Agents

An Agent is a lightweight service you run on a machine inside your own network. It makes
an outbound HTTPS/WebSocket connection to Intely and waits for work. When you run an agent
job, Intely sends the instruction down that existing connection, the agent executes it locally,
and streams the result back.

The important consequence: no inbound firewall rules, no VPN tunnel, no public IP. If the
machine can reach the internet on 443, it can run an agent.

Agents vs. VPN Connections

	Agent	VPN Connection
Direction	Outbound only, initiated by you	Site-to-site tunnel
Network change required	None beyond outbound 443	Firewall, routing, pre-shared keys
Typical setup time	Minutes	Days to weeks, involves your network team
Best for	Database queries, internal API calls, picking up files from a share	Broad network-level access, many hosts, non-HTTP protocols

If your use case is "query this SQL Server", "call this internal REST endpoint", or "pick up
the CSVs that land on this file share", an agent is almost always the faster path. Choose a
VPN when you need general network reachability rather than a defined set of jobs.

Installing an agent

Go to Organization → Agents and add a new agent.
Name it after where it lives — prod-db-server, radiology-file-share. You'll be
reading this name in logs.
Intely issues an agent token. Copy it now; it's used once during installation.
Install and start the agent on the target machine using the token. Your Intely contact will
supply the installer and the platform-specific steps for your environment.

Once running, the agent reports its host name, version, OS platform and
architecture back to Intely, and begins sending a heartbeat (every 15 seconds by default).

Agent status

Two statuses are tracked independently.

Lifecycle status — whether the agent is allowed to work:

Status	Meaning
Pending	Created in Intely; has not yet connected
Enabling	Being brought into service
Active	Accepting and running jobs
Disabling	Draining — finishing in-flight jobs, accepting no new ones
Disabled	Not accepting jobs
Interrupted	Stopped unexpectedly

Connection status — whether it's reachable right now: Connected, Disconnected,
or Reconnecting.

Disabling an agent drains it rather than killing it: in-flight jobs are allowed to finish
before it goes fully Disabled.

Agent settings

Setting	Default	Notes
Max concurrent jobs	1	Raise if the host has capacity and jobs are I/O-bound
Heartbeat interval	15,000 ms	Lower detects outages sooner, at the cost of chatter
Server log level	`info`	Minimum level forwarded to Intely: `debug`, `info`, `warn`, `error`, `disabled`
Local log level	`info`	Minimum level written to the agent's own console

Agent logs

Organization → Agents → Logs shows everything the agent and the server have to say,
filterable by source:

Source	Covers
Agent Lifecycle	Status transitions on the agent itself
Connection	Connect, disconnect and force-drain audit
Job Dispatch	Scheduling, dispatch, acknowledgement timeouts, agent selection
Execution	The agent's own step-by-step chatter while a job runs
Database Query	Database job detail
API Request	API job detail
File Retrieval	The whole file pipeline — retrieval, transfer, cleanup
Agent Update	Self-update rollout and apply

Each line is also tagged with an origin: agent (emitted by the agent process) or
server (emitted by Intely).

Security notes

The connection is outbound-only and TLS-encrypted.
Intely stores only the token's identifier, not the token itself, so a token can be revoked
without Intely ever holding a usable credential.
Database and API credentials configured on a job are encrypted at the service layer.
Database connections default to a secure SSL mode per driver (require for Postgres,
preferred for MySQL, true for SQL Server). Disabling encryption is possible but not
recommended.