What is T3 Connect? One command remote control, explained

What it is

T3 Connect is a tunnel layer, released open source alongside the rest of T3 Code, that makes a machine running the T3 Code backend reachable from a device that is not on the same network. Its author described it at launch as a minimal open-source tunnel allowing you to control T3 Code instances remotely without setting up Tailscale, and the whole point is the "without": the alternatives all work, and all of them ask a developer to configure networking before they can see a diff on a phone.

The mental model is a single account that owns machines. Once a machine has run the connect command and signed in, it appears in the instance list on every client signed into the same account, including the hosted web client at app.t3.codes and the iOS and Android apps. You are not pairing a phone to a laptop; you are adding a laptop to an account the phone already belongs to.

The three alternatives already in the box

T3 Connect is the newest of four remote-access routes, and it is not always the right one. The other three keep every byte on infrastructure you control.

# hosted tunnel, one command
npx t3 connect

# pair a phone or browser with a running instance
npx t3 pair
npx t3 pair --tailscale

# headless backend bound to a Tailnet address
npx t3 serve --host "$(tailscale ip -4)"

# let Tailscale Serve terminate TLS
npx t3 serve --tailscale-serve

# revoke a credential, list sessions, issue another
npx t3 auth

One practical trap sits between these routes. The hosted web client is served over HTTPS, and browsers block an HTTPS page from connecting to a plain HTTP endpoint, so pairing app.t3.codes against a bare http://192.168.x.y:3773 LAN URL does not work. Either use the desktop or mobile client for plain HTTP LAN pairing, or terminate TLS, which is what --tailscale-serve and the Tailscale HTTPS toggle exist to do. SSH launches additionally require Node ^22.16 || ^23.11 || >=24.10 on the far side.

The security model, stated plainly

The pairing design is sound and the documentation is candid, so it is worth repeating rather than paraphrasing. The remote device does not need a long-lived secret up front: t3 serve issues a one-time owner pairing token, the remote device exchanges it, and the server creates an authenticated session for that device. Later access uses the session rather than reusing the original token, and t3 auth can revoke credentials and inspect sessions afterwards.

Two things follow that are easy to miss. First, remote pairing beyond the loopback path authenticates through a hosted account system, so "fully local, no accounts" is an accurate description of running T3 Code on one machine and not of the remote flow. Second, the account is the security boundary: because any instance signed into the same account is drivable from any client on that account, the credential protecting your account is also the credential protecting every repository on every connected machine. Enable whatever second factor that account supports before you connect a work machine. Agent security covers the wider threat model.

The limits worth planning around

• Three devices per user. A laptop, a desktop, and a server fills the allowance before the phone is counted in whichever way the cap applies. Check it against your actual machine count before committing a workflow to it.
• The relay is unfunded. The project has said it does not want to charge and may have to change course if the bill becomes unacceptable, naming forking, self-hosting, and Tailscale as the alternatives. That is an honest disclosure and a real dependency.
• Traffic crosses a third party. For many people that is fine. For a repository under a customer contract that restricts where source may transit, it is a question for whoever signs those contracts.
• It rides an alpha project. Remote access is the surface where a nightly regression is least convenient, because you discover it when you are away from the machine.
• The relay is a single point of failure in a way that a Tailnet is not. If it is down, the Tailscale and SSH routes still work; that is a good reason to configure one of them even if you use Connect daily.

How Continuum solves the same problem

Continuum reaches the same conclusion about the hard part and takes a different route through it. Sign-in is the pairing ceremony: you sign into an account on both ends and the devices find each other, with no code to copy between screens. A controller then reaches a host three ways, preferring a direct path and falling back to a relay, and the session is end to end encrypted by default with a Tailnet option when you want one. Devices are peers rather than remotes, so a session started on the Mac continues on the phone rather than being mirrored to it.

Two rows are the honest summary. T3 Connect wins on Android and on the fact that you can read and fork the tunnel. Continuum wins on the phone being a real client rather than a viewport: a native iPhone app with a Watch companion, Lock Screen and Live Activity progress, and a plan-approval gate you can clear from a notification, which is what makes remote control useful for the twenty minutes when an agent is mid-run and you are not at the desk. If neither of those is your constraint, the routes are close enough that convenience decides.

Should you use it

T3 Connect is a good piece of work and the right default for most individual users of T3 Code. One command genuinely is the correct amount of setup for this problem, the pairing model is well designed, and shipping it open source rather than as a hosted upsell is consistent with the rest of the project.

Whichever route you choose, configure a second one. Remote access is the capability you notice is missing at the worst possible moment, and the ten minutes it takes to bind npx t3 serve to a Tailnet address is cheap insurance against a relay outage or a policy change. Remote coding covers the wider set of approaches, and running Claude Code from a phone covers the workflow rather than the plumbing.

Questions people ask

Keep reading

Continue through Agentic coding with What is Conductor? The Mac app for parallel coding agents.