CryptoMesh VPN: an MCP companion for connecting agents to private networks

I build CryptoMesh VPN. We’ve added a local MCP companion to the macOS and Windows desktop app, and I’d like feedback from people using agents for network administration.

The use case is the connection step: an agent requests access through your VPN, you approve it in the app, and the agent checks that the connection is verified before using its other tools. For a paired personal node, it can request private-network mode; for cloud VPN servers, it can request an exit-node connection.

There are six tools: vpn_get_status, vpn_list_servers, vpn_select_server, vpn_connect, vpn_disconnect, and vpn_diagnose.

The companion uses local stdio. Agent access starts disabled. Connecting and changing servers require an in-app approval. Disconnect cancels pending agent requests without another in-app approval, although Windows can still show its administrator prompt. The tools return sanitized state and don’t expose VPN keys, profiles, or account tokens. The app’s normal account, entitlement, and device-limit checks still apply.

For routers, switches, or servers, you still need a device-specific MCP server, API, or SSH tool and the appropriate network access. This companion controls the VPN connection; it doesn’t administer those devices itself.

Setup guide and downloads — includes the macOS and Windows MCP configuration and a first-call walkthrough.

What would make this useful in your workflow: selecting a personal network, checking reachability, or troubleshooting a failed connection?