Persistent Windows computers for AI agents. API signup, prepaid credit, desktop control and files.
Scored across 39 tools
Most tools map to a distinct resource+action, but there is real overlap between 'catalog' (prices, payment methods), 'payment_methods', and 'account' (balance, prices), and between 'exec', 'ssh', and 'input'/'screenshot' as competing ways to drive a computer. The naming of 'machine_request' (a read-only request-key lookup) and 'machine_request_stop' is misleading enough to cause misselection, and 'snapshot' vs 'snapshot_start' vs 'backup_restore' require careful reading.
There is a discernible pattern (plural noun = list, e.g. machines/snapshots/templates/keys; verb_noun = act, e.g. machine_create, key_revoke, topup_pay), but it is broken by many bare-noun action tools such as 'snapshot' (create), 'fork', 'exec', 'input', 'signup', 'viewer', 'account', and 'catalog'. Readable overall, but a consumer cannot reliably predict whether a tool is a lister or an action from its name.
39 tools is heavy, though the surface spans genuinely large domains (computers, snapshots, templates, keys, payments, auth, remote control). Several families (snapshot_*, key_*, topup_*) could be consolidated or nested, and a few tools (service_health, machine_health, machine_request) add surface area for thin value.
Coverage is strong: full machine lifecycle (create/get/list/update/start/stop/delete/health), snapshot and template CRUD plus restore, key management, signup/verify, payment quoting/paying/status, and remote interaction via exec/ssh/file/input/screenshot/viewer. Minor gaps remain, e.g. no machine reboot/resize, no directory listing alongside file_read/file_write, and no billing history or account deletion.
Requires a stopped computer with this account's backup copy. Poll the machine until backup.restoring clears; inspect backup.restore_error before starting.
Inputs: id (required), body (required).
Public prices, payment methods and template readiness
Inputs: no named parameters.
Choose script or argv. desktop:true is required for native Office. Default is SYSTEM. HTTP 200 is transport success; inspect exit_code, stderr and timed_out. Never blindly repeat after a lost reply.
Inputs: id (required), body (required).
Writes atomically and creates parent directories. URL-encode the absolute Windows path. Body is bytes, not JSON.
Inputs: id (required), path (required), content_base64 (required).
Protected computers refuse cloning. Partial failures return the snapshot and all copies that started; retain their IDs before retrying.
Inputs: id (required), body (required).
Coordinates are screenshot pixels. Scroll dy is notches, positive down. Body limit 64 KiB. Inspect the screen before repeating uncertain input.
Inputs: id (required), body (required).
Returns key plaintext once. Store it securely.
Inputs: body (required).
Revoke an API key
Inputs: id (required).
Persist a unique Idempotency-Key and exact body before calling. require_office_ready rejects an unverified template before provisioning. Creation needs 15 minutes of resulting aggregate running credit and capacity. prevent_cloning protects the new identity.
Inputs: body (required), request_key.
Irreversible. Backups are deleted too. Snapshots and forks retain their own state and encryption keys.
Inputs: id (required).
Read a computer
Inputs: id (required).
Read guest readiness
Inputs: id (required).
Read-only request-key lookup; never creates another computer.
Inputs: key (required).
Cancels the request key before locating/stopping a possibly created computer. A cancelled key cannot be reused.
Inputs: key (required).
Read stop_warning/resume_warning before continuing work. A cold recovery can preserve disk without unsaved memory. New admission requires prepaid runway and physical capacity.
Inputs: id (required).
Read stop_warning/resume_warning before continuing work. A cold recovery can preserve disk without unsaved memory. Stop ends running charges; optional stopped storage/backups retain their rates.
Inputs: id (required).
Change auto-stop or backup settings
Inputs: id (required), body (required).
Available prepayment methods and amount bounds
Inputs: no named parameters.
Read a PNG of the desktop
Inputs: id (required).
Control-plane health
Inputs: no named parameters.
Creates an account or recovers access through an API-readable inbox. Codes expire in 10 minutes, with five attempts. The provider code is never returned. Limit: three requests per address, replenishing one per minute.
Inputs: body (required).
Consumes one email code. Only an active single-organization administrator may recover an account key. The key is shown once; a lost reply requires another email challenge. No free credit.
Inputs: body (required).
Erase a snapshot
Inputs: id (required).
Start a copy from a snapshot
Inputs: id (required), body (required).
This URL transports SSH bytes. End-to-end SSH authentication and host-key verification are still required.
Inputs: id (required).
Replaces the source computer. Private templates copy files and signed-in identities; remove credentials before saving. Protected computers refuse this operation.
Inputs: id (required), body (required).
Erase a private template
Inputs: id (required).
Use one payment header and keep Authorization for the Panes key. Missing payment returns 402 with WWW-Authenticate (MPP) or PAYMENT-REQUIRED (x402) and payment in the JSON body. Stripe SPT payload is {spt,externalId}; x402 v2 payload includes resource, accepted requirements, signature and EIP-3009 authorization. The exact issued quote must match. A pending or uncertain payment must be polled, never repaid. Checkout returns a browser URL.
Inputs: id (required), payment_signature, payment_authorization.
Reusing a key returns the original quote (HTTP 200); a changed amount/method returns 409. Quote expires in 30 minutes. No charge until authorized. Check /v1/payment-methods before choosing a method.
Inputs: body (required), request_key (required).
Resumes the stored payment when pending. Paid credit is granted exactly once. Do not submit a new payment after a lost response; poll this URL. pending recommends three seconds between reads.
Inputs: id (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Cloud desktops for AI agents: create a Linux computer, see its screen, click, type and run tasks.
Real desktops for AI agents, on machines you choose: screenshot, type, click, hire more agents.
Persistent Linux computers for AI agents: desktop, signed-in browser, vault, apps and shell.
Your own cloud computer run by an AI agent: signed-in browser, its own email, files, long jobs.
Add one secure layer between your agents and this server.
