A remote development server for AI agents is a cloud machine that stays on, so coding agents like Claude Code keep working after you close your laptop. This guide sets one up step by step: choosing a server, hardening SSH and the firewall, keeping sessions alive with tmux, scoping credentials, sandboxing the agent, steering it from your phone, and protecting your work.
- A small VPS that never sleeps lets agents finish long tasks; size it for your builds and tests, not for the agent itself.
- Lock it down before installing anything: a non-root user, SSH keys only, root login off, a firewall, automatic security updates.
- Run agents inside tmux so they survive SSH disconnects, and use Claude Code's Remote Control or an SSH app to check in from a phone.
- Give the server the narrowest credentials possible: a fine-grained GitHub token for specific repos and no production secrets.
- Treat the server as disposable: push branches often, keep config in a script, and snapshot before risky changes.
Why use a remote development server for AI agents?
A remote development server keeps coding agents running when your laptop sleeps, loses Wi-Fi or goes in a bag. Agents such as Claude Code and Codex can work on a single task for an hour or more, and a process on a laptop stops the moment the lid closes.
Moving agents to an always-on machine also brings:
- Isolation. The agent works on a machine that does not hold your personal files, browser sessions or SSH keys to everything.
- Parallel work. Several agents can run on separate branches while you do something else on your own computer.
- Access from anywhere. You can check progress and answer questions from a phone.
The trade-off is maintenance: you are now running a server, with updates, security and backups to handle. The rest of this guide covers that work step by step, on Ubuntu, with Claude Code as the example agent. For the broader question of keeping agents running, including options that need no server, see how to run Claude Code 24/7.
How do you choose a server?
Pick a Linux VPS in a region close to you, with enough memory for your project's builds and tests. The agent process itself is light; npm install, compilers, test runners and dev databases are what use memory.
| Workload | Suggested size | Notes |
|---|---|---|
| Scripts, small libraries, docs | 1 to 2 vCPU, 2 to 4 GB RAM | Enough for one agent at a time |
| Typical web app (Next.js, Django, Rails) | 2 to 4 vCPU, 4 to 8 GB RAM | Builds and test suites set the floor |
| Several agents in parallel, heavy builds | 4 to 8 vCPU, 8 to 16 GB RAM | Each parallel worktree runs its own builds |
| Mobile builds, large monorepos | 8+ vCPU, 16+ GB RAM | Consider dedicated build machines |
Claude Code runs on Ubuntu 20.04+, Debian 10+ and Alpine 3.19+, on x64 or ARM64, according to its setup docs. Any mainstream provider works. As one price reference, Hetzner's cloud servers start at €5.99 a month excluding VAT at the time of writing (October 2026), with locations in Germany, Finland, Singapore and the US.
Choose the latest Ubuntu LTS image and add your SSH public key when you create the server, so password login is never needed.
How do you secure the server before installing anything?
Lock the server down in the first ten minutes: create a non-root user, allow SSH keys only, turn off root login, enable a firewall and turn on automatic security updates. Scanners find new servers within minutes of boot.
Log in as root once, then run the block below. In order, it creates a dev user with sudo, copies your SSH key to it, turns off password and root login, allows only SSH through the firewall, and turns on automatic security updates.
adduser devusermod -aG sudo devmkdir -p /home/dev/.sshcp /root/.ssh/authorized_keys /home/dev/.ssh/chown -R dev:dev /home/dev/.sshchmod 700 /home/dev/.ssh && chmod 600 /home/dev/.ssh/authorized_keyscat > /etc/ssh/sshd_config.d/99-hardening.conf <<'EOF'PasswordAuthentication noKbdInteractiveAuthentication noPermitRootLogin noEOFsystemctl restart sshufw allow OpenSSHufw enableapt update && apt install -y unattended-upgradesdpkg-reconfigure -plow unattended-upgradesBefore closing the root session, open a second terminal and confirm ssh dev@your-server works. If the key copy failed, you can still fix it from the open session instead of locking yourself out.
Optional: hide SSH behind a private network
A private mesh network such as Tailscale lets you close port 22 to the internet entirely and reach the server only from your own devices. Tailscale's free Personal plan covers up to 6 users with unlimited devices, per its pricing page.
curl -fsSL https://tailscale.com/install.sh | shsudo tailscale upThen, only after confirming you can SSH in over the Tailscale address, close the public SSH port:
sudo ufw allow in on tailscale0sudo ufw delete allow OpenSSHHow do you install the agent and your tools?
Install the same toolchain your project uses locally (Node, Python, Go or whatever your repo needs, ideally through the same version manager you use on your laptop), then the agent and the GitHub CLI. Working as the dev user from here on:
sudo apt install -y git tmux build-essential ripgrepcurl -fsSL https://claude.ai/install.sh | bashclaude --versionclaude doctorsudo apt install -y ghgh auth loginThe native installer is the method Anthropic recommends; claude doctor checks the install and settings without starting a session. Claude Code needs a Pro, Max, Team, Enterprise or Console account, since the free claude.ai plan does not include it. Run claude once in a project and follow the login prompts.
Clone your repository, add a CLAUDE.md with build and test commands, and confirm the test suite passes on the server before handing the agent any task. An agent that cannot run tests cannot check its own work.
How do you keep agent sessions alive with tmux?
Run every agent inside tmux. tmux keeps the terminal session alive on the server when your SSH connection drops, so the agent continues working and you can reattach later from any device.
The handful of commands you need:
| Action | Command |
|---|---|
| Start a named session | tmux new -s billing-refactor |
| Detach (leave it running) | Ctrl-b then d |
| List sessions | tmux ls |
| Reattach | tmux attach -t billing-refactor |
| New window inside a session | Ctrl-b then c |
| Switch windows | Ctrl-b then n / p |
A typical flow: SSH in, tmux new -s feature-x, cd into the repo, start claude, give it the task, then detach and log out. The agent keeps going. When you come back, tmux attach -t feature-x shows exactly where it is.
For parallel agents, give each its own git worktree and its own tmux session so they never edit the same checkout. Claude Code can create one for you with claude --worktree <name>. The guide on git worktrees for parallel agents covers branch hygiene and cleanup.
For scheduled, non-interactive jobs (a nightly dependency check, a weekly report), use claude -p "<task>" from cron or a systemd timer instead of an interactive session.
How do you steer agents from your phone?
Use Claude Code's Remote Control to continue a server session from the Claude app or claude.ai, or an SSH app to attach to tmux directly. Both let you answer an agent's question or review progress without a laptop.
Remote Control. Start the session with Remote Control on, and it appears in the session list at claude.ai/code and in the Claude mobile app:
claude --remote-control "billing refactor"If a session is already running, type /remote-control (or /rc) inside it instead.
According to the Remote Control docs, the session keeps running on your machine with its filesystem, tools and MCP servers, and messages sync across terminal, browser and phone. It requires a Pro, Max, Team or Enterprise plan and does not work with API keys. On a server inside tmux, it survives your disconnects as well.
SSH from a phone. Any SSH client app can connect to the server (over Tailscale if you closed port 22) and run tmux attach. This works with any agent, at the cost of typing on a small terminal.
More options, compared side by side, are in using Claude Code from your phone.
How do you limit what the agent can damage?
Assume anything the agent can reach, it might eventually break or leak, and set up the server accordingly. Coding agents read untrusted content (issues, web pages, dependency READMEs), and prompt injection can turn that content into instructions.
Layers that work together:
- Narrow credentials. Use a fine-grained GitHub token limited to the repositories the agent works on, with branch protection on
mainso changes go through pull requests. Do not put production database URLs, cloud admin keys or payment secrets on the server. - Claude Code's sandbox. Run
/sandboxto put the agent's shell commands inside an OS-enforced boundary for files and network hosts. On Linux it relies onbubblewrapandsocat, per the sandboxing docs. - Permission modes. Auto mode uses a classifier model to review actions instead of prompting you for each one. Reserve
--dangerously-skip-permissionsfor containers or VMs: the permission modes docs list bypass mode as "Isolated containers and VMs only" and say to run it as a non-root user. - Separate machines for separate trust levels. Do not run agents on the same server as anything public-facing or anything holding customer data.
The full threat model, with real attack patterns, is in prompt injection and coding agents.
How do you protect your work and keep the server healthy?
Treat the server as replaceable: your code lives in Git, your setup lives in a script, and a snapshot covers the rest. If the server dies or gets compromised, you should be able to rebuild it in under an hour.
- Push often. Ask agents to commit and push their branch after each step. Unpushed work on a single disk is the main thing you can lose.
- Script the setup. Keep the commands from this guide in a
setup.sh(or a cloud-init file) in a private repo, so a fresh server is one command away. - Snapshots. Most providers sell automatic backups or snapshots; take one before major upgrades. For files outside Git (local databases,
.envfiles for dev services), use a backup tool such as restic to object storage. - Disk and memory. Build caches, Docker images and old worktrees fill disks fast. Check
df -hweekly, prune Docker, and remove finished worktrees. - Updates. Unattended upgrades cover security patches; reboot when the kernel updates (
/var/run/reboot-requiredexists when one is needed). - Costs. Watch both the server bill and model usage. Long agent sessions on large models are usually the bigger number.
Where a hosted box fits
A hosted box gives you the always-on server without doing the setup and maintenance in this guide yourself. It makes sense when you want agents working overnight but do not want to manage SSH hardening, updates and tmux.
Orkio is one such option. It rents an isolated, always-on cloud box (servers in Europe) where agents like Claude Code and Codex keep working after you close the app or your laptop. You connect Claude and GitHub once, give tasks from your phone or the web, and review pull requests later. Agents use your own Claude account, so there is no markup on model usage. The Starter box (2 GB memory, 1.5 vCPU, running 24/7) is $19 a month or $182 a year, the phone reaches the box through an end-to-end encrypted relay, and Insights shows what agents cost per project and per merged pull request. See pricing for details.
If you prefer full control over the OS, toolchain and machine size, the self-managed VPS above is the better fit.
Remote development server checklist
Run through this list when you set up a server, and again once a month.
- Non-root user with sudo; SSH keys only; root login and passwords off
- Firewall allows only SSH, or only the Tailscale interface
- Unattended security upgrades on; reboot after kernel updates
- Toolchain installed; project tests pass on the server
- Claude Code installed with the native installer;
claude doctorclean - Fine-grained GitHub token for specific repos; branch protection on
main - No production secrets on the server
- Agents run inside tmux, one worktree and session per task
- Sandbox or container isolation configured for unattended runs
- Setup script saved; snapshot schedule set; disk usage checked
Once the server is ready, the next skill is writing tasks that finish without you. The guide to background coding agents covers task design and the review flow.
Frequently asked questions
How much does a remote development server cost?
Small cloud servers start at a few euros or dollars a month; Hetzner's cloud plans, for example, start at €5.99 a month excluding VAT at the time of writing. Larger machines for heavy builds cost more. Model usage is billed separately through your Claude plan or API account.
Can I use Claude Code on a remote server with my Claude subscription?
Yes. Claude Code works with Pro, Max, Team, Enterprise or Console accounts, and you log in once on the server. Remote Control, which lets you continue the session from claude.ai or the Claude app, requires a Pro, Max, Team or Enterprise plan and does not work with API keys.
Is it safe to run an AI agent with full permissions on a VPS?
Only if the server is isolated and holds nothing you cannot afford to lose or leak. Claude Code's docs say bypass permissions mode is for isolated containers and VMs only, run as a non-root user. Even on a dedicated server, avoid storing production credentials and limit the GitHub token to the repositories the agent needs.
What is the difference between tmux and running claude -p?
tmux keeps an interactive terminal session alive after you disconnect, so you can reattach and keep talking to the agent. claude -p runs a single non-interactive task and exits, which suits scripts, cron jobs and CI. Many setups use both: tmux for interactive work and claude -p for scheduled chores.
Should I use a VPS or a cloud IDE for coding agents?
A VPS gives you full control over the environment, tools and costs, but you maintain it: updates, security and backups are on you. Cloud IDEs and hosted agent boxes trade some control for less maintenance. Pick a VPS if you enjoy running servers and need custom tooling.
