Turns out what I want to do is impossible without something like spiped. I dug into the source of the cli tool and it looks like it doesn't rely on ssh at all.

Turns out what I want to do is impossible without something like spiped. I dug into the source of the cli tool and it looks like it doesn't rely on ssh at all. Instead it does all the provisioning through amazon APIs. i.e. Amazon is sshing into the machine for provisioning purposes, not my machine. Basically, I need to expose my ssh-agent socket to the world via a TCP socket exposed to the world. The server would then install spiped, get the symmetric key that allows it to connect to my ssh-agent-port and set up the SSH_AUTH_SOCK to proxy requests to my machine. This is still more secure than ever letting your private key ever leave your machine. While I don't think I need it anymore since I can mount the unix domain socket anywhere, I did find this script useful and think others here may as well: https://github.com/wwalker/ssh-find-agent/ https://github.com/wwalker/ssh-find-agent/