@remcp/remcp 0.1.1 → 0.1.2

package/README.md

@@ -1,90 +1,118 @@
 # ReMCP
 
-ReMCP is an open-source remote MCP bridge for computers you control. A local agent connects outbound to a ReMCP server and exposes filesystem, search, terminal and process tools through one authenticated remote MCP endpoint.
+ReMCP is an open-source remote MCP bridge for computers you control. A lightweight device agent connects **outbound** to a ReMCP relay, so ChatGPT, Codex, or another MCP client can work with local files, directories, searches, terminal sessions, and processes without exposing an inbound port on the computer.
 
-**Hosted service:** https://remcp.delio24.com
-**MCP endpoint:** `https://remcp.delio24.com/mcp`
+- Hosted service: <https://remcp.delio24.com>
+- MCP endpoint: `https://remcp.delio24.com/mcp`
+- npm: `@remcp/remcp`
+- License: MIT
 
-## How it works
+## Quick start
 
-```text
-ChatGPT / MCP client ── OAuth + HTTPS ──> ReMCP server
-                                           │
-                                           ├── WSS ──> laptop agent ──> local MCP
-                                           └── WSS ──> server agent ──> local MCP
-```
-
-The central service stores account/device metadata, hashed reusable credentials and OAuth state. Actual filesystem and process access stays on the paired computer.
+Requires Node.js 22.5 or newer.
 
-## Install and pair
-
-Requires Node.js 22.5 or newer. Generate a one-time pairing code after signing in at https://remcp.delio24.com, then run:
+1. Sign in at <https://remcp.delio24.com> and generate a one-time pairing command.
+2. Run it on the computer you want to connect:
 
 ```bash
-npx --yes @remcp/remcp@latest connect --server https://remcp.delio24.com --code YOUR_PAIRING_CODE --install
+npx --yes @remcp/remcp@latest connect \
+  --server https://remcp.delio24.com \
+  --code YOUR_PAIRING_CODE \
+  --install
 ```
 
-`--install` creates a persistent global `remcp` CLI and Linux user service. The initial `npx` execution is only the bootstrap step.
-
-Verify:
+3. Verify the persistent agent:
 
 ```bash
 remcp --version
 remcp status
 ```
 
+4. Add the MCP endpoint to your client:
+
+```text
+https://remcp.delio24.com/mcp
+```
+
+Authentication uses OAuth authorization code + PKCE with rotating refresh credentials.
+
 ## Update
 
 ```bash
 remcp update
 ```
 
-This updates the global CLI to the latest published release, refreshes the compatible local runtime, and restarts the installed user service.
+`remcp update` refreshes the global CLI and compatible local runtime, then restarts the installed user service.
 
 ## CLI
 
 ```text
 remcp start             Run the device agent in the foreground
-remcp status            Check pairing, version and server health
+remcp status            Show version, pairing and server health
 remcp doctor            Alias for status
-remcp update            Update ReMCP and restart the installed service
+remcp update            Update ReMCP and restart the user service
 remcp install           Install or repair the user service
 remcp uninstall         Remove the user service
 remcp uninstall --purge Remove the service and global ReMCP packages
 remcp --version         Print the installed CLI version
 ```
 
-## Self-host the server
+## Architecture
 
-```bash
-git clone https://github.com/antonbaider/remcp.git
-cd remcp
-cp .env.example .env
-# Fill in your public URL and Firebase Web App configuration.
-docker compose up -d --build
+```text
+ChatGPT / Codex / MCP client
+           │
+           │ OAuth 2.1 + HTTPS
+           ▼
+     ReMCP relay /mcp
+           │
+           │ authenticated WSS (outbound from device)
+           ▼
+      paired computer
+           │
+           └── local file / search / terminal / process runtime
 ```
 
-Put a TLS reverse proxy in front of ReMCP and proxy WebSocket upgrades for `/agent`. The example Compose file binds the application to localhost by default. Do not publish the internal application port directly unless you have deliberately secured it.
+The hosted relay stores account/device metadata, one-way hashes of reusable credentials, OAuth client metadata, and refresh-token hashes. Device credentials are independently revocable. MCP sessions are scoped to the authenticated ReMCP account.
+
+## OpenAI Plugin package
 
-ReMCP does **not** require a Firebase Admin service-account private key. Firebase ID tokens are verified using Google's public signing keys.
+The repository is prepared for the current OpenAI Plugins format:
 
-## ChatGPT / remote MCP
+- `plugin.json` — portable Agent Plugins manifest;
+- `mcp.json` — production Streamable HTTP MCP configuration;
+- `skills/remcp-operator/SKILL.md` — bundled operator skill;
+- `assets/remcp-icon.png` — plugin icon;
+- `docs/OPENAI_PLUGIN.md` — submission and reviewer checklist;
+- `submission/openai-plugin-review.json` — generated tool annotations plus five positive and three negative review cases.
 
-ReMCP exposes Streamable HTTP MCP at `/mcp`. Authentication uses authorization code + PKCE, Dynamic Client Registration, short-lived access tokens and rotating refresh tokens.
+ReMCP has no plugin UI, so the public submission should not include UI screenshots. The remote MCP server uses a universal production URL and OAuth. See [`docs/OPENAI_PLUGIN.md`](docs/OPENAI_PLUGIN.md) before submitting.
 
-The repository includes `chatgpt-app-submission.json` plus a reusable ReMCP operator skill for submission/testing workflows.
 ## Security model
 
-- one independent credential per paired device;
-- device and refresh credentials are stored as one-way hashes server-side;
+- no inbound port is required on paired computers;
+- one revocable credential is issued per paired device;
+- reusable credentials are hashed server-side;
 - pairing codes are short-lived and single-use;
-- MCP sessions are bound to the authenticated account;
-- the device agent connects outbound over WSS;
-- write/process tools expose explicit MCP risk annotations;
-- the public review sandbox is isolated per authenticated user and intentionally limits terminal commands;
-- central Docker deployment runs read-only with dropped Linux capabilities in the supplied Compose configuration.
+- OAuth uses PKCE and rotating refresh credentials;
+- OAuth metadata advertises `openid` and `email`, with a UserInfo endpoint for verified-email workspace restrictions;
+- MCP tools carry explicit `readOnlyHint`, `openWorldHint`, and `destructiveHint` annotations;
+- the public review fixture is isolated per authenticated account and intentionally restricts terminal commands;
+- the supplied server container runs read-only with dropped Linux capabilities.
 
-See https://remcp.delio24.com/security for the hosted-service security overview.
+ReMCP tools should not be used to request or process passwords, MFA codes, API/private keys, payment-card data, protected health information, or government identifiers. See [`SECURITY.md`](SECURITY.md) and the hosted <https://remcp.delio24.com/security> page.
+
+## Self-hosting
+
+```bash
+git clone https://github.com/antonbaider/remcp.git
+cd remcp
+cp .env.example .env
+# Fill in your public URL and Firebase Web App configuration.
+docker compose up -d --build
+```
+
+Put a TLS reverse proxy in front of ReMCP and proxy WebSocket upgrades for `/agent`. The supplied Compose configuration binds the application to localhost by default. ReMCP verifies Firebase ID tokens using Google's public signing keys and does not require a Firebase Admin private key.
 
 ## Development
 
@@ -93,8 +121,25 @@ npm ci
 npm run check
 npm test
 npm audit --omit=dev
+npm pack --dry-run
+```
+
+For server changes:
+
+```bash
+docker build -t remcp:test .
 ```
 
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for contribution and security rules.
+
+## Project docs
+
+- [`docs/OPENAI_PLUGIN.md`](docs/OPENAI_PLUGIN.md) — OpenAI Plugins submission
+- [`SECURITY.md`](SECURITY.md) — vulnerability reporting and operational security
+- [`CONTRIBUTING.md`](CONTRIBUTING.md) — development checks
+- [`CHANGELOG.md`](CHANGELOG.md) — release notes
+- [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) — third-party license notices
+
 ## License
 
-ReMCP is MIT licensed. Third-party notices for the local device runtime are preserved in `THIRD_PARTY_NOTICES.md`. ReMCP is self-hostable and does not depend on a proprietary hosted relay.
+ReMCP is MIT licensed. Third-party notices for the local device runtime are preserved in `THIRD_PARTY_NOTICES.md`.

package/mcp.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "remcp": {
+      "type": "streamable-http",
+      "url": "https://remcp.delio24.com/mcp"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Self-hosted remote MCP bridge for securely controlling your own computers from MCP clients.",
   "type": "module",
   "license": "MIT",
@@ -15,8 +15,10 @@
     "bin",
     "src",
     "public",
+    "plugin.json",
+    "mcp.json",
+    "assets",
     "skills/remcp-operator",
-    "chatgpt-app-submission.json",
     "LICENSE",
     "THIRD_PARTY_NOTICES.md",
     "README.md"

package/plugin.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "remcp",
+  "version": "0.1.2",
+  "description": "Securely use files, directories, searches, terminal sessions, and processes on computers you have paired with ReMCP.",
+  "homepage": "https://remcp.delio24.com",
+  "repository": "https://github.com/antonbaider/remcp",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "remote-computer",
+    "developer-tools",
+    "files",
+    "terminal"
+  ],
+  "extensions": {
+    "com.openai": {
+      "interface": {
+        "displayName": "ReMCP",
+        "shortDescription": "Use your paired computers through MCP.",
+        "longDescription": "ReMCP securely connects ChatGPT and Codex to computers you have explicitly paired. Inspect files and directories, search local content, and manage terminal sessions and processes through an authenticated remote MCP endpoint.",
+        "category": "Developer Tools",
+        "websiteURL": "https://remcp.delio24.com",
+        "privacyPolicyURL": "https://remcp.delio24.com/privacy",
+        "termsOfServiceURL": "https://remcp.delio24.com/terms",
+        "defaultPrompt": [
+          "Show my paired ReMCP computers and tell me which ones are online.",
+          "On my laptop, list the files in my project folder and summarize what is there without changing anything.",
+          "On my server, list the running processes and help me identify the one using the most memory."
+        ],
+        "brandColor": "#4C50D8",
+        "composerIcon": "./assets/remcp-icon.png",
+        "logo": "./assets/remcp-icon.png"
+      }
+    }
+  }
+}

package/public/authorize.html

@@ -56,7 +56,7 @@
       <p class="eyebrow">Access request</p>
       <h2>Authorize ReMCP Access</h2>
       <p class="muted">This MCP client is requesting access to operate computers paired to this ReMCP account.</p>
-      <ul class="scope-list"><li><span>Control paired devices</span><strong>remcp:control</strong></li><li><span>Maintain the authorized connection</span><strong>offline_access</strong></li></ul>
+      <ul class="scope-list"><li><span>Identify your ReMCP account</span><strong>openid</strong></li><li><span>Share your verified email for workspace access rules</span><strong>email</strong></li><li><span>Control paired devices</span><strong>remcp:control</strong></li><li><span>Maintain the authorized connection</span><strong>offline_access</strong></li></ul>
       <p class="oauth-meta">Client: <span id="client-id"></span></p>
       <div class="oauth-actions"><button id="authorize" class="button" type="button">Authorize ReMCP Access</button><a class="button ghost" href="/">Not Now</a></div>
     </div>

package/public/privacy.html

@@ -41,7 +41,8 @@
 <h2>Device and security metadata</h2><p>ReMCP stores device identifiers, device names and basic platform metadata, one-way hashes of device credentials, pairing records, OAuth client metadata, and one-way hashes of refresh credentials. Pairing codes are short-lived and single-use. Raw device credentials are returned to the paired device and are not stored in plaintext by the service.</p>
 <h2>Files, commands and tool results</h2><p>When you use an MCP tool, its request and response may pass through the ReMCP relay. This can include filenames, file contents, command output and process information that you explicitly ask the paired computer to process. ReMCP does not intentionally retain those tool payloads as product data. Operational security logs may retain limited metadata such as timestamps, status codes and errors.</p>
 <h2>How data is used and shared</h2><p>Data is used to provide authentication, device pairing, OAuth authorization, request routing, abuse prevention, security and reliability. ReMCP does not sell personal information and does not serve advertising. Data may be processed by infrastructure and authentication providers only as needed to operate the service, including Firebase/Google for authentication.</p>
-<h2>Retention and control</h2><p>Device records remain until revoked or removed. OAuth grants remain until revoked, expired or rotated. Security and operational metadata may be retained for a limited period appropriate to troubleshooting and abuse prevention. You can revoke a paired device from the ReMCP workspace. Requests concerning account data or deletion can be made through the support channel identified on the Support page or in the app listing.</p>
+<h2>Retention and control</h2><p>Pairing codes expire after 10 minutes by default. MCP access tokens expire after 1 hour by default. Refresh credentials expire after 30 days by default and are rotated on use. Device records remain until you revoke or remove the device. ReMCP does not intentionally retain MCP tool request or response payloads as product data. Hosted Nginx access and error logs are rotated daily with 14 rotated copies. Application container logs are size-bounded to three files of at most 50 MB each rather than retained for a fixed number of days. These operational logs are used only for security, reliability, and troubleshooting and are not intended to contain authentication secrets or MCP tool payloads. You can revoke a paired device from the ReMCP workspace, and account-data or deletion requests can be made through the Support page.</p>
+<h2>Restricted data</h2><p>ReMCP is not intended to collect or process passwords, MFA or OTP codes, API or private keys, payment-card data, protected health information, or government identifiers through plugin tool calls. Users should keep those data out of ReMCP requests and use a safer local workflow when a requested file or command would expose them.</p>
 <h2>Security and international processing</h2><p>ReMCP uses TLS for network transport, hashes reusable credentials before storage, and scopes device access to the authenticated account. Internet services may process data in more than one country depending on infrastructure and authentication providers. See the <a href="/security">Security page</a> for the current security model.</p>
 <h2>Children</h2><p>ReMCP is a developer and systems-administration tool and is not directed to children under 13.</p>
 <h2>Changes</h2><p>Material changes to this policy will be published at this URL with an updated effective date.</p>

package/skills/remcp-operator/SKILL.md

@@ -33,4 +33,4 @@ Use `start_process` once and then `read_process_output` or `interact_with_proces
 
 ## Out-of-scope requests
 
-Do not use ReMCP to access a computer the user has not paired or is not authorized to control. Do not ask for passwords, MFA codes, private keys, or other credentials through ReMCP tool inputs.
+Do not use ReMCP to access a computer the user has not paired or is not authorized to control. Do not ask for or process passwords, MFA codes, private keys, API keys, payment-card data, protected health information, government identifiers, or other restricted credentials/data through ReMCP tools. If a requested file or command would expose those categories, ask the user to use a safer local workflow instead.

package/src/auth.mjs

@@ -18,6 +18,7 @@ export async function verifyFirebaseToken(token) {
     uid,
     firebaseUid: payload.sub,
     email,
+    emailVerified: payload.email_verified === true,
     name: typeof payload.name === 'string' ? payload.name : '',
   };
 }

package/src/config.mjs

@@ -38,7 +38,7 @@ export const config = Object.freeze({
   refreshTtlSeconds: Number(process.env.REFRESH_TTL_SECONDS || 2592000),
   rpcTimeoutMs: Number(process.env.RPC_TIMEOUT_MS || 120000),
   domainVerificationToken: (process.env.OPENAI_DOMAIN_VERIFICATION_TOKEN || '').trim(),
-  domainVerificationPath: (process.env.OPENAI_DOMAIN_VERIFICATION_PATH || '/.well-known/openai-domain-verification').trim(),
+  domainVerificationPath: (process.env.OPENAI_DOMAIN_VERIFICATION_PATH || '/.well-known/openai-apps-challenge').trim(),
   firebase: {
     apiKey: required('FIREBASE_API_KEY'),
     authDomain: required('FIREBASE_AUTH_DOMAIN'),

package/src/db.mjs

@@ -9,7 +9,7 @@ export const db = new DatabaseSync(join(config.dataDir, 'remcp.sqlite'));
 db.exec(`PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000;`);
 db.exec(`
 CREATE TABLE IF NOT EXISTS users (
-  uid TEXT PRIMARY KEY, email TEXT, name TEXT, created_at INTEGER NOT NULL, last_login_at INTEGER NOT NULL
+  uid TEXT PRIMARY KEY, email TEXT, name TEXT, email_verified INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL, last_login_at INTEGER NOT NULL
 );
 CREATE TABLE IF NOT EXISTS pair_codes (
   code_hash TEXT PRIMARY KEY, uid TEXT NOT NULL REFERENCES users(uid) ON DELETE CASCADE,
@@ -34,12 +34,15 @@ CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
   scope TEXT NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER
 );
 `);
+try { db.exec('ALTER TABLE users ADD COLUMN email_verified INTEGER NOT NULL DEFAULT 0'); } catch {}
 
-export function upsertUser({ uid, email = '', name = '' }) {
+export const getUser = uid => db.prepare('SELECT * FROM users WHERE uid=?').get(uid);
+
+export function upsertUser({ uid, email = '', name = '', emailVerified = false }) {
   const t = now();
-  db.prepare(`INSERT INTO users(uid,email,name,created_at,last_login_at) VALUES(?,?,?,?,?)
-    ON CONFLICT(uid) DO UPDATE SET email=excluded.email,name=excluded.name,last_login_at=excluded.last_login_at`)
-    .run(uid, email, name, t, t);
+  db.prepare(`INSERT INTO users(uid,email,name,email_verified,created_at,last_login_at) VALUES(?,?,?,?,?,?)
+    ON CONFLICT(uid) DO UPDATE SET email=excluded.email,name=excluded.name,email_verified=excluded.email_verified,last_login_at=excluded.last_login_at`)
+    .run(uid, email, name, emailVerified ? 1 : 0, t, t);
   return db.prepare('SELECT * FROM users WHERE uid=?').get(uid);
 }
 

package/src/mcp.mjs

@@ -57,7 +57,7 @@ function publicTool(tool) {
       readOnlyHint: tool.name === 'start_search' ? false : upstream.readOnlyHint === true,
       destructiveHint: destructive.has(tool.name),
       idempotentHint: upstream.idempotentHint === true,
-      openWorldHint: tool.name === 'read_file' ? false : (openWorld.has(tool.name) || upstream.openWorldHint === true),
+      openWorldHint: openWorld.has(tool.name) || tool.name === 'read_file' || upstream.openWorldHint === true,
     },
   };
 }

package/src/oauth.mjs

@@ -2,9 +2,9 @@ import crypto from 'node:crypto';
 import express from 'express';
 import { rateLimit } from 'express-rate-limit';
 import { config } from './config.mjs';
-import { verifyFirebaseToken, signMcpAccessToken } from './auth.mjs';
-import { createOauthCode, consumeOauthCode, getOauthClient, getRefreshToken, revokeRefreshToken, saveOauthClient, saveRefreshToken, upsertUser } from './db.mjs';
-import { normalizeScope, now, randomId, randomToken, sha256, validRedirectUri } from './util.mjs';
+import { verifyFirebaseToken, signMcpAccessToken, verifyMcpAccessToken } from './auth.mjs';
+import { createOauthCode, consumeOauthCode, getOauthClient, getRefreshToken, getUser, revokeRefreshToken, saveOauthClient, saveRefreshToken, upsertUser } from './db.mjs';
+import { bearer, normalizeScope, now, randomId, randomToken, sha256, validRedirectUri } from './util.mjs';
 
 const CODE_TTL_MS = 5 * 60 * 1000;
 const router = express.Router();
@@ -18,12 +18,13 @@ function metadata() {
     authorization_endpoint: endpoint('/oauth/authorize'),
     token_endpoint: endpoint('/oauth/token'),
     registration_endpoint: endpoint('/oauth/register'),
+    userinfo_endpoint: endpoint('/oauth/userinfo'),
     revocation_endpoint: endpoint('/oauth/revoke'),
     response_types_supported: ['code'],
     grant_types_supported: ['authorization_code', 'refresh_token'],
     token_endpoint_auth_methods_supported: ['none'],
     code_challenge_methods_supported: ['S256'],
-    scopes_supported: ['remcp:control', 'offline_access'],
+    scopes_supported: ['openid', 'email', 'remcp:control', 'offline_access'],
   };
 }
 
@@ -32,7 +33,7 @@ function protectedResource() {
     resource: endpoint('/mcp'),
     authorization_servers: [config.publicUrl],
     bearer_methods_supported: ['header'],
-    scopes_supported: ['remcp:control', 'offline_access'],
+    scopes_supported: ['openid', 'email', 'remcp:control', 'offline_access'],
     resource_documentation: config.publicUrl,
     resource_policy_uri: endpoint('/privacy'),
     resource_tos_uri: endpoint('/terms'),
@@ -136,6 +137,24 @@ router.post('/oauth/token', tokenLimiter, async (req, res) => {
   }
 });
 
+
+router.get('/oauth/userinfo', oauthLimiter, async (req, res) => {
+  noStore(res);
+  try {
+    const token = bearer(req);
+    if (!token) throw new Error('missing_token');
+    const auth = await verifyMcpAccessToken(token);
+    const scopes = new Set(auth.scope.split(/\s+/).filter(Boolean));
+    if (!scopes.has('openid') || !scopes.has('email')) throw new Error('insufficient_scope');
+    const user = getUser(auth.uid);
+    if (!user?.email || user.email_verified !== 1) throw new Error('verified_email_required');
+    res.json({ sub: auth.uid, email: user.email, email_verified: true, ...(user.name ? { name: user.name } : {}) });
+  } catch (error) {
+    res.setHeader('WWW-Authenticate', 'Bearer error="invalid_token"');
+    res.status(401).json({ error: 'invalid_token', error_description: error.message });
+  }
+});
+
 router.post('/oauth/revoke', oauthLimiter, (req, res) => {
   const token = String(req.body?.token || '');
   if (token) revokeRefreshToken(sha256(token));

package/src/util.mjs

@@ -9,7 +9,7 @@ export const bearer = req => {
   return value.startsWith('Bearer ') ? value.slice(7).trim() : '';
 };
 export function normalizeScope(value = '') {
-  const allowed = new Set(['openid', 'offline_access', 'remcp:control']);
+  const allowed = new Set(['openid', 'email', 'offline_access', 'remcp:control']);
   const scopes = String(value).split(/\s+/).filter(Boolean).filter(scope => allowed.has(scope));
   if (!scopes.includes('remcp:control')) scopes.push('remcp:control');
   if (!scopes.includes('offline_access')) scopes.push('offline_access');

package/chatgpt-app-submission.json

@@ -1,356 +0,0 @@
-{
-  "$schema": "https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json",
-  "schema_version": 1,
-  "app_info": {
-    "display_name": "ReMCP",
-    "subtitle": "Control your own computers",
-    "description": "ReMCP lets authenticated users connect to computers they have paired and work with local files, directories, searches, terminal sessions, and processes through MCP. Each device uses a revocable credential and an outbound agent connection.",
-    "category": "DEVELOPER_TOOLS"
-  },
-  "tools": {
-    "list_devices": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "get_config": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "set_config_value": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Can change security and access configuration on the selected computer."
-      }
-    },
-    "read_file": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "read_multiple_files": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "write_file": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Can overwrite or append file content on the selected computer."
-      }
-    },
-    "write_pdf": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Can replace PDF content or remove pages when editing a PDF."
-      }
-    },
-    "create_directory": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "list_directory": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "move_file": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Moves or renames filesystem objects and may replace an intended path."
-      }
-    },
-    "start_search": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "get_more_search_results": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "stop_search": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "list_searches": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "get_file_info": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "edit_block": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Changes existing file or document content on the selected computer."
-      }
-    },
-    "start_process": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": true,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "User-supplied process commands or input can contact external services or change external state.",
-        "destructive_justification": "Can execute commands that modify files, processes, configuration, or external systems."
-      }
-    },
-    "read_process_output": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "interact_with_process": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": true,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "User-supplied process commands or input can contact external services or change external state.",
-        "destructive_justification": "Can send commands or input to a process that performs irreversible actions."
-      }
-    },
-    "force_terminate": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Force-stops a running terminal session."
-      }
-    },
-    "list_sessions": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "list_processes": {
-      "annotations": {
-        "readOnlyHint": true,
-        "openWorldHint": false,
-        "destructiveHint": false
-      },
-      "justifications": {
-        "read_only_justification": "Only retrieves local device data or results and does not change persistent user state.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Does not delete, overwrite, revoke, terminate, or perform another irreversible action by itself."
-      }
-    },
-    "kill_process": {
-      "annotations": {
-        "readOnlyHint": false,
-        "openWorldHint": false,
-        "destructiveHint": true
-      },
-      "justifications": {
-        "read_only_justification": "Creates, changes, stops, or controls local device state or a local execution session.",
-        "open_world_justification": "Operates on the paired computer or ReMCP session and does not itself publish or modify third-party internet state.",
-        "destructive_justification": "Terminates the selected operating-system process."
-      }
-    }
-  },
-  "test_cases": [
-    {
-      "description": "List the computers available to the signed-in ReMCP account.",
-      "user_prompt": "List my ReMCP devices and tell me which ones are online. Include the ReMCP Review Sandbox if it is available.",
-      "file_attachment_urls": null,
-      "tools_triggered": "list_devices",
-      "expected_output": "Returns devices available to the authenticated account and includes the isolated ReMCP Review Sandbox with device id review-sandbox.",
-      "expected_output_url": null
-    },
-    {
-      "description": "Browse a directory on a paired review computer.",
-      "user_prompt": "Using ReMCP device id review-sandbox, list the files in /workspace.",
-      "file_attachment_urls": null,
-      "tools_triggered": "list_directory",
-      "expected_output": "Returns the isolated sandbox directory entries without changing them.",
-      "expected_output_url": null
-    },
-    {
-      "description": "Read a text file from a paired review computer.",
-      "user_prompt": "Using ReMCP device id review-sandbox, read /workspace/README.txt and summarize it.",
-      "file_attachment_urls": null,
-      "tools_triggered": "read_file",
-      "expected_output": "Returns the seeded review-sandbox README content so it can be summarized.",
-      "expected_output_url": null
-    },
-    {
-      "description": "Create a new file on a paired review computer.",
-      "user_prompt": "Using ReMCP device id review-sandbox, create /workspace/review-note.txt containing exactly: ReMCP submission test.",
-      "file_attachment_urls": null,
-      "tools_triggered": "write_file",
-      "expected_output": "Creates the requested file only inside the authenticated reviewer sandbox and reports the write result.",
-      "expected_output_url": null
-    },
-    {
-      "description": "Run a harmless terminal command on a paired review computer.",
-      "user_prompt": "Using ReMCP device id review-sandbox, run pwd and show me the result.",
-      "file_attachment_urls": null,
-      "tools_triggered": "start_process",
-      "expected_output": "Runs the sandbox-safe command and returns /workspace; arbitrary terminal commands remain blocked in the review sandbox.",
-      "expected_output_url": null
-    }
-  ],
-  "negative_test_cases": [
-    {
-      "description": "Do not invoke ReMCP for general weather information.",
-      "user_prompt": "What will the weather be in Warsaw tomorrow?",
-      "file_attachment_urls": null,
-      "tools_triggered": null,
-      "expected_output": "ReMCP should not be invoked because the request does not involve a paired computer.",
-      "expected_output_url": null
-    },
-    {
-      "description": "Do not invoke ReMCP for standalone writing help.",
-      "user_prompt": "Draft a polite email asking my landlord to repair a leaking faucet.",
-      "file_attachment_urls": null,
-      "tools_triggered": null,
-      "expected_output": "ReMCP should not be invoked because no local computer action or data is needed.",
-      "expected_output_url": null
-    },
-    {
-      "description": "Do not invoke ReMCP for a conceptual technical explanation.",
-      "user_prompt": "Explain OAuth PKCE in simple terms.",
-      "file_attachment_urls": null,
-      "tools_triggered": null,
-      "expected_output": "ReMCP should not be invoked because the user only requested an explanation.",
-      "expected_output_url": null
-    }
-  ]
-}