remcp

Your computer. Your tools. One secure MCP connection.

Website · Plugins · Docs · Tool reference · Security · Privacy · Support

ReMCP connects a computer you own or administer to ChatGPT & Codex, Cursor, Claude Code, GeminiCLI, Kiro, Cline, or another MCP client. The device agent makes an outbound connection only — noinbound port, no tunnel, no third-party desktop relay. This repository contains the public deviceclient/runtime, portable Agent Plugin metadata, the Gemini CLI extension manifest, official MCPRegistry metadata, and the host-specific OpenAI and Anthropic plugin packaging.

Packages

Install

Requires Node.js 22.5 or newer.

npm install --global @remcp/remcp@latest

Then open ReMCP → Connect a machine and generate aone-time pairing command. Run that exact command on the computer you want to connect; it installs theruntime and registers the background service.

Pairing codes are generated in the authenticated workspace, expire automatically, and aresingle-use. Do not invent or reuse a code from documentation.

Commands

Plugins

For users, ReMCP is catalog-first:

Install from your AI host → sign in to ReMCP → use your paired computers.

You do not need to paste an MCP server URL, edit a manifest, clone this repository, or configure alocal path just to use the published plugin.

Shareable install guides:

• ChatGPT & Codex: https://remcp.site/install/chatgpt
• Claude Code: https://remcp.site/install/claude

ChatGPT & Codex / OpenAI

ChatGPT and Codex share OpenAI's public plugin directory.

1. Open https://chatgpt.com/plugins.
2. Search for ReMCP and open the ReMCP plugin card when it is available.
3. Choose Install plugin.
4. If prompted, choose Connect and complete ReMCP OAuth.
5. In ChatGPT, use @ReMCP when you want to invoke it explicitly. In Codex, use Sources → Use plugins → ReMCP.

If ReMCP is not visible yet, the listing or rollout is not available to that account. There is nomanual MCP endpoint an ordinary plugin user needs to configure while waiting.

Claude Code / Anthropic

ReMCP was submitted through Claude Platform on September 18, 2026 and currently showsSubmitted and pending review.

After approval:

1. Open https://claude.com/plugins. In Claude or Claude Desktop, you can also use Customize → Plugins → + → Browse plugins.
2. Search for ReMCP and confirm it supports Claude Code.
3. Choose Install.
4. Complete ReMCP authorization if Claude asks you to connect.
5. Ask Claude Code to use ReMCP on a computer already paired to your account.

While the listing is under review, ordinary users do not need to add a marketplace, clone thisrepository, or paste an MCP endpoint. Developer and reviewer workflows live in the technical guide.

Start with Plugin overview →.

Cursor and the wider MCP ecosystem

ReMCP publishes host-native metadata for coding agents plus directory records for MCP discovery:

The same ReMCP OAuth account and paired computers sit behind every route. Marketplace and directorysurfaces change discovery; they do not create separate ReMCP backends.

Distribution manifests, direct install commands, and review links are documented inPLUGINS.md → and DISTRIBUTION.md →.

Developer / reviewer internals

Host-specific manifests, MCP configuration, validation commands, submission artifacts, and localdevelopment workflows remain documented separately:

• ChatGPT & Codex developer guide →
• Claude Code developer guide →
• AI tool-selection evaluation →

The OpenAI files and Claude files deliberately do not overwrite each other. Release checks fail ifeither host-specific contract drifts from the shared ReMCP version or production endpoint.

The local runtime

@remcp/runtime is a clean-room MCP server written for ReMCP. It is not a fork of, and shares no codewith, DesktopCommanderMCP or any other MCPserver.

83 device tools. The hosted production catalog adds 8 account/fleet tools and 3 chat-presentation tools for 94 tools total whenever custom widgets are enabled; native-only deployments expose 91 tools. See the generated full tool reference.

Device runtime surface:

The hosted ReMCP endpoint has eleven hosted account/presentation tools in its normal production catalog, for 94 tools. Setting REMCP_CUSTOM_WIDGETS_ENABLED=false omits the three app-only preview recovery helpers and returns the 91-tool native-only surface. With widgets enabled, file/image/terminal source tools own their UI resource directly and hydrate it from the same tool result; structuredContent.preview remains a short-lived retry reference for the app only, so no second model-selected render call or device RPC is required. Each online device returned by list_devices also reports its live supported subset; platform-specific tools that are unavailable on that computer fail closed rather than being guessed.

Tool selection for AI agents

ReMCP publishes selection-oriented descriptions and ships the same decision tree in its operator skill:

native Accessibility/UI Automation → browser DOM/CDP → OCR → coordinates

• Start unfamiliar desktop work with computer_snapshot; use ui_snapshot/ui_find/ui_action for native apps.
• For Chromium page content use browser_navigate action=new_tab when needed, then browser_snapshot/browser_find/browser_action/browser_wait instead of desktop coordinates.
• Use type_text for normal Unicode text in native/focused controls, browser_action for Chromium page DOM text, and keyboard for shortcuts/navigation keys.
• Use pointer only when semantic actions cannot express the task; prefer element ids for drag_drop. GNOME Wayland drag uses the consent-backed Remote Desktop portal rather than unreliable XTEST drag.
• Use wait_for_ui / browser_wait instead of fixed sleeps.
• Use screenshot_region for targeted visual proof and record_screen only for motion/timing.
• Use structured document tools instead of automating Office when the request is about file content.

All 39 computer/browser/diagnostic/document tools declare closed top-level input schemas, parameter descriptions, structured output schemas, and MCP read-only/destructive/idempotent/open-world hints.

Why the tool list looks different from other computer-control servers. Security-sensitiveconfiguration remains deliberately narrow, and everything else the alternatives can do has anequivalent here — usually more than one:

What ReMCP adds beyond the usual set: image reads and screenshots that any MCP client candisplay, binary transfer in both directions, archive create/extract, wait_for_process_output insteadof polling, line-range replacement, project-wide replace, unified diffs, checksums, trash instead ofdeletion, and host resource reporting.

Nothing is gated. There is no approval prompt, no "are you sure", and no mandatory dry run: a toolcall executes with the full rights of the account running the agent — the same trust model as SSH.Writes replace by default and moves/copies replace the destination. The catastrophic-commandguardrail defaults to warn (advisory, not blocking); an operator may choose allow or block.Files are never written to a local history log, so tool arguments and output are not recorded there.

Unrestricted by design

• No per-call approval contour. ReMCP does not add a confirmation dialog before each tool call.The local runtime's configured roots, command blocklist and command policy still apply, as do theoperating-system permissions of the account running the agent. Within those boundaries,start_process can operate services, packages, databases, containers, sudo, git, and other local tools.
• Full transfer in both directions. read_binary/write_binary move any file, create_archiveand extract_archive move whole trees, and take_screenshot shows the desktop.
• Optional hardening, explicit security boundaries. remcp godmode on lifts the roots, theblocklist and the command guardrail for one computer — and only a person at that computer can turnit on; no MCP tool accepts it. allowedRoots and blockedCommands are empty until an operatorconfigures them. dangerousCommands defaults to warn: matching catastrophic commands stillrun, but the result carries an advisory note; allow silences it and block refuses it. Theruntime refuses to start — loudly — if runtime.json cannot be parsed, so configured safetyboundaries are never silently dropped.
• Crash-resistant. A bad shell, a closed stdin, or a 40 MB line cannot take the runtime down; theagent restarts it if it exits, so a device recovers instead of going quietly offline.
• Outbound-only. Per-device revocable credential, hashed server-side, stored locally withrestrictive permissions. Runtime metadata from a custom server requires an explicit--trust-runtime decision.
• No local history. Tool arguments and outputs are never written to a log on your computer.

Usage metrics

Both the client and the runtime collect opt-out usage metrics: tool names, durations, outcomes,coarse error classes, session counts, and device health samples. They never include file paths, filecontents, command strings, tool arguments, or tool output — the event schema is a whitelist, so thosefields have nowhere to travel.

There is no telemetry endpoint and no third-party processor. The runtime emits MCP notifications tothe agent, and the agent forwards them over the authenticated WebSocket it already holds to yourReMCP account. No install ping, no postinstall script, no remote feature flags, no A/B assignment.

remcp telemetry off      # one switch for the client and the runtime
remcp telemetry status

Development

npm install
npm run check
npm test

Both workspaces are plain ESM with no build step. The contract commands (--help, --version,--print-tools, --describe) work with no dependencies installed, so CI can diff the advertisedtool surface against the published tarball.

License

MIT.