Skip to main content
Glama
yaohuangguan

Remote Link Local MCP

by yaohuangguan

Remote Link Local MCP

Remote Link Local MCP is the local execution component of the Remote Link project. It exposes a computer to MCP clients through a controlled local tool surface.

The first milestone is intentionally small:

ChatGPT Work / MCP client
          |
          | MCP
          v
     Remote Link
          |
          | local stdio
          v
Desktop Commander OSS
          |
          +-- filesystem
          +-- terminal
          +-- processes

Remote Link Local MCP does not reimplement filesystem and terminal automation. It uses the open-source Desktop Commander MCP server as a local execution backend and adds its own permission boundary and, later, remote transport/device layer.

Status

Early proof of concept. Do not expose it to untrusted users or networks.

Safe mode (default)

  • remote_link_status

  • list_directory

  • read_file

  • get_file_info

  • list_processes

  • core_list_tools

Developer mode

Adds:

  • start_process

  • write_file

  • edit_block

Full mode

Can additionally expose core_call_tool, a raw pass-through to the Desktop Commander tool catalog. It is deliberately disabled unless two explicit switches are enabled.

Related MCP server: HostGate MCP

Requirements

  • Node.js 20+

  • pnpm

  • npx available on PATH

Desktop Commander is launched on demand with:

npx -y @wonderwhy-er/desktop-commander@latest

Run locally

pnpm install
pnpm start

Remote Link is currently a stdio MCP server, so normally an MCP host or tunnel starts it for you instead of you typing into it directly.

To inspect it locally:

pnpm inspect

Permission modes

Safe mode is the default:

pnpm start

Developer mode enables terminal execution and file mutation.

macOS / Linux:

REMOTE_LINK_MODE=developer pnpm start

PowerShell:

$env:REMOTE_LINK_MODE="developer"
pnpm start

Full raw-core access requires both:

REMOTE_LINK_MODE=full
REMOTE_LINK_ALLOW_CORE_CALL=1

This is intentionally inconvenient. A generic raw call can reach any tool the execution backend exposes.

Connect through OpenAI Secure MCP Tunnel

Secure MCP Tunnel is useful for the PoC because the local MCP server can stay private. The tunnel client runs on the same computer, opens an outbound HTTPS connection to OpenAI, and launches Remote Link as a local stdio MCP command.

After creating a tunnel in OpenAI Platform tunnel settings and installing tunnel-client, initialize a profile from this repository.

export CONTROL_PLANE_API_KEY="sk-..."

tunnel-client init \
  --sample sample_mcp_stdio_local \
  --profile remote-link-local \
  --tunnel-id YOUR_TUNNEL_ID \
  --mcp-command "pnpm start"

tunnel-client doctor --profile remote-link-local --explain
tunnel-client run --profile remote-link-local

On PowerShell set CONTROL_PLANE_API_KEY with:

$env:CONTROL_PLANE_API_KEY="sk-..."

Then in ChatGPT Developer Mode, create a personal plugin and choose Tunnel as the connection type.

For the first test, keep Remote Link in safe mode and ask it to:

  1. call remote_link_status

  2. list a non-sensitive directory

  3. read a harmless text file

Only after those work should you restart the tunnel in developer mode.

Why not expose Desktop Commander directly?

For a local experiment, you can. Remote Link Local MCP exists because the intended product needs a layer that Desktop Commander local does not provide:

  • explicit Safe / Developer / Full permission profiles

  • device identity and pairing

  • remote transport independent of any one AI vendor

  • per-device access policy

  • audit and approval boundaries

  • future Cloudflare-hosted relay for public remote MCP use

The OpenAI tunnel is a development transport, not the eventual public architecture.

Planned architecture

                         +------------------+
ChatGPT / Claude / Codex |   MCP clients    |
                         +--------+---------+
                                  |
                            HTTPS / MCP
                                  |
                         +--------v---------+
                         | Remote Link Edge |
                         | Cloudflare       |
                         +--------+---------+
                                  |
                         outbound encrypted
                                  |
                         +--------v---------+
                         | Local Agent      |
                         | Win / macOS/Linux|
                         +--------+---------+
                                  |
                           local MCP/stdin
                                  |
                         +--------v---------+
                         | Execution Core   |
                         | Desktop Commander|
                         +------------------+

Security

Remote computer control is high impact.

Remote Link Local MCP starts read-oriented and keeps mutation tools out of the MCP tool list unless developer mode is explicitly enabled. This is only a first boundary; it is not a sandbox.

Before a public release the project should add:

  • directory-scoped permissions enforced outside the shell

  • credential/sensitive-path deny rules

  • command policy and approval gates

  • device-bound credentials

  • replay protection

  • short-lived sessions

  • encrypted transport

  • auditable tool invocations with secret redaction

  • optional container / sandbox execution

Do not treat Desktop Commander's allowedDirectories or command blocklist as a complete security boundary when terminal execution is enabled.

Upstream

Remote Link Local MCP interoperates with Desktop Commander MCP, which is MIT licensed. Remote Link is an independent project and is not affiliated with Desktop Commander.

License

MIT

Available Tools

6 tools
core_list_toolsInspect execution-core toolsA
Read-only

List tools currently exposed by the local Desktop Commander core. Useful for compatibility diagnostics.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds the 'local Desktop Commander core' scope and the diagnostic purpose, which is useful context. It does not describe output format or pagination, but for a zero-parameter listing tool this is a minor gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no wasted words. The core action is front-loaded and the purpose is stated efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only listing tool, the description is complete enough. It states what is listed and why. It could mention that the output is a list of tool names, but the tool name and description already make that obvious.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is no parameter semantics burden. The description correctly implies no inputs are needed. Baseline 4 for zero-parameter tools is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('tools currently exposed by the local Desktop Commander core'), and adds a purpose ('compatibility diagnostics'). It is clear enough to distinguish from siblings like list_directory or list_processes, though it does not explicitly name a sibling to differentiate from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it—when checking which tools the core exposes, especially for compatibility diagnostics. It does not explicitly state when not to use it or name alternatives, but the context is reasonably clear given the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_file_infoGet local file infoA
Read-only

Get metadata about a local file or directory without modifying it.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation readOnlyHint=true already indicates the tool does not modify, and the description's "without modifying it" merely restates that. The description adds no new behavioral context beyond the annotation – it does not disclose error handling, permission requirements, symlink behavior, or output format. With annotations present, this is a minimal contribution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It includes the core action, the resource scope, and the safety trait in six words, every part contributing to understanding without repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only one parameter and no output schema, and the description covers the path's scope and safety. However, it does not mention what metadata fields are returned, error conditions (e.g., file not found), or whether paths must be absolute. For a read-only metadata tool, this may be acceptable, but it leaves some gaps for an agent deciding between siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must clarify the path parameter. It adds meaningful semantics by specifying that the path refers to a "local file or directory", distinguishing it from remote paths and clarifying that both files and directories are acceptable. This compensates for the schema's lack of description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool action: "Get metadata about a local file or directory without modifying it." It uses a specific verb (Get), resource (metadata about a local file or directory), and explicitly differentiates from siblings by emphasizing "local" and "without modifying", which distinguishes it from remote_link_status, read_file, and list_directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when metadata of a local file/directory is needed) but does not explicitly mention alternatives or exclusions. It does not say "use list_directory for directory contents" or "use read_file for content", leaving the choice to inference from the word "metadata".

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_directoryList local directoryA
Read-only

List files and directories on the connected computer through the Desktop Commander execution core.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute or allowed local directory path
depthNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already covers the operation's non-destructive nature. The description adds only that the listing happens on the 'connected computer' through the 'Desktop Commander execution core', which gives environmental context but does not disclose recursion behavior, sorting, or output format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

At a single front-loaded sentence, the description is concise and minimally redundant. The phrase 'through the Desktop Commander execution core' adds environmental context without bloat, so every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and its read-only annotation covers safety, but with no output schema and no mention of recursion depth or how this differs from file-info/read siblings, the description is adequate but leaves gaps. An agent calling it correctly would need to infer depth semantics and output shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides no information about the two parameters. The schema documents 'path' as an absolute or allowed path (50% coverage), but 'depth' is left to its name and numeric constraints alone, and the description does not compensate for that gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' with the resource 'files and directories on the connected computer', making the tool's function immediately clear. This separates it from siblings like read_file (content) and get_file_info (metadata), so an agent can distinguish without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit when-to-use or when-not-to-use guidance and names no sibling alternatives. The intended use is only implied by the verb and resource, leaving an agent to infer when to choose this over read_file or get_file_info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_processesList local processesA
Read-only

List processes running on the connected computer. This does not terminate or modify processes.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation readOnlyHint=true already signals safety, and the description reinforces it by stating 'does not terminate or modify processes.' This adds explicit behavioral disclosure beyond the annotation, confirming that the tool is purely observational. No contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero wasted words. The primary action and scope are front-loaded, and the non-destructive clarification is concise. Ideal length for a simple read-only tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter, no-output-schema tool, the description fully covers what the tool does and what it does not do. An agent has everything needed to decide to call it and interpret its effect. Nothing is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters, the schema carries no meaning to supplement. The description adds no parameter details because none exist. Per the baseline rule for 0-param tools, a score of 4 is appropriate; the description is complete for its interface.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('list') and resource ('processes') with scope ('running on the connected computer'). It clearly distinguishes from sibling tools which all operate on files, directories, or links. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (whenever process listing is needed) and, by contrast with the file-oriented siblings, effectively excludes those alternatives. It doesn't explicitly say 'use this for processes, not files,' but the resource naming makes that clear. A slight gap is that it doesn't mention any conditions that would make another tool more appropriate, but none are relevant.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_fileRead local fileA
Read-only

Read a local file through the Desktop Commander execution core. Large files should be paged with offset and length.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
lengthNo
offsetNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already covers the safety profile, and the description adds a meaningful behavioral caveat: large files should be paged with offset and length, implying the tool may otherwise return very large content. This goes beyond the annotation and helps the agent avoid excessive reads.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences carry a clear purpose and an actionable usage rule. No filler or redundant restatement of the title or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool, the description covers selection and the main invocation concern (paging), but it omits return format details and the exact meaning of offset and length. Since there is no output schema, some expectation-setting would be valuable, though the tool's core use is intuitive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It mentions offset and length as paging controls but does not specify their units or exact semantics, and path is only implicitly clear from the title. This is a partial hint, not enough to unambiguously invoke the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly names the action ('Read') and resource ('a local file'), and identifies the execution core, making it clear this is a file-content-reading tool rather than a listing or metadata tool. It does not explicitly contrast with get_file_info, but the content-read semantics are clear enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides concrete guidance for large files: page with offset and length. However, it does not state when to prefer this tool over sibling tools like get_file_info or list_directory, leaving some selection context implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedcore_list_tools
    • First observedget_file_info
    • First observedlist_directory
    • First observedlist_processes
    • First observedread_file
    • First observedremote_link_status

TDQS

A4/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a distinct concern: connection status, directory listing, file reading, file metadata, process listing, and core tool enumeration. There is no meaningful overlap between any two tools.

Naming Consistency4/5

Most tools follow a verb_noun pattern (list_directory, read_file, get_file_info, list_processes). The exceptions are remote_link_status, which is noun_noun, and core_list_tools, which has a prefix before the verb; these are minor deviations.

Tool Count5/5

Six tools is a well-scoped collection for a read-only remote diagnostics and file access server. Each tool serves a clear purpose without bloat or redundancy.

Completeness5/5

For the apparent read-only diagnostic scope, the surface is complete: status, file browsing, file reading, metadata, process listing, and core tool discovery are all covered. No obvious dead ends or missing operations within this intended domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers