation on a service the user is not authorized to operate against. The naturalism layer (when enabled) is for accessibility and reliability — not cover for impersonation. If you build something sketchy on top of this, that’s on you, and we will not help.