Connectivity Tiers
What each way of putting an agent behind its own address gives you, and what it asks of the host.
On this page (2)
Connectivity Tiers Documentation
An agent's identity is the same on every tier. The address, the forward and reverse records, the DANE pin and the registry entry do not change when you move between them. What changes is how much of the agent's traffic leaves from that address, and how much the host has to cooperate.
The tiers
| Tier | What leaves from your address | What the host needs | How to ask for it |
|---|---|---|---|
| Tier 1, routed WireGuard | every connection the tunnel carries | nothing privileged: a userspace tunnel with no root and no kernel module | whisper connect --tier wireguard |
| Tier 1.5, source-bound proxy | every connection that goes through the local proxy | nothing privileged | whisper connect --tier socks5 |
| Tier 2, resolver only | nothing: the host keeps its own address and only its name lookups go through Whisper | a DNS setting | whisper resolver |
Tier 1 generates the tunnel key locally, and that key never leaves the host. The same local proxy endpoint fronts the tunnel, so tools that were already pointed at the proxy need no change when you move up from Tier 1.5.
Tier 2 is the tier that applies to a machine you do not want to re-plumb, and to a phone or a laptop. It still gives that machine a routable identity and your account's name policy, without touching how its traffic is routed. Setting it up is Set Up a Device for a personal machine and Encrypted DNS for an agent host.
Choosing one
--tier auto is the default, and it negotiates: it tries Tier 1 first and on any failure
falls back to Tier 1.5. The success line names the tier it landed on, so a script can read
back what it got. An explicit --tier is forced exactly as asked, with no downgrade, which
is what you want in a deployment that must fail rather than quietly change shape.
whisper connect --agent shipping-bot --tier wireguard
Take Tier 1 when you want an agent's whole socket surface bound, including protocols a proxy does not carry. Take Tier 1.5 when the runtime can set proxy environment variables and you want the smallest possible footprint on the host. Take Tier 2 when routing is somebody else's decision and the value you want is the verdict on each name.
The full walkthrough is Send Traffic From Your Address, and the credential the proxy and the tunnel accept is on Egress Authentication. The operator console reports fleet coverage by tier, so you can see which of your hosts landed where.