ReMCP
ReMCP is a local computer-control MCP server exposing 80+ filesystem, terminal, desktop UI, browser, diagnostics, and document tools for an AI agent to operate a paired machine.
File reading: read single/glob/multiple text files, images, binary chunks, page large files, compute hashes, list directories, inspect file metadata, and diff files.
File writing/editing: write one or many files, append, apply unified patches, edit exact blocks, replace line ranges, search-and-replace across files, set permissions, and preview changes with dry runs.
File organization: create directories, copy/move single or multiple paths, move to trash, delete paths, create/extract tar/tar.gz/zip archives.
Binary transfer: read and write any file as base64 chunks, enabling byte-for-byte transfer of binaries, archives, and oversized media.
Search: start content/filename searches, page through results, stop searches, and list active searches.
Process/terminal control: start shell commands, read and interact with process output, wait for matching output, terminate sessions, list sessions/processes, and kill arbitrary OS processes.
System/runtime introspection: get system health, runtime info/stats, environment variables, and adjust a narrow set of local runtime preferences.
Desktop/computer use: take screenshots, capture computer snapshots with accessibility trees/OCR, perform semantic UI actions, launch apps, open/reveal paths, work with windows, keyboard/mouse/pointer/scroll/clipboard, and automate native apps.
Browser automation: list tabs, navigate, snapshot/find/action/wait/evaluate against Chromium via CDP.
Diagnostics: network inspection/TCP tests, installed software inventory, and OS/runtime environment facts.
Documents: read PDF/DOCX/XLSX and structured CSV/JSON/XML content, plus PDF merge/split/page extraction/annotation inspection.
Offers a plugin for GitHub Copilot, allowing it to use ReMCP to interact with a paired computer's filesystem, processes, and system via the local runtime.
Provides a plugin for ChatGPT and Codex, enabling them to use ReMCP's runtime to manage files, run processes, capture screenshots, and control a paired computer.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ReMCPList the log files in my home directory"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ReMCP connects a computer you own or administer to ChatGPT & Codex, Cursor, Claude Code, Gemini CLI, Kiro, Cline, or another MCP client. The device agent makes an outbound connection only — no inbound port, no tunnel, no third-party desktop relay. This repository contains the public device client/runtime, portable Agent Plugin metadata, the Gemini CLI extension manifest, official MCP Registry metadata, and the host-specific OpenAI and Anthropic plugin packaging.
Packages
Package | What it is |
The device client: pairing, the outbound agent, the background service, and the usage-metrics switch. | |
The first-party local runtime: 83 MCP tools for files, images, binary transfer, archives, screenshots, search, terminal/process work, native desktop UI, loopback browser CDP, diagnostics, lightweight documents, and narrowly scoped runtime preferences, with two direct dependencies. |
Related MCP server: HostGate MCP
Install
Requires Node.js 22.5 or newer.
npm install --global @remcp/remcp@latestThen open ReMCP → Connect a machine and generate a one-time pairing command. Run that exact command on the computer you want to connect; it installs the runtime and registers the background service.
Pairing codes are generated in the authenticated workspace, expire automatically, and are single-use. Do not invent or reuse a code from documentation.
Commands
Command | Purpose |
| Start the device agent when no managed background service is already running |
| Show device, client/runtime versions, managed-agent state, update consistency and server reachability as JSON |
| Status plus a real local-runtime handshake and filesystem diagnostics |
| Install or repair the persistent user service |
| Update the client and runtime, then restart the service |
| Stop and remove the user service |
| Remove the service and the global packages |
| Show or change usage metrics for the client and the runtime |
| Show or change this computer's local unrestricted mode |
| Print the installed client version |
Plugins
For users, ReMCP is catalog-first:
Install from your AI host → sign in to ReMCP → use your paired computers.
You do not need to paste an MCP server URL, edit a manifest, clone this repository, or configure a local path just to use the published plugin.
Shareable install guides:
ChatGPT & Codex: https://remcp.site/install/chatgpt
Claude Code: https://remcp.site/install/claude
ChatGPT & Codex / OpenAI
ChatGPT and Codex share OpenAI's public plugin directory.
Search for ReMCP and open the ReMCP plugin card when it is available.
Choose Install plugin.
If prompted, choose Connect and complete ReMCP OAuth.
In ChatGPT, use @ReMCP when you want to invoke it explicitly. In Codex, use Sources → Use plugins → ReMCP.
If ReMCP is not visible yet, the listing or rollout is not available to that account. There is no manual MCP endpoint an ordinary plugin user needs to configure while waiting.
Claude Code / Anthropic
ReMCP was submitted through Claude Platform on September 18, 2026 and currently shows Submitted and pending review.
After approval:
Open https://claude.com/plugins. In Claude or Claude Desktop, you can also use Customize → Plugins → + → Browse plugins.
Search for ReMCP and confirm it supports Claude Code.
Choose Install.
Complete ReMCP authorization if Claude asks you to connect.
Ask Claude Code to use ReMCP on a computer already paired to your account.
While the listing is under review, ordinary users do not need to add a marketplace, clone this repository, or paste an MCP endpoint. Developer and reviewer workflows live in the technical guide.
Start with Plugin overview →.
Cursor and the wider MCP ecosystem
ReMCP publishes host-native metadata for coding agents plus directory records for MCP discovery:
Host / directory | User path | Status |
Cursor | Find ReMCP in Cursor Marketplace and install it. | published |
Gemini CLI | Install from the Extension Gallery when indexed, or run | gallery discovery enabled |
GitHub Copilot CLI | Install from the | submitted |
VS Code Agent Plugins | Browse | submitted |
Kiro Powers | Import | submitted |
Cline | Use the Cline MCP Marketplace after review; the current submission is tracked in | submitted |
Smithery | published | |
Glama | Open the ownership-verified connector at https://glama.ai/mcp/connectors/site.remcp/re-mcp. | verified / healthy |
Official MCP Registry | Search for | published (legacy identity) |
The same ReMCP OAuth account and paired computers sit behind every route. Marketplace and directory surfaces change discovery; they do not create separate ReMCP backends.
Distribution manifests, direct install commands, and review links are documented in PLUGINS.md → and DISTRIBUTION.md →.
Developer / reviewer internals
Host-specific manifests, MCP configuration, validation commands, submission artifacts, and local development workflows remain documented separately:
The OpenAI files and Claude files deliberately do not overwrite each other. Release checks fail if either host-specific contract drifts from the shared ReMCP version or production endpoint.
The local runtime
@remcp/runtime is a clean-room MCP server written for ReMCP. It is not a fork of, and shares no code
with, DesktopCommanderMCP or any other MCP
server.
83 granular device operations, 15 hosted definitions. Production advertises 8 device-facing façade tools, 2 account/fleet tools, and 5 app-only UI helpers; only 10 definitions are model-visible, and native-only deployments expose that same 10-tool model-facing surface. See the generated full tool reference for every façade and its operation list.
Device runtime surface:
Area | Tools |
Read |
|
Write / edit |
|
Organise |
|
Delete |
|
Transfer |
|
Screen |
|
Search |
|
Processes |
|
Runtime |
|
Computer use |
|
Browser |
|
Diagnostics |
|
Documents |
|
The hosted ReMCP endpoint advertises 15 tools in normal production, of which 10 are model-visible; with REMCP_CUSTOM_WIDGETS_ENABLED=false it exposes those same 10 model-facing tools without the five app-only helpers. The compact surface routes to all 83 granular runtime operations; legacy granular names remain callable for cached clients without inflating discovery for new models. With widgets enabled, read_file, view_image, and run_terminal own their UI resources directly and hydrate from the same tool result; structuredContent.preview remains a short-lived retry reference for the app only, so no second model-selected render call or device RPC is required. Each online device returned by list_devices reports its live supported subset, and unavailable operations fail closed.
Tool selection for AI agents
ReMCP publishes selection-oriented descriptions and ships the same decision tree in its operator skill:
native Accessibility/UI Automation → browser DOM/CDP → OCR → coordinates
Start unfamiliar desktop work with
computer_snapshot; useui_snapshot/ui_find/ui_actionfor native apps.For Chromium page content use
browser_navigate action=new_tabwhen needed, thenbrowser_snapshot/browser_find/browser_action/browser_waitinstead of desktop coordinates.Use
type_textfor normal Unicode text in native/focused controls,browser_actionfor Chromium page DOM text, andkeyboardfor shortcuts/navigation keys.Use
pointeronly when semantic actions cannot express the task; prefer element ids fordrag_drop. GNOME Wayland drag uses the consent-backed Remote Desktop portal rather than unreliable XTEST drag.Use
wait_for_ui/browser_waitinstead of fixed sleeps.Use
screenshot_regionfor targeted visual proof andrecord_screenonly for motion/timing.Use structured document tools instead of automating Office when the request is about file content.
All 39 computer/browser/diagnostic/document tools declare closed top-level input schemas, parameter descriptions, structured output schemas, and MCP read-only/destructive/idempotent/open-world hints.
Why the tool list looks different from other computer-control servers. Security-sensitive configuration remains deliberately narrow, and everything else the alternatives can do has an equivalent here — usually more than one:
Not included | Why |
Bundled browser/document rendering stacks | ReMCP supports lightweight DOCX/XLSX/PDF operations but deliberately uses OOXML and existing system PDF utilities instead of bundling Puppeteer, |
Broad configuration mutation |
|
URL fetching in | It is a server-side request forgery surface. The runtime reads your computer, not the internet. |
What ReMCP adds beyond the usual set: image reads and screenshots that any MCP client can
display, binary transfer in both directions, archive create/extract, wait_for_process_output instead
of polling, line-range replacement, project-wide replace, unified diffs, checksums, trash instead of
deletion, and host resource reporting.
Nothing is gated. There is no approval prompt, no "are you sure", and no mandatory dry run: a tool
call executes with the full rights of the account running the agent — the same trust model as SSH.
Writes replace by default and moves/copies replace the destination. The catastrophic-command
guardrail defaults to warn (advisory, not blocking); an operator may choose allow or block.
Files are never written to a local history log, so tool arguments and output are not recorded there.
Unrestricted by design
No per-call approval contour. ReMCP does not add a confirmation dialog before each tool call. The local runtime's configured roots, command blocklist and command policy still apply, as do the operating-system permissions of the account running the agent. Within those boundaries,
start_processcan operate services, packages, databases, containers,sudo, git, and other local tools.Full transfer in both directions.
read_binary/write_binarymove any file,create_archiveandextract_archivemove whole trees, andtake_screenshotshows the desktop.Optional hardening, explicit security boundaries.
remcp godmode onlifts the roots, the blocklist and the command guardrail for one computer — and only a person at that computer can turn it on; no MCP tool accepts it.allowedRootsandblockedCommandsare empty until an operator configures them.dangerousCommandsdefaults towarn: matching catastrophic commands still run, but the result carries an advisory note;allowsilences it andblockrefuses it. The runtime refuses to start — loudly — ifruntime.jsoncannot be parsed, so configured safety boundaries are never silently dropped.Crash-resistant. A bad shell, a closed stdin, or a 40 MB line cannot take the runtime down; the agent restarts it if it exits, so a device recovers instead of going quietly offline.
Outbound-only. Per-device revocable credential, hashed server-side, stored locally with restrictive permissions. Runtime metadata from a custom server requires an explicit
--trust-runtimedecision.No local history. Tool arguments and outputs are never written to a log on your computer.
Usage metrics
Both the client and the runtime collect opt-out usage metrics: tool names, durations, outcomes, coarse error classes, session counts, and device health samples. They never include file paths, file contents, command strings, tool arguments, or tool output — the event schema is a whitelist, so those fields have nowhere to travel.
There is no telemetry endpoint and no third-party processor. The runtime emits MCP notifications to the agent, and the agent forwards them over the authenticated WebSocket it already holds to your ReMCP account. No install ping, no postinstall script, no remote feature flags, no A/B assignment.
remcp telemetry off # one switch for the client and the runtime
remcp telemetry statusDevelopment
npm install
npm run check
npm testBoth workspaces are plain ESM with no build step. The contract commands (--help, --version,
--print-tools, --describe) work with no dependencies installed, so CI can diff the advertised
tool surface against the published tarball.
License
MIT.
Available Tools
7 toolscontrol_computerControl computerADestructiveInspect
Use this for semantic inspection or control of native desktop applications on this computer: windows, accessibility/UI elements, waits, displays, app launch, text/input, clipboard, open/reveal, notifications, or short screen recording. Snapshot/find/wait operations observe state; clicks, typing, window close, app launch, clipboard writes, and recording can change local application state. Prefer semantic targets before raw coordinates.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Concrete local runtime operation to execute in this domain. | |
| parameters | No | Arguments for the selected operation; validated against that operation’s original closed schema. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false. The description adds value by distinguishing observe-only operations from state-changing ones: 'Snapshot/find/wait operations observe state; clicks, typing, window close, app launch, clipboard writes, and recording can change local application state.' This is useful behavioral context beyond the annotations and is consistent with them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler. The first sentence front-loads the tool's purpose and scope, the second adds critical behavioral nuance about which operations mutate state, and the third gives a targeting preference. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with this much schema complexity and a rich output schema, the description is sufficiently complete: it defines the domain, separates read vs. mutate operations, and offers a targeting heuristic. It does not enumerate all supported operations, but the schema's operation enum and parameter definitions carry that burden. Minor gaps like platform-specific caveats are left to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema provides extremely detailed descriptions for every parameter, including nested objects and operation-specific constraints. The description itself adds little parameter-level detail, but with full schema coverage the baseline of 3 is appropriate; it does not need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'semantic inspection or control of native desktop applications on this computer.' It lists concrete capability categories (windows, accessibility/UI elements, app launch, clipboard, recording) that clearly distinguish it from sibling file/terminal/read tools. An agent can tell this is the desktop-automation tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: 'Use this for semantic inspection or control of native desktop applications on this computer.' It also provides an important operational guideline, 'Prefer semantic targets before raw coordinates.' It does not explicitly name alternatives or say when not to use it, but the domain boundary is clear enough against the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage_documentsManage documentsADestructiveInspect
Use this for structured document content: read PDF/DOCX/XLSX, edit DOCX/XLSX directly, or merge, split, extract, or inspect PDFs. DOCX/XLSX edits can replace the input when no separate output is supplied, and PDF write operations create or replace their requested output; read_document itself is read-only. Use read_file for plain line-oriented text.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Concrete local runtime operation to execute in this domain. | |
| parameters | No | Arguments for the selected operation; validated against that operation’s original closed schema. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral detail beyond the annotations: DOCX/XLSX edits can replace the input when no output is supplied, PDF write operations create or replace requested output, and read_document is read-only. This directly explains what may be destroyed, which aligns with and enriches the destructiveHint=true annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences: the first states scope and actions, the second warns about input/output replacement behavior, and the third routes text files elsewhere. Every sentence adds distinct value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich conditional schema, output schema, and annotations, the description covers what an agent needs to choose and call the tool safely: operation families, destructive side effects, and the key sibling distinction. The schema handles remaining parameter-level details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline applies. The description adds high-level operation categories but does not clarify individual parameter formats or constraints beyond what the schema already documents, such as page range syntax or output patterns.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names concrete resources (PDF/DOCX/XLSX) and specific verbs (read, edit, merge, split, extract, inspect), so an agent immediately knows the tool's domain and scope. It also explicitly distinguishes itself from read_file, which prevents confusion with a sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear trigger condition ('structured document content') and explicitly routes plain line-oriented text to read_file. It does not mention alternatives like manage_files, but the context plus the named sibling exclusion is sufficient for most selection decisions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage_filesManage filesADestructiveInspect
Use this when the task is about files, directories, archives, or filesystem search on this computer. Choose exactly one operation; parameters must contain only that operation’s arguments and are validated against its closed schema. Write, edit, move, permission, and delete operations can change or remove local data, while read and search operations leave files unchanged. Use read_file for one known text file.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Concrete local runtime operation to execute in this domain. | |
| parameters | No | Arguments for the selected operation; validated against that operation’s original closed schema. |
Output Schema
| Name | Required | Description |
|---|---|---|
| text | Yes | Human-readable result of the tool call. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations' destructiveHint=true, the description names which operation classes can change or remove local data and which leave files unchanged. It also discloses that parameters are validated against a closed per-operation schema. This materially improves the agent's understanding of a large, destructive-capable tool and does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no filler. The use condition is front-loaded, the per-operation constraint is stated clearly, and the read/write safety split and sibling routing are compressed into the remaining sentences. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite managing 29 sub-operations, the description gives the essential orientation: domain scope, one-operation rule, destructive vs read-only behavior, and a fallback to read_file. With such a rich input schema and an output schema present, the individual operation details are already covered structurally, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description mostly restates what the schema already says ('parameters must contain only that operation's arguments and are validated against its closed schema'), adding no new meaning to individual parameters. The rich schema carries the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's scope: files, directories, archives, and filesystem search on this computer. It also distinguishes itself from the sibling read_file by routing single known text files there. The verb is somewhat generic ('manage'), but combined with the title and operation list it is clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool ('task is about files, directories, archives, or filesystem search'), gives an explicit alternative ('Use read_file for one known text file'), and also separates read/search operations from write/edit/delete operations. An agent can reliably decide between this tool and the read_file sibling without opening the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage_systemManage systemADestructiveIdempotentInspect
Use this for operating-system or ReMCP runtime state: system/runtime/process facts, runtime preferences, services, event logs, networking, installed apps, environment, audio, or explicit power actions. Fact, log, and inventory operations only observe state; process termination, preference/service/audio changes, restart, and shutdown can interrupt work or change the machine. Use run_terminal for general shell commands.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Concrete local runtime operation to execute in this domain. | |
| parameters | No | Arguments for the selected operation; validated against that operation’s original closed schema. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already provide destructiveHint and readOnlyHint, the description adds genuinely useful behavioral context by separating observe-only fact/log/inventory operations from operations that can interrupt work or change the machine. This tells an agent both what is safe and what consequences to expect beyond the boolean annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and every sentence earns its place: domain, safety caveat, and routing to run_terminal. The first sentence is a lengthy category list and includes a few domains absent from the schema, so it is not perfectly tight, but overall it is appropriately concise for a broad umbrella tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high complexity of nine conditional operations and nested parameters, the description is only a high-level umbrella and does not help an agent choose between similar operations such as get_system_info, get_runtime_info, and get_runtime_stats. The prose also claims support for services, event logs, audio, and power actions that are not represented in the operation enum, leaving a meaningful completeness gap despite the rich schema and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and parameters like pid, limit, key, value, host, port, and action are already documented in the schema. The description contributes no parameter-level meaning, which meets the baseline for full schema coverage but does not elevate it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description anchors the tool to a concrete domain (operating-system/ReMCP runtime state) and gives a meaningful category list: facts, processes, preferences, networking, installed apps, environment. It also distinguishes itself from run_terminal. However, it mentions services, event logs, audio, and power actions that do not appear in the operation enum, so the claimed scope is somewhat broader than the schema actually supports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states when to use this tool and explicitly routes general shell commands to run_terminal. It does not give exclusions for the other sibling tools or explain how to choose among the nine operations, but the main alternative is named and the intended context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead fileARead-onlyIdempotentInspect
Read a plain text or line-oriented file on this computer: source, config, Markdown, scripts or logs. Use read_document for PDF, DOCX, XLSX and other structured documents. Legacy .docx/.pdf extraction remains supported for compatibility. Use offset and length to page through large text files; a negative offset reads from the end.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path of the file to read. Relative paths resolve against the runtime working directory. | |
| length | No | Maximum number of lines to return. | |
| offset | No | Zero-based first line to read. Negative values read the last N lines. |
Output Schema
| Name | Required | Description |
|---|---|---|
| text | Yes | Human-readable result of the tool call. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose read-only and idempotent behavior)Skip the description. The description adds real behavioral context: it limits the tool to text-like files, explains paging semantics, and discloses the legacy docx/pdf extraction behavior. This goes beyond annotation coverage without redundancy.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each with a distinct purpose: scope definition, alternative routing, and paging guidance. No fluff or repetition of schema fields. The phrasing is compact and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-file read tool, the description covers scope, exclusions, paging, and compatibility, while the output schema and read-only annotations cover the rest. An agent has enough information to invoke it correctly and to decide when another tool is better.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value beyond the schema by explaining how offset and length should be used together to page through large files and clarifying the negative-offset behavior. This is meaningful, though the schema already documents each parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (read), a specific resource type (plain text or line-oriented file), and concrete examples (source, config, Markdown, scripts, logs). Explicitly distinguishes from read_document for PDF/DOCX/XLSX, so an agent can select it among several sibling read tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit routing guidance: use read_document for structured documentsainer and notes legacy .docx/.pdf support for compatibility. Also gives concrete usage advice for large files with offset/length paging and negative offsets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_terminalRun terminal operationsADestructiveInspect
Use this when the task needs a shell command or an existing ReMCP terminal session: start, read, wait, interact, stop, or list sessions. Choose exactly one operation; parameters are validated against that operation’s closed schema. Starting or interacting with commands can change local or external state, and force termination can lose unsaved process work; reading, waiting, and listing do not mutate the session.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Concrete local runtime operation to execute in this domain. | |
| parameters | No | Arguments for the selected operation; validated against that operation’s original closed schema. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description explicitly warns that starting or interacting with commands can change local or external state and that force termination can lose unsaved process work, while reading, waiting, and listing do not mutate the session. This clarifies the destructive/non-destructive split across operations and matches the annotation profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the trigger condition and operation list, followed by the crucial safety caveats. Every sentence contributes selection guidance or behavioral warning with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers when to use the tool, the need to select exactly one operation, validation behavior, and the mutation profile of each operation family. Since an output schema exists and the input schema fully documents each operation's parameters, no critical selection or invocation information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the input schema already provides detailed descriptions for operation-specific parameters such as pid, offset, pattern, and timeout_ms. The description only adds a structural note about per-operation validation, not new meaning for individual parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific trigger condition ('when the task needs a shell command or an existing ReMCP terminal session') and enumerates the operation families: start, read, wait, interact, stop, and list sessions. This clearly distinguishes the terminal domain from sibling tools like manage_files or control_computer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit context for when to use the tool and emphasizes that exactly one operation must be chosen, with parameters validated against that operation's schema. It does not explicitly name sibling alternatives or state when not to use the tool, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
view_imageView image or screenshotAInspect
Use this when the result must be pixels from this computer: read an existing image or capture the desktop, one window, monitor, or region. These operations return pixels without interacting with the visible UI. Use control_computer when semantic structure or an action is enough.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Concrete local runtime operation to execute in this domain. | |
| parameters | No | Arguments for the selected operation; validated against that operation’s original closed schema. |
Output Schema
| Name | Required | Description |
|---|---|---|
| text | Yes | Human-readable result of the tool call. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses a key behavioral trait: 'These operations return pixels without interacting with the visible UI', which is useful beyond the annotations. However, it claims capture of 'one window, monitor, or region' while the input schema for take_screenshot only exposes keep and directory parameters, leaving a behavioral promise the schema does not support. Annotations are all false and provide no additional coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the key selection criterion ('when the result must be pixels'), and zero filler. The alternative and exclusion are stated efficiently in the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The discriminated-union schema and output schema provide good structural coverage, and the description supplies overall context. However, the description overpromises window/monitor/region capture that is not reflected in the schema, creating a serious mismatch an agent must resolve before calling the tool correctly. This gap makes the definition not fully complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline should be 3cars, but the description actively adds misleading meaning by mentioning 'one window, monitor, or region' capture when no schema parameter supports selecting those targets. It does not clarify how the operation discriminates between read_image and take_screenshot beyond the fixed operation enum, and the unsupported target claims could cause an agent to pass invalid parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific purpose: 'Use this when the result must be pixels from this computer', and enumerates the exact operations (read an existing image or capture desktop/window/monitor/region). It distinguishes itself from siblings by emphasizing pixels and the alternative control_computer for semantic structure or actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance ('when the result must be pixels') and names the clear alternative ('Use control_computer when semantic structure or an action is enough'). It also adds context that these operations do not interact with the visible UI, helping an agent choose correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
59 tool updates
v0.2.88- Removed
apply_patch - Removed
computer_action - Removed
computer_snapshot - Added
control_computer - Removed
copy_file - Removed
copy_paths - Removed
create_archive - Removed
create_directory - Removed
delete_path - Removed
delete_paths - Removed
diff_files - Removed
edit_block - Removed
environment - Removed
extract_archive - Removed
force_terminate - Removed
get_file_info - Removed
get_more_search_results - Removed
get_runtime_info - Removed
get_runtime_stats - Removed
get_system_info - Removed
hash_file - Removed
installed_apps - Removed
interact_with_process - Removed
kill_process - Removed
launch_app - Removed
list_directory - Removed
list_processes - Removed
list_searches - Removed
list_sessions - Added
manage_documents - Added
manage_files - Added
manage_system - Removed
move_file - Removed
move_paths - Removed
move_to_trash - Removed
network - Removed
open_path - Removed
pdf_action - Removed
read_binary - Removed
read_document - Removed
read_files - Removed
read_image - Removed
read_multiple_files - Removed
read_process_output - Removed
replace_in_files - Removed
replace_lines - Removed
reveal_path - Added
run_terminal - Removed
set_config_value - Removed
set_permissions - Removed
start_process - Removed
start_search - Removed
stop_search - Removed
take_screenshot - Added
view_image - Removed
wait_for_process_output - Removed
write_binary - Removed
write_file - Removed
write_files
54 tool updates
v0.1.0- First observed
apply_patch - First observed
computer_action - First observed
computer_snapshot - First observed
copy_file - First observed
copy_paths - First observed
create_archive - First observed
create_directory - First observed
delete_path - First observed
delete_paths - First observed
diff_files - First observed
edit_block - First observed
environment - First observed
extract_archive - First observed
force_terminate - First observed
get_file_info - First observed
get_more_search_results - First observed
get_runtime_info - First observed
get_runtime_stats - First observed
get_system_info - First observed
hash_file - First observed
installed_apps - First observed
interact_with_process - First observed
kill_process - First observed
launch_app - First observed
list_directory - First observed
list_processes - First observed
list_searches - First observed
list_sessions - First observed
move_file - First observed
move_paths - First observed
move_to_trash - First observed
network - First observed
open_path - First observed
pdf_action - First observed
read_binary - First observed
read_document - First observed
read_file - First observed
read_files - First observed
read_image - First observed
read_multiple_files - First observed
read_process_output - First observed
replace_in_files - First observed
replace_lines - First observed
reveal_path - First observed
set_config_value - First observed
set_permissions - First observed
start_process - First observed
start_search - First observed
stop_search - First observed
take_screenshot - First observed
wait_for_process_output - First observed
write_binary - First observed
write_file - First observed
write_files
TDQS
Scored across 7 tools
Each tool covers a distinct domain—UI control, filesystem, terminal sessions, pixel capture, system/runtime state, structured documents, and plain-text reads—and the descriptions explicitly cross-reference one another to resolve edge cases. The few adjacent tools (read_file vs. manage_files, view_image vs. control_computer) have clear usage guidance that prevents misselection.
All seven tool names follow the same verb_noun snake_case convention: control_computer, manage_files, run_terminal, view_image, manage_system, manage_documents, read_file. There are no mixed casing styles, vague single-word verbs, or unpredictable patterns.
Seven tools is a well-scoped size for a computer-automation server; each tool maps to a major capability area without bloat. Even the specialized read_file and view_image tools serve frequent standalone tasks and earn their place.
The set covers the core lifecycle of local computer interaction: UI observation/control, file operations, terminal sessions, system state, structured document editing, and pixel capture. No obvious dead ends or missing major operations are apparent for the stated scope.
Maintenance
Related MCP Connectors
Remote MCP server for OFAC screening, EDD memos, exposure forecasts, queues, and reports.
Secure tunneling, reverse proxy and remote access for local applications.
Remote MCP server for Tandem docs, install guides, SDKs, workflows, and agent setup help.
Run commands and read/write files on your servers over Termalin's keyless tunnels (hosted MCP).
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables cloud agents to securely operate local machine resources (files, commands, screenshots) via standard MCP protocol.MIT
- AlicenseNot gradedqualityCmaintenanceEnables an MCP client to safely access selected local files and trusted executables with policy control, audit, and rollback via a Windows control center.Apache 2.0
- AlicenseNot gradedqualityAmaintenanceEnables MCP clients to connect to a local workspace over a public tunnel and lets them run shell commands and transfer files bidirectionally.262 npm21GPL 3.0
- FlicenseNot gradedqualityAmaintenanceEnables MCP clients to safely access user-local filesystems, apply validated patches, inspect git state, and run persistent jobs on outbound-connected local runners through a stateless Cloudflare control plane.8-