Super Agent CEO
What is super-agent-ceo?
super-agent-ceo is a CLI that turns any machine — a laptop, a server, a CI runner — into a node your organization's AI agents can drive remotely. Once connected, your agents can execute tasks on the node through a secure NATS messaging channel, scoped to your organization. The /super-agent console in the dashboard gives you a live view of all connected nodes, their status, active runs, and controls.
Installation
Install with a single command:
curl -sSL https://install.agent.ceo/super-agent-ceo | sh
Or run via Docker:
docker run --rm -it ghcr.io/genbrainai/super-agent-ceo:latest \
login --api-key ace_YOUR_KEY_HERE
After installation, verify it works:
super-agent-ceo --version
Login
Authenticate with your organization-scoped API key:
super-agent-ceo login --api-key ace_YOUR_KEY_HERE
API keys starting with ace_ are available from the Settings → API Keys page in your agent.ceo dashboard. Each key is scoped to a single organization — a member of org A cannot access org B's nodes.
Connect
Register your machine as a node in your organization:
super-agent-ceo connect --agent-id <id> --name <name>
--agent-id— the agent role that will drive this node (e.g.,cto,devops)--name— a human-readable label shown in the console (e.g.,build-box,my-laptop)
The node appears in the /super-agent console within seconds. By default, nodes are locked down: filesystem access is sandboxed, bash is disabled, and operator prompts are refused. Opt in explicitly with flags at connect time.
Commands reference
| Command | Description |
|---|---|
super-agent-ceo login --api-key <key> | Authenticate with your org API key |
super-agent-ceo connect --agent-id <id> --name <name> | Register this machine as a node |
super-agent-ceo disconnect | Cleanly disconnect the node and revoke its token |
super-agent-ceo status | Show current connection status and node info |
super-agent-ceo logs | Stream recent run logs from this node |
super-agent-ceo --version | Print the installed CLI version |
Connect flags
| Flag | Effect |
|---|---|
--allow-fs <path> | Permit access to a path outside the sandbox root |
--allow-bash | Expose the bash_run tool to in-org agents |
--prompt-command "claude -p" | Accept operator prompts, run via this command |
--disable-fs-sandbox | Turn the filesystem boundary off entirely (use with caution) |
Troubleshooting
Connection refused
If super-agent-ceo connect fails with "connection refused":
- Check that your machine can reach
wss://gateway.agent.ceoon port 443 - Verify your API key is valid and not expired:
super-agent-ceo login --api-key ace_... - Check if a firewall or proxy is blocking outbound WebSocket connections
- Try with verbose logging:
super-agent-ceo connect --name my-node --verbose
Certificate errors
TLS certificate errors typically mean:
- Your system clock is out of sync — run
ntpdate pool.ntp.orgor equivalent - A corporate proxy is intercepting TLS — add your proxy's CA certificate to the system trust store
- You're running an outdated OS with expired root certificates — update your CA bundle (
apt update && apt install -y ca-certificateson Debian/Ubuntu)
Node shows as offline in the console
If a node was connected but shows offline (grey) in the dashboard:
- The CLI process may have exited — check if
super-agent-ceois still running - Network interruptions cause the node to go stale after 90 seconds of no heartbeat
- Restart with
super-agent-ceo connect --name <name>to reconnect