Remote Link Local MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Remote Link Local MCPWhat files are in my Downloads folder?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Remote Link Local MCP
Remote Link Local MCP is the local execution component of the Remote Link project. It exposes a computer to MCP clients through a controlled local tool surface.
The first milestone is intentionally small:
ChatGPT Work / MCP client
|
| MCP
v
Remote Link
|
| local stdio
v
Desktop Commander OSS
|
+-- filesystem
+-- terminal
+-- processesRemote Link Local MCP does not reimplement filesystem and terminal automation. It uses the open-source Desktop Commander MCP server as a local execution backend and adds its own permission boundary and, later, remote transport/device layer.
Status
Early proof of concept. Do not expose it to untrusted users or networks.
Safe mode (default)
remote_link_statuslist_directoryread_fileget_file_infolist_processescore_list_tools
Developer mode
Adds:
start_processwrite_fileedit_block
Full mode
Can additionally expose core_call_tool, a raw pass-through to the Desktop Commander tool catalog. It is deliberately disabled unless two explicit switches are enabled.
Related MCP server: HostGate MCP
Requirements
Node.js 20+
pnpm
npxavailable on PATH
Desktop Commander is launched on demand with:
npx -y @wonderwhy-er/desktop-commander@latestRun locally
pnpm install
pnpm startRemote Link is currently a stdio MCP server, so normally an MCP host or tunnel starts it for you instead of you typing into it directly.
To inspect it locally:
pnpm inspectPermission modes
Safe mode is the default:
pnpm startDeveloper mode enables terminal execution and file mutation.
macOS / Linux:
REMOTE_LINK_MODE=developer pnpm startPowerShell:
$env:REMOTE_LINK_MODE="developer"
pnpm startFull raw-core access requires both:
REMOTE_LINK_MODE=full
REMOTE_LINK_ALLOW_CORE_CALL=1This is intentionally inconvenient. A generic raw call can reach any tool the execution backend exposes.
Connect through OpenAI Secure MCP Tunnel
Secure MCP Tunnel is useful for the PoC because the local MCP server can stay private. The tunnel client runs on the same computer, opens an outbound HTTPS connection to OpenAI, and launches Remote Link as a local stdio MCP command.
After creating a tunnel in OpenAI Platform tunnel settings and installing tunnel-client, initialize a profile from this repository.
export CONTROL_PLANE_API_KEY="sk-..."
tunnel-client init \
--sample sample_mcp_stdio_local \
--profile remote-link-local \
--tunnel-id YOUR_TUNNEL_ID \
--mcp-command "pnpm start"
tunnel-client doctor --profile remote-link-local --explain
tunnel-client run --profile remote-link-localOn PowerShell set CONTROL_PLANE_API_KEY with:
$env:CONTROL_PLANE_API_KEY="sk-..."Then in ChatGPT Developer Mode, create a personal plugin and choose Tunnel as the connection type.
For the first test, keep Remote Link in safe mode and ask it to:
call
remote_link_statuslist a non-sensitive directory
read a harmless text file
Only after those work should you restart the tunnel in developer mode.
Why not expose Desktop Commander directly?
For a local experiment, you can. Remote Link Local MCP exists because the intended product needs a layer that Desktop Commander local does not provide:
explicit Safe / Developer / Full permission profiles
device identity and pairing
remote transport independent of any one AI vendor
per-device access policy
audit and approval boundaries
future Cloudflare-hosted relay for public remote MCP use
The OpenAI tunnel is a development transport, not the eventual public architecture.
Planned architecture
+------------------+
ChatGPT / Claude / Codex | MCP clients |
+--------+---------+
|
HTTPS / MCP
|
+--------v---------+
| Remote Link Edge |
| Cloudflare |
+--------+---------+
|
outbound encrypted
|
+--------v---------+
| Local Agent |
| Win / macOS/Linux|
+--------+---------+
|
local MCP/stdin
|
+--------v---------+
| Execution Core |
| Desktop Commander|
+------------------+Security
Remote computer control is high impact.
Remote Link Local MCP starts read-oriented and keeps mutation tools out of the MCP tool list unless developer mode is explicitly enabled. This is only a first boundary; it is not a sandbox.
Before a public release the project should add:
directory-scoped permissions enforced outside the shell
credential/sensitive-path deny rules
command policy and approval gates
device-bound credentials
replay protection
short-lived sessions
encrypted transport
auditable tool invocations with secret redaction
optional container / sandbox execution
Do not treat Desktop Commander's allowedDirectories or command blocklist as a complete security boundary when terminal execution is enabled.
Upstream
Remote Link Local MCP interoperates with Desktop Commander MCP, which is MIT licensed. Remote Link is an independent project and is not affiliated with Desktop Commander.
License
MIT
Available Tools
6 toolscore_list_toolsInspect execution-core toolsARead-only
List tools currently exposed by the local Desktop Commander core. Useful for compatibility diagnostics.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds the 'local Desktop Commander core' scope and the diagnostic purpose, which is useful context. It does not describe output format or pagination, but for a zero-parameter listing tool this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no wasted words. The core action is front-loaded and the purpose is stated efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only listing tool, the description is complete enough. It states what is listed and why. It could mention that the output is a list of tool names, but the tool name and description already make that obvious.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics burden. The description correctly implies no inputs are needed. Baseline 4 for zero-parameter tools is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('tools currently exposed by the local Desktop Commander core'), and adds a purpose ('compatibility diagnostics'). It is clear enough to distinguish from siblings like list_directory or list_processes, though it does not explicitly name a sibling to differentiate from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it—when checking which tools the core exposes, especially for compatibility diagnostics. It does not explicitly state when not to use it or name alternatives, but the context is reasonably clear given the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_file_infoGet local file infoARead-only
Get metadata about a local file or directory without modifying it.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation readOnlyHint=true already indicates the tool does not modify, and the description's "without modifying it" merely restates that. The description adds no new behavioral context beyond the annotation – it does not disclose error handling, permission requirements, symlink behavior, or output format. With annotations present, this is a minimal contribution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It includes the core action, the resource scope, and the safety trait in six words, every part contributing to understanding without repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only one parameter and no output schema, and the description covers the path's scope and safety. However, it does not mention what metadata fields are returned, error conditions (e.g., file not found), or whether paths must be absolute. For a read-only metadata tool, this may be acceptable, but it leaves some gaps for an agent deciding between siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must clarify the path parameter. It adds meaningful semantics by specifying that the path refers to a "local file or directory", distinguishing it from remote paths and clarifying that both files and directories are acceptable. This compensates for the schema's lack of description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool action: "Get metadata about a local file or directory without modifying it." It uses a specific verb (Get), resource (metadata about a local file or directory), and explicitly differentiates from siblings by emphasizing "local" and "without modifying", which distinguishes it from remote_link_status, read_file, and list_directory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when metadata of a local file/directory is needed) but does not explicitly mention alternatives or exclusions. It does not say "use list_directory for directory contents" or "use read_file for content", leaving the choice to inference from the word "metadata".
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_directoryList local directoryARead-only
List files and directories on the connected computer through the Desktop Commander execution core.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or allowed local directory path | |
| depth | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already covers the operation's non-destructive nature. The description adds only that the listing happens on the 'connected computer' through the 'Desktop Commander execution core', which gives environmental context but does not disclose recursion behavior, sorting, or output format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
At a single front-loaded sentence, the description is concise and minimally redundant. The phrase 'through the Desktop Commander execution core' adds environmental context without bloat, so every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and its read-only annotation covers safety, but with no output schema and no mention of recursion depth or how this differs from file-info/read siblings, the description is adequate but leaves gaps. An agent calling it correctly would need to infer depth semantics and output shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no information about the two parameters. The schema documents 'path' as an absolute or allowed path (50% coverage), but 'depth' is left to its name and numeric constraints alone, and the description does not compensate for that gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' with the resource 'files and directories on the connected computer', making the tool's function immediately clear. This separates it from siblings like read_file (content) and get_file_info (metadata), so an agent can distinguish without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use or when-not-to-use guidance and names no sibling alternatives. The intended use is only implied by the verb and resource, leaving an agent to infer when to choose this over read_file or get_file_info.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_processesList local processesARead-only
List processes running on the connected computer. This does not terminate or modify processes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation readOnlyHint=true already signals safety, and the description reinforces it by stating 'does not terminate or modify processes.' This adds explicit behavioral disclosure beyond the annotation, confirming that the tool is purely observational. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero wasted words. The primary action and scope are front-loaded, and the non-destructive clarification is concise. Ideal length for a simple read-only tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter, no-output-schema tool, the description fully covers what the tool does and what it does not do. An agent has everything needed to decide to call it and interpret its effect. Nothing is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the schema carries no meaning to supplement. The description adds no parameter details because none exist. Per the baseline rule for 0-param tools, a score of 4 is appropriate; the description is complete for its interface.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('list') and resource ('processes') with scope ('running on the connected computer'). It clearly distinguishes from sibling tools which all operate on files, directories, or links. The purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (whenever process listing is needed) and, by contrast with the file-oriented siblings, effectively excludes those alternatives. It doesn't explicitly say 'use this for processes, not files,' but the resource naming makes that clear. A slight gap is that it doesn't mention any conditions that would make another tool more appropriate, but none are relevant.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead local fileARead-only
Read a local file through the Desktop Commander execution core. Large files should be paged with offset and length.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| length | No | ||
| offset | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already covers the safety profile, and the description adds a meaningful behavioral caveat: large files should be paged with offset and length, implying the tool may otherwise return very large content. This goes beyond the annotation and helps the agent avoid excessive reads.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences carry a clear purpose and an actionable usage rule. No filler or redundant restatement of the title or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool, the description covers selection and the main invocation concern (paging), but it omits return format details and the exact meaning of offset and length. Since there is no output schema, some expectation-setting would be valuable, though the tool's core use is intuitive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions offset and length as paging controls but does not specify their units or exact semantics, and path is only implicitly clear from the title. This is a partial hint, not enough to unambiguously invoke the tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly names the action ('Read') and resource ('a local file'), and identifies the execution core, making it clear this is a file-content-reading tool rather than a listing or metadata tool. It does not explicitly contrast with get_file_info, but the content-read semantics are clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides concrete guidance for large files: page with offset and length. However, it does not state when to prefer this tool over sibling tools like get_file_info or list_directory, leaving some selection context implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
remote_link_statusRemote Link statusARead-only
Show the active Remote Link permission mode and local execution backend. This does not modify the computer.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description reinforces this with the explicit statement 'This does not modify the computer,' which is a valuable safety signal. It also clarifies that it reports the active/current state rather than changing anything.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences front-load the action and output, and the safety disclaimer earns its place. There is no redundant or vague filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter status tool, the description fully covers what it reports, that it is read-only, and that no inputs are required. The absence of an output schema is acceptable because the description names the two pieces of information returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty input schema, so there is no parameter detail for the description to add. The baseline 4 applies because no parameter documentation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the verb 'Show' and names two concrete outputs: the active Remote Link permission mode and the local execution backend. This is unambiguous and clearly distinct from the sibling file/process inspection tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly frames this as a read-only status inspection, so the intended use case is obvious: check the current Remote Link permission mode and backend. It does not explicitly name alternatives or exclusions, but no sibling tool overlaps with this status query.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
core_list_tools - First observed
get_file_info - First observed
list_directory - First observed
list_processes - First observed
read_file - First observed
remote_link_status
TDQS
Scored across 6 tools
Each tool targets a distinct concern: connection status, directory listing, file reading, file metadata, process listing, and core tool enumeration. There is no meaningful overlap between any two tools.
Most tools follow a verb_noun pattern (list_directory, read_file, get_file_info, list_processes). The exceptions are remote_link_status, which is noun_noun, and core_list_tools, which has a prefix before the verb; these are minor deviations.
Six tools is a well-scoped collection for a read-only remote diagnostics and file access server. Each tool serves a clear purpose without bloat or redundancy.
For the apparent read-only diagnostic scope, the surface is complete: status, file browsing, file reading, metadata, process listing, and core tool discovery are all covered. No obvious dead ends or missing operations within this intended domain.
Maintenance
Related MCP Connectors
Remote MCP server for Tandem docs, install guides, SDKs, workflows, and agent setup help.
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Run and manage H Company's Computer-Use Agents from any MCP client.
Unified gateway exposing 150+ tools across all NexGenData MCP servers via one endpoint.
Related MCP Servers
- AlicenseBqualityBmaintenanceEnables full local computer control from MCP clients, including terminal commands, file system operations, application management, screen capture, and input device automation across Windows, macOS, and Linux.27MIT
- AlicenseNot gradedqualityCmaintenanceEnables an MCP client to safely access selected local files and trusted executables with policy control, audit, and rollback via a Windows control center.Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables self-hosted local file, terminal, document, and named-device tools for MCP clients, with an isolated document mode and a full-access mode.MIT
- AlicenseAqualityBmaintenanceEnables AI assistants to securely operate on a local workstation through MCP by exposing file, shell, and workspace management tools.10MIT