Use KoboldCpp from your phone or another computer

KoboldCpp remote access: LAN, tunnel or your own HTTPS

Cloud websites such as Janitor AI need the tunnel (connecting apps).

On your home network (LAN)

1. Check what KoboldCpp listens on

   We started 1.124.2 with no --host and found the port open on all interfaces: a request to the machine’s own network address returned 200 F87. With --host 127.0.0.1 it was open to the PC only and the network address failed. The launcher’s Network tab has a Host box for the same setting.
2. Find the PC's address

   Windows: ipconfig, Linux: ip addr, macOS: System Settings, Network. Take the IPv4 address of your Wi-Fi.
3. Allow it through the firewall

   Windows asks the first time; choose private networks. You can add a rule for the port later in Windows Defender Firewall. On Linux and macOS open the port in your firewall tool if you use one (we did not test these).
4. Open it on the phone

   http://<PC address>:5001 in the phone’s browser.

We tested the listening part on a Linux machine. We did not test a phone, a second device, or the Windows and macOS firewall prompts, so those steps are the standard ones, not our results. A page on the https website can call a KoboldCpp on localhost, but Chrome 153 blocked it from the PC’s network address as mixed content F78; use the address in the address bar of the device instead.

From anywhere: the Cloudflare tunnel

--remotetunnel (Remote Tunnel in the launcher) downloads cloudflared, opens a quick tunnel and prints an https://….trycloudflare.com address (since 1.48, macOS since 1.60, upstream). Add a password. We could not test it: our sandbox refused to open a public tunnel. So the first-start time, the file location, how often the address changes and any time-out on long replies are not measured here; users report that the address changes at every start and that very long generations can be cut. The Colab notebook uses the same tunnel (Colab).

HTTPS on your own

--ssl takes a certificate file and a key file. With a self-signed pair the server answered https:// and a strict client refused the certificate, which is what a browser warning is; plain http:// on the same port was reset F87. You need https when a browser feature such as the microphone only works on https or localhost (voice). A reverse proxy or your own named tunnel is outside this guide’s tests.

A password is not a firewall

--password (Network tab, or the KCPP_PASSWORD environment variable, which we tested F87) makes generation need a key: without it generate returned 401 and with Authorization: Bearer <key> it returned 200. Discovery still works: the Lite page and /api/v1/model answer without a key, and upstream says image endpoints are not protected F25. In plain words: anyone with the address can see that a KoboldCpp is running.

Other controls:

• --ratelimit sets seconds between generations per address: with 8, the second call right after the first got 503, and a call after 9 seconds got 200 F87.
• --sdclamped caps image size on a shared server; --adminpassword protects admin mode if you use it; --queuelimit and --maxrequestsize limit load (upstream, not tested).
• A browser risk is reported in the project’s issue 539: any website you visit can call a local API. We found KoboldCpp answers cross-origin calls permissively, including with an Authorization header F77, so a password is what protects you from other websites.

Safety checklist

Check it worked

The phone shows the Lite page and a test prompt gets an answer. With a password set, an API call without the key must return 401 (API tester).

Undo

Close KoboldCpp (the tunnel ends), remove the firewall rule, and delete host and the tunnel setting from a saved config (config files). To keep it local while it runs, start with --host 127.0.0.1.