@remcp/remcp 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +83 -0
  3. package/THIRD_PARTY_NOTICES.md +7 -0
  4. package/bin/remcp.mjs +3 -0
  5. package/chatgpt-app-submission.json +356 -0
  6. package/package.json +63 -0
  7. package/public/android-chrome-192x192.png +0 -0
  8. package/public/android-chrome-512x512.png +0 -0
  9. package/public/app.js +95 -0
  10. package/public/apple-touch-icon.png +0 -0
  11. package/public/assets/icon-120.png +0 -0
  12. package/public/assets/icon-16.png +0 -0
  13. package/public/assets/icon-180.png +0 -0
  14. package/public/assets/icon-192.png +0 -0
  15. package/public/assets/icon-256.png +0 -0
  16. package/public/assets/icon-32.png +0 -0
  17. package/public/assets/icon-48.png +0 -0
  18. package/public/assets/icon-512.png +0 -0
  19. package/public/assets/og-remcp.png +0 -0
  20. package/public/authorize.html +70 -0
  21. package/public/docs.html +58 -0
  22. package/public/favicon-16x16.png +0 -0
  23. package/public/favicon-32x32.png +0 -0
  24. package/public/favicon-48x48.png +0 -0
  25. package/public/favicon.ico +0 -0
  26. package/public/index.html +130 -0
  27. package/public/oauth-app.js +54 -0
  28. package/public/privacy.html +61 -0
  29. package/public/remcp-darkmode-16x16.png +0 -0
  30. package/public/remcp-darkmode-192x192.png +0 -0
  31. package/public/remcp-darkmode-32x32.png +0 -0
  32. package/public/remcp-darkmode-48x48.png +0 -0
  33. package/public/remcp-darkmode-512x512.png +0 -0
  34. package/public/security.html +59 -0
  35. package/public/site.webmanifest +23 -0
  36. package/public/style.css +231 -0
  37. package/public/support.html +57 -0
  38. package/public/terms.html +62 -0
  39. package/skills/remcp-operator/SKILL.md +36 -0
  40. package/src/agent.mjs +89 -0
  41. package/src/auth.mjs +70 -0
  42. package/src/cli.mjs +90 -0
  43. package/src/config.mjs +51 -0
  44. package/src/db.mjs +99 -0
  45. package/src/mcp.mjs +90 -0
  46. package/src/oauth.mjs +145 -0
  47. package/src/relay.mjs +97 -0
  48. package/src/review-sandbox.mjs +96 -0
  49. package/src/server.mjs +158 -0
  50. package/src/tool-catalog.json +836 -0
  51. package/src/util.mjs +24 -0
package/public/authorize.html ADDED
@@ -0,0 +1,70 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8">
5
+ <meta name="viewport" content="width=device-width,initial-scale=1">
6
+ <meta name="color-scheme" content="light">
7
+ <meta name="theme-color" content="#f7f7f5">
8
+ <title>Authorize · ReMCP</title>
9
+ <meta name="description" content="Authorize an MCP client to access computers paired to your ReMCP account.">
10
+ <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
11
+ <link rel="stylesheet" href="/style.css?v=b92ac4c9219a">
12
+ <meta property="og:site_name" content="ReMCP">
13
+ <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
14
+ <link rel="icon" href="/favicon.ico" sizes="any">
15
+ <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" media="(prefers-color-scheme: light)">
16
+ <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" media="(prefers-color-scheme: light)">
17
+ <link rel="icon" type="image/png" sizes="48x48" href="/favicon-48x48.png" media="(prefers-color-scheme: light)">
18
+ <link rel="icon" type="image/png" sizes="16x16" href="/remcp-darkmode-16x16.png" media="(prefers-color-scheme: dark)">
19
+ <link rel="icon" type="image/png" sizes="32x32" href="/remcp-darkmode-32x32.png" media="(prefers-color-scheme: dark)">
20
+ <link rel="icon" type="image/png" sizes="48x48" href="/remcp-darkmode-48x48.png" media="(prefers-color-scheme: dark)">
21
+ <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
22
+ <link rel="manifest" href="/site.webmanifest">
23
+ </head>
24
+ <body>
25
+ <a class="skip-link" href="#oauth-main">Skip to authorization</a>
26
+ <header class="site-header">
27
+ <a class="wordmark" href="/" aria-label="ReMCP home">
28
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
29
+ <span translate="no">ReMCP</span>
30
+ </a>
31
+ <nav aria-label="Primary"><a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a></nav>
32
+ </header>
33
+ <main id="oauth-main" class="oauth-shell">
34
+ <section class="oauth-card">
35
+ <div id="oauth-login">
36
+ <p class="eyebrow">Secure authorization</p>
37
+ <h2 id="oauth-title">Sign in to ReMCP</h2>
38
+ <p class="muted">Verify your account before reviewing this MCP client’s access request.</p>
39
+ <button id="google" class="button google-button" type="button">
40
+ <svg class="google-icon" viewBox="0 0 18 18" aria-hidden="true" focusable="false">
41
+ <path fill="#4285F4" d="M17.64 9.205c0-.638-.057-1.252-.164-1.841H9v3.481h4.844a4.14 4.14 0 0 1-1.796 2.715v2.259h2.909c1.702-1.567 2.683-3.874 2.683-6.614Z"/>
42
+ <path fill="#34A853" d="M9 18c2.43 0 4.468-.806 5.957-2.181l-2.909-2.259c-.806.54-1.835.859-3.048.859-2.344 0-4.328-1.585-5.037-3.714H.956v2.332A9 9 0 0 0 9 18Z"/>
43
+ <path fill="#FBBC05" d="M3.963 10.705A5.41 5.41 0 0 1 3.682 9c0-.592.102-1.168.281-1.705V4.963H.956A9 9 0 0 0 0 9c0 1.452.347 2.827.956 4.037l3.007-2.332Z"/>
44
+ <path fill="#EA4335" d="M9 3.581c1.321 0 2.507.454 3.441 1.346l2.581-2.581C13.464.892 11.426 0 9 0A9 9 0 0 0 .956 4.963l3.007 2.332C4.672 5.166 6.656 3.581 9 3.581Z"/>
45
+ </svg>
46
+ <span>Continue with Google</span>
47
+ </button>
48
+ <div class="divider"><span>or use email</span></div>
49
+ <label for="email">Email</label>
50
+ <input id="email" name="email" type="email" autocomplete="email" inputmode="email" autocapitalize="none" spellcheck="false">
51
+ <label for="password">Password</label>
52
+ <input id="password" name="password" type="password" autocomplete="current-password">
53
+ <div class="button-row"><button id="email-login" class="button secondary" type="button">Sign In</button><button id="email-register" class="button ghost" type="button">Create Account</button></div>
54
+ </div>
55
+ <div id="oauth-consent" class="hidden">
56
+ <p class="eyebrow">Access request</p>
57
+ <h2>Authorize ReMCP Access</h2>
58
+ <p class="muted">This MCP client is requesting access to operate computers paired to this ReMCP account.</p>
59
+ <ul class="scope-list"><li><span>Control paired devices</span><strong>remcp:control</strong></li><li><span>Maintain the authorized connection</span><strong>offline_access</strong></li></ul>
60
+ <p class="oauth-meta">Client: <span id="client-id"></span></p>
61
+ <div class="oauth-actions"><button id="authorize" class="button" type="button">Authorize ReMCP Access</button><a class="button ghost" href="/">Not Now</a></div>
62
+ </div>
63
+ <p id="status" class="muted" aria-live="polite"></p>
64
+ <p id="error" class="error" role="alert" aria-live="assertive"></p>
65
+ <p class="footer-mini"><a href="/privacy">Privacy</a> · <a href="/terms">Terms</a> · <a href="/security">Security</a></p>
66
+ </section>
67
+ </main>
68
+ <script type="module" src="/oauth-app.js?v=36155fefb47e"></script>
69
+ </body>
70
+ </html>
package/public/docs.html ADDED
@@ -0,0 +1,58 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8">
5
+ <meta name="viewport" content="width=device-width,initial-scale=1">
6
+ <meta name="color-scheme" content="light">
7
+ <meta name="theme-color" content="#f7f7f5">
8
+ <title>Docs · ReMCP</title>
9
+ <meta name="description" content="Connect a computer to ReMCP and configure the hosted MCP endpoint.">
10
+ <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
11
+ <link rel="stylesheet" href="/style.css?v=b92ac4c9219a">
12
+ <meta property="og:site_name" content="ReMCP">
13
+ <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
14
+ <link rel="icon" href="/favicon.ico" sizes="any">
15
+ <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" media="(prefers-color-scheme: light)">
16
+ <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" media="(prefers-color-scheme: light)">
17
+ <link rel="icon" type="image/png" sizes="48x48" href="/favicon-48x48.png" media="(prefers-color-scheme: light)">
18
+ <link rel="icon" type="image/png" sizes="16x16" href="/remcp-darkmode-16x16.png" media="(prefers-color-scheme: dark)">
19
+ <link rel="icon" type="image/png" sizes="32x32" href="/remcp-darkmode-32x32.png" media="(prefers-color-scheme: dark)">
20
+ <link rel="icon" type="image/png" sizes="48x48" href="/remcp-darkmode-48x48.png" media="(prefers-color-scheme: dark)">
21
+ <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
22
+ <link rel="manifest" href="/site.webmanifest">
23
+ </head>
24
+ <body>
25
+ <a class="skip-link" href="#main">Skip to content</a>
26
+ <header class="site-header">
27
+ <a class="wordmark" href="/" aria-label="ReMCP home">
28
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
29
+ <span translate="no">ReMCP</span>
30
+ </a>
31
+ <nav aria-label="Primary"><a href="/docs" aria-current="page">Docs</a><a href="/security">Security</a><a href="/support">Support</a></nav>
32
+ </header>
33
+ <main id="main" class="doc-shell">
34
+ <aside class="doc-nav" aria-label="Documentation"><a href="/docs" aria-current="page">Setup</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a></aside>
35
+ <article class="prose">
36
+ <p class="eyebrow">Documentation</p>
37
+ <h1>Connect a computer to ReMCP.</h1>
38
+ <p>ReMCP is a remote MCP relay. The hosted server authenticates the MCP client and routes each tool call to a paired local agent.</p>
39
+ <h2>1. Sign in</h2><p>Open <a href="/">the ReMCP workspace</a> and authenticate. Generate a one-time pairing command from the device section.</p>
40
+ <h2>2. Pair the computer</h2><pre><code>npx @remcp/remcp connect --server https://remcp.delio24.com --code YOUR_CODE --install</code></pre><p>The code is exchanged for a device-specific credential that can later be revoked.</p>
41
+ <h2>3. Add the MCP server</h2><pre><code>https://remcp.delio24.com/mcp</code></pre><p>Choose OAuth when your MCP client asks for authentication. ReMCP uses authorization code flow with PKCE and refresh tokens.</p>
42
+ <h2>Connection model</h2><p>The device agent creates an outbound secure WebSocket connection to the relay. You do not need to expose a listener on the computer.</p>
43
+ <div class="notice"><strong>Review mutating actions.</strong><p>Some tools can write files or run processes. Review the action requested by your MCP client before approving it.</p></div>
44
+ <h2>Self-hosting</h2><p>The central ReMCP service runs in Docker with persistent account, device and OAuth metadata. Device agents run natively so host access does not require a privileged container.</p>
45
+ </article>
46
+ </main>
47
+ <footer class="site-footer">
48
+ <div class="wordmark">
49
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
50
+ <span translate="no">ReMCP</span>
51
+ </div>
52
+ <nav aria-label="Footer">
53
+ <a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a>
54
+ </nav>
55
+ <p>Open-source remote MCP infrastructure.</p>
56
+ </footer>
57
+ </body>
58
+ </html>
package/public/favicon-16x16.png ADDED
Binary file
package/public/favicon-32x32.png ADDED
Binary file
package/public/favicon-48x48.png ADDED
Binary file
package/public/favicon.ico ADDED
Binary file
package/public/index.html ADDED
@@ -0,0 +1,130 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8">
5
+ <meta name="viewport" content="width=device-width,initial-scale=1">
6
+ <meta name="color-scheme" content="light">
7
+ <meta name="theme-color" content="#f7f7f5">
8
+ <title>ReMCP — Your computers over MCP</title>
9
+ <meta name="description" content="Securely pair your own computers and use their files, terminal and processes through authenticated MCP clients.">
10
+ <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
11
+ <link rel="stylesheet" href="/style.css?v=b92ac4c9219a">
12
+ <meta property="og:site_name" content="ReMCP">
13
+ <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
14
+ <link rel="icon" href="/favicon.ico" sizes="any">
15
+ <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" media="(prefers-color-scheme: light)">
16
+ <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" media="(prefers-color-scheme: light)">
17
+ <link rel="icon" type="image/png" sizes="48x48" href="/favicon-48x48.png" media="(prefers-color-scheme: light)">
18
+ <link rel="icon" type="image/png" sizes="16x16" href="/remcp-darkmode-16x16.png" media="(prefers-color-scheme: dark)">
19
+ <link rel="icon" type="image/png" sizes="32x32" href="/remcp-darkmode-32x32.png" media="(prefers-color-scheme: dark)">
20
+ <link rel="icon" type="image/png" sizes="48x48" href="/remcp-darkmode-48x48.png" media="(prefers-color-scheme: dark)">
21
+ <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
22
+ <link rel="manifest" href="/site.webmanifest">
23
+ </head>
24
+ <body>
25
+ <a class="skip-link" href="#main">Skip to content</a>
26
+ <header class="site-header">
27
+ <a class="wordmark" href="/" aria-label="ReMCP home">
28
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
29
+ <span translate="no">ReMCP</span>
30
+ </a>
31
+ <nav aria-label="Primary"><a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a></nav>
32
+ </header>
33
+ <main id="main">
34
+ <section class="hero">
35
+ <div class="hero-copy">
36
+ <p class="eyebrow">Remote MCP, without exposed device ports</p>
37
+ <h1>Your computers.<br>Available to MCP.</h1>
38
+ <p class="lede">Pair a device once. ReMCP routes authenticated tool calls to its local agent while the device keeps an outbound-only connection.</p>
39
+ <div class="hero-actions">
40
+ <a class="button" href="#connect">Connect a Device</a>
41
+ <a class="text-link" href="/docs">Read Setup Guide <span aria-hidden="true">→</span></a>
42
+ </div>
43
+ </div>
44
+ <div class="hero-visual" role="img" aria-label="ReMCP connection diagram">
45
+ <div class="node client"><span>ChatGPT / MCP client</span><b>OAuth 2.1</b></div>
46
+ <div class="rail" aria-hidden="true"><span></span><i>encrypted</i></div>
47
+ <div class="node relay"><span>ReMCP relay</span><b translate="no">remcp.delio24.com</b></div>
48
+ <div class="rail" aria-hidden="true"><span></span><i>outbound</i></div>
49
+ <div class="node device-node"><span>Your device</span><b>local agent</b><em class="pulse">online</em></div>
50
+ </div>
51
+ </section>
52
+
53
+ <section class="principles" aria-label="Product principles">
54
+ <div><span>01</span><h2>Private by default</h2><p>Accounts and devices are isolated by authenticated user identity and revocable device credentials.</p></div>
55
+ <div><span>02</span><h2>No inbound laptop port</h2><p>The device agent connects outward to ReMCP. Your laptop does not need a public IP or open listener.</p></div>
56
+ <div><span>03</span><h2>Explicit control</h2><p>Read, write and destructive tools declare their behavior so MCP clients can apply the right review flow.</p></div>
57
+ </section>
58
+
59
+ <section id="connect" class="workspace">
60
+ <div class="section-heading">
61
+ <p class="eyebrow">Workspace</p>
62
+ <h2>Pair and manage devices</h2>
63
+ <p>Sign in to generate one-time pairing commands and revoke computers you no longer trust.</p>
64
+ </div>
65
+ <div class="workspace-grid">
66
+ <section class="auth-pane" aria-labelledby="account-title">
67
+ <h3 id="account-title">Account</h3>
68
+ <div id="signed-out" class="stack">
69
+ <p class="muted">Sign in to access your ReMCP device workspace.</p>
70
+ <button id="google" class="button google-button" type="button">
71
+ <svg class="google-icon" viewBox="0 0 18 18" aria-hidden="true" focusable="false">
72
+ <path fill="#4285F4" d="M17.64 9.205c0-.638-.057-1.252-.164-1.841H9v3.481h4.844a4.14 4.14 0 0 1-1.796 2.715v2.259h2.909c1.702-1.567 2.683-3.874 2.683-6.614Z"/>
73
+ <path fill="#34A853" d="M9 18c2.43 0 4.468-.806 5.957-2.181l-2.909-2.259c-.806.54-1.835.859-3.048.859-2.344 0-4.328-1.585-5.037-3.714H.956v2.332A9 9 0 0 0 9 18Z"/>
74
+ <path fill="#FBBC05" d="M3.963 10.705A5.41 5.41 0 0 1 3.682 9c0-.592.102-1.168.281-1.705V4.963H.956A9 9 0 0 0 0 9c0 1.452.347 2.827.956 4.037l3.007-2.332Z"/>
75
+ <path fill="#EA4335" d="M9 3.581c1.321 0 2.507.454 3.441 1.346l2.581-2.581C13.464.892 11.426 0 9 0A9 9 0 0 0 .956 4.963l3.007 2.332C4.672 5.166 6.656 3.581 9 3.581Z"/>
76
+ </svg>
77
+ <span>Continue with Google</span>
78
+ </button>
79
+ <div class="divider"><span>or use email</span></div>
80
+ <label for="email">Email</label>
81
+ <input id="email" name="email" type="email" autocomplete="email" inputmode="email" autocapitalize="none" spellcheck="false">
82
+ <label for="password">Password</label>
83
+ <input id="password" name="password" type="password" autocomplete="current-password">
84
+ <div class="button-row">
85
+ <button id="email-login" class="button secondary" type="button">Sign In</button>
86
+ <button id="email-register" class="button ghost" type="button">Create Account</button>
87
+ </div>
88
+ <p id="auth-error" class="error" role="alert" aria-live="polite"></p>
89
+ </div>
90
+ <div id="signed-in" class="hidden stack">
91
+ <div class="identity"><span class="status-dot" aria-hidden="true"></span><div><strong id="user-label"></strong><small>Authenticated</small></div></div>
92
+ <button id="logout" class="button ghost" type="button">Sign Out</button>
93
+ </div>
94
+ </section>
95
+ <section class="endpoint-pane" aria-labelledby="endpoint-title">
96
+ <div><h3 id="endpoint-title">MCP endpoint</h3><p class="muted">Use this HTTPS endpoint when adding ReMCP to an MCP client.</p></div>
97
+ <div class="command-row"><code id="mcp-url">https://remcp.delio24.com/mcp</code><button class="copy-button" type="button" data-copy="#mcp-url" aria-label="Copy MCP endpoint">Copy</button></div>
98
+ <dl class="endpoint-facts"><div><dt>Transport</dt><dd>Streamable HTTP</dd></div><div><dt>Authentication</dt><dd>OAuth 2.1 + PKCE</dd></div></dl>
99
+ </section>
100
+ </div>
101
+ <section id="dashboard" class="hidden device-workspace" aria-label="Device management">
102
+ <div class="pair-panel">
103
+ <div><p class="eyebrow">Add a computer</p><h3>Generate a one-time pairing command</h3><p class="muted">The code expires automatically and can only be claimed once.</p></div>
104
+ <button id="pair" class="button" type="button">Generate Command</button>
105
+ <div id="pairing" class="hidden pairing-output"><code id="pair-command"></code><button class="copy-button" type="button" data-copy="#pair-command">Copy</button><p id="pair-expiry" class="muted"></p></div>
106
+ </div>
107
+ <div class="devices-panel"><div class="panel-title"><h3>Paired devices</h3><span class="muted">Online state updates when the page refreshes.</span></div><div id="devices" class="device-list" aria-live="polite">No devices yet.</div></div>
108
+ </section>
109
+ </section>
110
+
111
+ <section class="final-cta">
112
+ <p class="eyebrow">Self-hostable architecture</p>
113
+ <h2>Keep the relay yours.</h2>
114
+ <p>ReMCP can run as a small Docker service while each computer runs its own local agent.</p>
115
+ <a class="text-link" href="/security">Review the Security Model <span aria-hidden="true">→</span></a>
116
+ </section>
117
+ </main>
118
+ <footer class="site-footer">
119
+ <div class="wordmark">
120
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
121
+ <span translate="no">ReMCP</span>
122
+ </div>
123
+ <nav aria-label="Footer">
124
+ <a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a>
125
+ </nav>
126
+ <p>Open-source remote MCP infrastructure.</p>
127
+ </footer>
128
+ <script type="module" src="/app.js?v=14a728f07dd1"></script>
129
+ </body>
130
+ </html>
package/public/oauth-app.js ADDED
@@ -0,0 +1,54 @@
1
+ import { initializeApp } from 'https://www.gstatic.com/firebasejs/10.14.1/firebase-app.js';
2
+ import { getAuth, GoogleAuthProvider, onAuthStateChanged, signInWithPopup, signInWithEmailAndPassword, createUserWithEmailAndPassword } from 'https://www.gstatic.com/firebasejs/10.14.1/firebase-auth.js';
3
+
4
+ const cfg = await fetch(`/api/config?fresh=${Date.now()}`, { cache: 'no-store' }).then(r => r.json());
5
+ const auth = getAuth(initializeApp(cfg.firebase));
6
+ const query = new URLSearchParams(location.search);
7
+ const $ = selector => document.querySelector(selector);
8
+ const showError = error => { $('#error').textContent = error?.message || String(error); };
9
+ let currentUser = null;
10
+ let completing = false;
11
+ const googleProvider = new GoogleAuthProvider();
12
+
13
+ $('#client-id').textContent = query.get('client_id') || 'MCP client';
14
+ $('#google').onclick = async () => {
15
+ const button = $('#google');
16
+ const label = button.querySelector('span');
17
+ button.disabled = true;
18
+ $('#error').textContent = '';
19
+ label.textContent = 'Opening Google…';
20
+ try { await signInWithPopup(auth, googleProvider); }
21
+ catch (error) { showError(error); }
22
+ finally { button.disabled = false; label.textContent = 'Continue with Google'; }
23
+ };
24
+ $('#email-login').onclick = () => signInWithEmailAndPassword(auth, $('#email').value, $('#password').value).catch(showError);
25
+ $('#email-register').onclick = () => createUserWithEmailAndPassword(auth, $('#email').value, $('#password').value).catch(showError);
26
+
27
+ onAuthStateChanged(auth, user => {
28
+ currentUser = user;
29
+ $('#oauth-login').classList.toggle('hidden', Boolean(user));
30
+ $('#oauth-consent').classList.toggle('hidden', !user);
31
+ $('#status').textContent = user ? `Signed in as ${user.email || 'ReMCP user'}. Review access before continuing.` : '';
32
+ });
33
+ $('#authorize').onclick = async () => {
34
+ if (!currentUser || completing) return;
35
+ completing = true;
36
+ $('#authorize').disabled = true;
37
+ $('#status').textContent = 'Authorizing…';
38
+ $('#error').textContent = '';
39
+ try {
40
+ const body = { id_token: await currentUser.getIdToken() };
41
+ for (const key of ['client_id','redirect_uri','response_type','code_challenge','code_challenge_method','scope','state','resource']) {
42
+ if (query.has(key)) body[key] = query.get(key);
43
+ }
44
+ const response = await fetch('/oauth/authorize/complete', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
45
+ const data = await response.json();
46
+ if (!response.ok) throw new Error(data.error_description || data.error || 'Authorization failed');
47
+ location.assign(data.redirect_to);
48
+ } catch (error) {
49
+ completing = false;
50
+ $('#authorize').disabled = false;
51
+ $('#status').textContent = '';
52
+ showError(error);
53
+ }
54
+ };
package/public/privacy.html ADDED
@@ -0,0 +1,61 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8">
5
+ <meta name="viewport" content="width=device-width,initial-scale=1">
6
+ <meta name="color-scheme" content="light">
7
+ <meta name="theme-color" content="#f7f7f5">
8
+ <title>Privacy Policy · ReMCP</title>
9
+ <meta name="description" content="How ReMCP processes account, device, OAuth and remote-computer data.">
10
+ <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
11
+ <link rel="stylesheet" href="/style.css?v=b92ac4c9219a">
12
+ <meta property="og:site_name" content="ReMCP">
13
+ <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
14
+ <link rel="icon" href="/favicon.ico" sizes="any">
15
+ <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" media="(prefers-color-scheme: light)">
16
+ <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" media="(prefers-color-scheme: light)">
17
+ <link rel="icon" type="image/png" sizes="48x48" href="/favicon-48x48.png" media="(prefers-color-scheme: light)">
18
+ <link rel="icon" type="image/png" sizes="16x16" href="/remcp-darkmode-16x16.png" media="(prefers-color-scheme: dark)">
19
+ <link rel="icon" type="image/png" sizes="32x32" href="/remcp-darkmode-32x32.png" media="(prefers-color-scheme: dark)">
20
+ <link rel="icon" type="image/png" sizes="48x48" href="/remcp-darkmode-48x48.png" media="(prefers-color-scheme: dark)">
21
+ <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
22
+ <link rel="manifest" href="/site.webmanifest">
23
+ </head>
24
+ <body>
25
+ <a class="skip-link" href="#main">Skip to content</a>
26
+ <header class="site-header">
27
+ <a class="wordmark" href="/" aria-label="ReMCP home">
28
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
29
+ <span translate="no">ReMCP</span>
30
+ </a>
31
+ <nav aria-label="Primary"><a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a></nav>
32
+ </header>
33
+ <main id="main" class="doc-shell">
34
+ <aside class="doc-nav" aria-label="Legal and policy navigation"><a href="/docs">Setup</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a></aside>
35
+ <article class="prose">
36
+ <p class="eyebrow">Privacy</p>
37
+ <h1>Privacy Policy</h1>
38
+ <p><strong>Effective September 16, 2026.</strong> This policy describes the hosted ReMCP service at remcp.delio24.com. A self-hosted deployment is operated by its own administrator and may have different practices.</p>
39
+ <h2>What ReMCP does</h2><p>ReMCP authenticates an MCP client, identifies computers you have paired, and relays authorized tool calls between that client and the selected computer. Device agents connect outbound to the ReMCP service.</p>
40
+ <h2>Account and Google Sign-In data</h2><p>Authentication is provided by Firebase Authentication. If you choose Google Sign-In, Firebase may provide ReMCP with your Firebase user identifier, email address and display name. ReMCP uses this information only to authenticate you, keep your devices separated from other accounts, and administer your ReMCP account. ReMCP does not request Gmail, Google Drive, Google Calendar or other Google API data.</p>
41
+ <h2>Device and security metadata</h2><p>ReMCP stores device identifiers, device names and basic platform metadata, one-way hashes of device credentials, pairing records, OAuth client metadata, and one-way hashes of refresh credentials. Pairing codes are short-lived and single-use. Raw device credentials are returned to the paired device and are not stored in plaintext by the service.</p>
42
+ <h2>Files, commands and tool results</h2><p>When you use an MCP tool, its request and response may pass through the ReMCP relay. This can include filenames, file contents, command output and process information that you explicitly ask the paired computer to process. ReMCP does not intentionally retain those tool payloads as product data. Operational security logs may retain limited metadata such as timestamps, status codes and errors.</p>
43
+ <h2>How data is used and shared</h2><p>Data is used to provide authentication, device pairing, OAuth authorization, request routing, abuse prevention, security and reliability. ReMCP does not sell personal information and does not serve advertising. Data may be processed by infrastructure and authentication providers only as needed to operate the service, including Firebase/Google for authentication.</p>
44
+ <h2>Retention and control</h2><p>Device records remain until revoked or removed. OAuth grants remain until revoked, expired or rotated. Security and operational metadata may be retained for a limited period appropriate to troubleshooting and abuse prevention. You can revoke a paired device from the ReMCP workspace. Requests concerning account data or deletion can be made through the support channel identified on the Support page or in the app listing.</p>
45
+ <h2>Security and international processing</h2><p>ReMCP uses TLS for network transport, hashes reusable credentials before storage, and scopes device access to the authenticated account. Internet services may process data in more than one country depending on infrastructure and authentication providers. See the <a href="/security">Security page</a> for the current security model.</p>
46
+ <h2>Children</h2><p>ReMCP is a developer and systems-administration tool and is not directed to children under 13.</p>
47
+ <h2>Changes</h2><p>Material changes to this policy will be published at this URL with an updated effective date.</p>
48
+ </article>
49
+ </main>
50
+ <footer class="site-footer">
51
+ <div class="wordmark">
52
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
53
+ <span translate="no">ReMCP</span>
54
+ </div>
55
+ <nav aria-label="Footer">
56
+ <a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a>
57
+ </nav>
58
+ <p>Open-source remote MCP infrastructure.</p>
59
+ </footer>
60
+ </body>
61
+ </html>
package/public/remcp-darkmode-16x16.png ADDED
Binary file
package/public/remcp-darkmode-32x32.png ADDED
Binary file
package/public/remcp-darkmode-48x48.png ADDED
Binary file
package/public/security.html ADDED
@@ -0,0 +1,59 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8">
5
+ <meta name="viewport" content="width=device-width,initial-scale=1">
6
+ <meta name="color-scheme" content="light">
7
+ <meta name="theme-color" content="#f7f7f5">
8
+ <title>Security · ReMCP</title>
9
+ <meta name="description" content="How ReMCP isolates accounts, devices, credentials and remote MCP tool access.">
10
+ <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
11
+ <link rel="stylesheet" href="/style.css?v=b92ac4c9219a">
12
+ <meta property="og:site_name" content="ReMCP">
13
+ <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
14
+ <link rel="icon" href="/favicon.ico" sizes="any">
15
+ <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" media="(prefers-color-scheme: light)">
16
+ <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" media="(prefers-color-scheme: light)">
17
+ <link rel="icon" type="image/png" sizes="48x48" href="/favicon-48x48.png" media="(prefers-color-scheme: light)">
18
+ <link rel="icon" type="image/png" sizes="16x16" href="/remcp-darkmode-16x16.png" media="(prefers-color-scheme: dark)">
19
+ <link rel="icon" type="image/png" sizes="32x32" href="/remcp-darkmode-32x32.png" media="(prefers-color-scheme: dark)">
20
+ <link rel="icon" type="image/png" sizes="48x48" href="/remcp-darkmode-48x48.png" media="(prefers-color-scheme: dark)">
21
+ <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
22
+ <link rel="manifest" href="/site.webmanifest">
23
+ </head>
24
+ <body>
25
+ <a class="skip-link" href="#main">Skip to content</a>
26
+ <header class="site-header">
27
+ <a class="wordmark" href="/" aria-label="ReMCP home">
28
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
29
+ <span translate="no">ReMCP</span>
30
+ </a>
31
+ <nav aria-label="Primary"><a href="/docs">Docs</a><a href="/security" aria-current="page">Security</a><a href="/support">Support</a></nav>
32
+ </header>
33
+ <main id="main" class="doc-shell">
34
+ <aside class="doc-nav" aria-label="Documentation"><a href="/docs">Setup</a><a href="/security" aria-current="page">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a></aside>
35
+ <article class="prose">
36
+ <p class="eyebrow">Security</p>
37
+ <h1>A narrow relay between the model and your machine.</h1>
38
+ <p>ReMCP treats remote computer control as privileged access. Authentication, device isolation and explicit tool behavior are part of the core design.</p>
39
+ <h2>Identity and tenancy</h2><p>User authentication is handled with Firebase Authentication. MCP sessions and paired device records are scoped to the same authenticated user identity.</p>
40
+ <h2>Device credentials</h2><p>Pairing codes are short-lived and one-time. Each paired computer receives an independent random credential. Server storage keeps a one-way hash of that credential.</p>
41
+ <h2>Network model</h2><p>The local agent opens an outbound secure WebSocket connection to the relay. No inbound port needs to be opened on the laptop or workstation.</p>
42
+ <h2>Tool risk</h2><p>Tool descriptors explicitly declare read-only, destructive and open-world hints. Terminal execution can change local or external state depending on the command supplied.</p>
43
+ <h2>Revocation</h2><p>Revoke a device from the signed-in workspace if a computer is lost, retired, or no longer trusted. Revoked credentials cannot reconnect.</p>
44
+ <h2>Transport</h2><p>Production traffic uses HTTPS/WSS. OAuth uses PKCE S256. Tokens and device credentials are not placed in public source or page markup.</p>
45
+ <div class="notice"><strong>Operator trust.</strong><p>If you use a third-party ReMCP deployment, that deployment operator controls the relay infrastructure. For highest control, run your own deployment.</p></div>
46
+ </article>
47
+ </main>
48
+ <footer class="site-footer">
49
+ <div class="wordmark">
50
+ <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
51
+ <span translate="no">ReMCP</span>
52
+ </div>
53
+ <nav aria-label="Footer">
54
+ <a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a>
55
+ </nav>
56
+ <p>Open-source remote MCP infrastructure.</p>
57
+ </footer>
58
+ </body>
59
+ </html>
package/public/site.webmanifest ADDED
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "ReMCP",
3
+ "short_name": "ReMCP",
4
+ "description": "Secure remote MCP access to computers you pair.",
5
+ "start_url": "/",
6
+ "display": "standalone",
7
+ "background_color": "#f7f6f2",
8
+ "theme_color": "#111114",
9
+ "icons": [
10
+ {
11
+ "src": "/android-chrome-192x192.png",
12
+ "sizes": "192x192",
13
+ "type": "image/png",
14
+ "purpose": "any"
15
+ },
16
+ {
17
+ "src": "/android-chrome-512x512.png",
18
+ "sizes": "512x512",
19
+ "type": "image/png",
20
+ "purpose": "any"
21
+ }
22
+ ]
23
+ }