@remcp/remcp 0.1.1 → 0.1.3

package/README.md

@@ -1,90 +1,116 @@
 # ReMCP
 
-ReMCP is an open-source remote MCP bridge for computers you control. A local agent connects outbound to a ReMCP server and exposes filesystem, search, terminal and process tools through one authenticated remote MCP endpoint.
+ReMCP is an open-source remote MCP bridge for computers you control. A lightweight device agent connects **outbound** to a ReMCP relay, so ChatGPT, Codex, or another MCP client can work with local files, directories, searches, terminal sessions, and processes without exposing an inbound port on the computer.
 
-**Hosted service:** https://remcp.delio24.com
-**MCP endpoint:** `https://remcp.delio24.com/mcp`
+- Hosted service: <https://remcp.delio24.com>
+- MCP endpoint: `https://remcp.delio24.com/mcp`
+- npm: `@remcp/remcp`
+- License: MIT
 
-## How it works
+## Quick start
 
-```text
-ChatGPT / MCP client ── OAuth + HTTPS ──> ReMCP server
-                                           │
-                                           ├── WSS ──> laptop agent ──> local MCP
-                                           └── WSS ──> server agent ──> local MCP
-```
-
-The central service stores account/device metadata, hashed reusable credentials and OAuth state. Actual filesystem and process access stays on the paired computer.
+Requires Node.js 22.5 or newer.
 
-## Install and pair
-
-Requires Node.js 22.5 or newer. Generate a one-time pairing code after signing in at https://remcp.delio24.com, then run:
+1. Install the CLI:
 
 ```bash
-npx --yes @remcp/remcp@latest connect --server https://remcp.delio24.com --code YOUR_PAIRING_CODE --install
+npm install --global @remcp/remcp@latest
 ```
 
-`--install` creates a persistent global `remcp` CLI and Linux user service. The initial `npx` execution is only the bootstrap step.
+2. Open <https://remcp.delio24.com/#connect>, sign in with Google or GitHub, and choose **Generate pairing command**. Run the exact generated command on the computer you want to pair.
 
-Verify:
+3. Verify:
 
 ```bash
 remcp --version
 remcp status
 ```
 
+4. Add the MCP endpoint to your client:
+
+```text
+https://remcp.delio24.com/mcp
+```
+
+Authentication uses OAuth authorization code + PKCE with rotating refresh credentials.
+
 ## Update
 
 ```bash
 remcp update
 ```
 
-This updates the global CLI to the latest published release, refreshes the compatible local runtime, and restarts the installed user service.
+`remcp update` refreshes the global CLI and compatible local runtime, then restarts the installed user service.
 
 ## CLI
 
 ```text
 remcp start             Run the device agent in the foreground
-remcp status            Check pairing, version and server health
+remcp status            Show version, pairing and server health
 remcp doctor            Alias for status
-remcp update            Update ReMCP and restart the installed service
+remcp update            Update ReMCP and restart the user service
 remcp install           Install or repair the user service
 remcp uninstall         Remove the user service
 remcp uninstall --purge Remove the service and global ReMCP packages
 remcp --version         Print the installed CLI version
 ```
 
-## Self-host the server
+## Architecture
 
-```bash
-git clone https://github.com/antonbaider/remcp.git
-cd remcp
-cp .env.example .env
-# Fill in your public URL and Firebase Web App configuration.
-docker compose up -d --build
+```text
+ChatGPT / Codex / MCP client
+           │
+           │ OAuth 2.1 + HTTPS
+           ▼
+     ReMCP relay /mcp
+           │
+           │ authenticated WSS (outbound from device)
+           ▼
+      paired computer
+           │
+           └── local file / search / terminal / process runtime
 ```
 
-Put a TLS reverse proxy in front of ReMCP and proxy WebSocket upgrades for `/agent`. The example Compose file binds the application to localhost by default. Do not publish the internal application port directly unless you have deliberately secured it.
+The hosted relay stores account/device metadata, one-way hashes of reusable credentials, OAuth client metadata, and refresh-token hashes. Device credentials are independently revocable. MCP sessions are scoped to the authenticated ReMCP account.
+
+## OpenAI Plugin package
 
-ReMCP does **not** require a Firebase Admin service-account private key. Firebase ID tokens are verified using Google's public signing keys.
+The repository is prepared for the current OpenAI Plugins format:
 
-## ChatGPT / remote MCP
+- `plugin.json` — portable Agent Plugins manifest;
+- `mcp.json` — production Streamable HTTP MCP configuration;
+- `skills/remcp-operator/SKILL.md` — bundled operator skill;
+- `assets/remcp-icon.png` — plugin icon;
+- `docs/OPENAI_PLUGIN.md` — submission and reviewer checklist;
+- `submission/openai-plugin-review.json` — generated tool annotations plus five positive and three negative review cases.
 
-ReMCP exposes Streamable HTTP MCP at `/mcp`. Authentication uses authorization code + PKCE, Dynamic Client Registration, short-lived access tokens and rotating refresh tokens.
+ReMCP has no plugin UI, so the public submission should not include UI screenshots. The remote MCP server uses a universal production URL and OAuth. See [`docs/OPENAI_PLUGIN.md`](docs/OPENAI_PLUGIN.md) before submitting.
 
-The repository includes `chatgpt-app-submission.json` plus a reusable ReMCP operator skill for submission/testing workflows.
 ## Security model
 
-- one independent credential per paired device;
-- device and refresh credentials are stored as one-way hashes server-side;
+- no inbound port is required on paired computers;
+- one revocable credential is issued per paired device;
+- reusable credentials are hashed server-side;
 - pairing codes are short-lived and single-use;
-- MCP sessions are bound to the authenticated account;
-- the device agent connects outbound over WSS;
-- write/process tools expose explicit MCP risk annotations;
-- the public review sandbox is isolated per authenticated user and intentionally limits terminal commands;
-- central Docker deployment runs read-only with dropped Linux capabilities in the supplied Compose configuration.
+- OAuth uses PKCE and rotating refresh credentials;
+- OAuth metadata advertises `openid` and `email`, with a UserInfo endpoint for verified-email workspace restrictions;
+- MCP tools carry explicit `readOnlyHint`, `openWorldHint`, and `destructiveHint` annotations;
+- the public review fixture is isolated per authenticated account and intentionally restricts terminal commands;
+- the supplied server container runs read-only with dropped Linux capabilities.
 
-See https://remcp.delio24.com/security for the hosted-service security overview.
+ReMCP tools should not be used to request or process passwords, MFA codes, API/private keys, payment-card data, protected health information, or government identifiers. See [`SECURITY.md`](SECURITY.md) and the hosted <https://remcp.delio24.com/security> page.
+
+## Self-hosting
+
+```bash
+git clone https://github.com/antonbaider/remcp.git
+cd remcp
+cp .env.example .env
+# Fill in your public URL and Firebase Web App configuration.
+docker compose up -d --build
+```
+
+Put a TLS reverse proxy in front of ReMCP and proxy WebSocket upgrades for `/agent`. The supplied Compose configuration binds the application to localhost by default. ReMCP verifies Firebase ID tokens using Google's public signing keys and does not require a Firebase Admin private key.
 
 ## Development
 
@@ -93,8 +119,25 @@ npm ci
 npm run check
 npm test
 npm audit --omit=dev
+npm pack --dry-run
+```
+
+For server changes:
+
+```bash
+docker build -t remcp:test .
 ```
 
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for contribution and security rules.
+
+## Project docs
+
+- [`docs/OPENAI_PLUGIN.md`](docs/OPENAI_PLUGIN.md) — OpenAI Plugins submission
+- [`SECURITY.md`](SECURITY.md) — vulnerability reporting and operational security
+- [`CONTRIBUTING.md`](CONTRIBUTING.md) — development checks
+- [`CHANGELOG.md`](CHANGELOG.md) — release notes
+- [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) — third-party license notices
+
 ## License
 
-ReMCP is MIT licensed. Third-party notices for the local device runtime are preserved in `THIRD_PARTY_NOTICES.md`. ReMCP is self-hostable and does not depend on a proprietary hosted relay.
+ReMCP is MIT licensed. Third-party notices for the local device runtime are preserved in `THIRD_PARTY_NOTICES.md`.

package/mcp.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "remcp": {
+      "type": "streamable-http",
+      "url": "https://remcp.delio24.com/mcp"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Self-hosted remote MCP bridge for securely controlling your own computers from MCP clients.",
   "type": "module",
   "license": "MIT",
@@ -15,8 +15,10 @@
     "bin",
     "src",
     "public",
+    "plugin.json",
+    "mcp.json",
+    "assets",
     "skills/remcp-operator",
-    "chatgpt-app-submission.json",
     "LICENSE",
     "THIRD_PARTY_NOTICES.md",
     "README.md"

package/plugin.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "remcp",
+  "version": "0.1.3",
+  "description": "Securely use files, directories, searches, terminal sessions, and processes on computers you have paired with ReMCP.",
+  "homepage": "https://remcp.delio24.com",
+  "repository": "https://github.com/antonbaider/remcp",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "remote-computer",
+    "developer-tools",
+    "files",
+    "terminal"
+  ],
+  "extensions": {
+    "com.openai": {
+      "interface": {
+        "displayName": "ReMCP",
+        "shortDescription": "Use your paired computers through MCP.",
+        "longDescription": "ReMCP securely connects ChatGPT and Codex to computers you have explicitly paired. Inspect files and directories, search local content, and manage terminal sessions and processes through an authenticated remote MCP endpoint.",
+        "category": "Developer Tools",
+        "websiteURL": "https://remcp.delio24.com",
+        "privacyPolicyURL": "https://remcp.delio24.com/privacy",
+        "termsOfServiceURL": "https://remcp.delio24.com/terms",
+        "defaultPrompt": [
+          "Show my paired ReMCP computers and tell me which ones are online.",
+          "On my laptop, list the files in my project folder and summarize what is there without changing anything.",
+          "On my server, list the running processes and help me identify the one using the most memory."
+        ],
+        "brandColor": "#4C50D8",
+        "composerIcon": "./assets/remcp-icon.png",
+        "logo": "./assets/remcp-icon.png"
+      }
+    }
+  }
+}

package/public/app.js

@@ -1,37 +1,37 @@
 import { initializeApp } from 'https://www.gstatic.com/firebasejs/10.14.1/firebase-app.js';
-import { getAuth, GoogleAuthProvider, onAuthStateChanged, signInWithPopup, signInWithEmailAndPassword, createUserWithEmailAndPassword, signOut } from 'https://www.gstatic.com/firebasejs/10.14.1/firebase-auth.js';
+import { getAuth, GoogleAuthProvider, GithubAuthProvider, onAuthStateChanged, signInWithPopup, signOut } from 'https://www.gstatic.com/firebasejs/10.14.1/firebase-auth.js';
 
 const cfg = await fetch(`/api/config?fresh=${Date.now()}`, { cache: 'no-store' }).then(r => r.json());
 const auth = getAuth(initializeApp(cfg.firebase));
 const $ = selector => document.querySelector(selector);
-const showError = error => { $('#auth-error').textContent = error?.message || String(error); };
 const googleProvider = new GoogleAuthProvider();
+const githubProvider = new GithubAuthProvider();
+googleProvider.setCustomParameters({ prompt: 'select_account' });
 
-$('#mcp-url').textContent = cfg.mcpUrl;
-$('#google').onclick = async () => {
-  const button = $('#google');
+const friendlyAuthError = error => {
+  const code = error?.code || '';
+  if (code === 'auth/popup-closed-by-user' || code === 'auth/cancelled-popup-request') return '';
+  if (code === 'auth/account-exists-with-different-credential') return 'This email is already linked to another sign-in provider.';
+  if (code === 'auth/operation-not-allowed') return 'This sign-in provider is not enabled.';
+  return error?.message || String(error);
+};
+const showError = error => { $('#auth-error').textContent = friendlyAuthError(error); };
+
+async function signIn(button, provider, idleLabel) {
   const label = button.querySelector('span');
   button.disabled = true;
   $('#auth-error').textContent = '';
-  label.textContent = 'Opening Google…';
-  try { await signInWithPopup(auth, googleProvider); }
+  label.textContent = 'Opening…';
+  try { await signInWithPopup(auth, provider); }
   catch (error) { showError(error); }
-  finally { button.disabled = false; label.textContent = 'Continue with Google'; }
-};
-$('#email-login').onclick = () => signInWithEmailAndPassword(auth, $('#email').value, $('#password').value).catch(showError);
-$('#email-register').onclick = () => createUserWithEmailAndPassword(auth, $('#email').value, $('#password').value).catch(showError);
+  finally { button.disabled = false; label.textContent = idleLabel; }
+}
+
+$('#mcp-url').textContent = cfg.mcpUrl;
+$('#google').onclick = () => signIn($('#google'), googleProvider, 'Continue with Google');
+$('#github').onclick = () => signIn($('#github'), githubProvider, 'Continue with GitHub');
 $('#logout').onclick = () => signOut(auth);
 
-document.addEventListener('click', async event => {
-  const button = event.target.closest('[data-copy]');
-  if (!button) return;
-  const target = document.querySelector(button.dataset.copy);
-  if (!target) return;
-  await navigator.clipboard.writeText(target.textContent.trim());
-  const original = button.textContent;
-  button.textContent = 'Copied';
-  setTimeout(() => { button.textContent = original; }, 1200);
-});
 async function api(path, options = {}) {
   const token = await auth.currentUser.getIdToken();
   const response = await fetch(path, { ...options, headers: { ...(options.headers || {}), authorization: `Bearer ${token}`, 'content-type': 'application/json' } });
@@ -70,16 +70,17 @@ async function refreshDevices() {
   const data = await api('/api/me');
   const root = $('#devices');
   root.replaceChildren();
-  if (!data.devices.length) { root.textContent = 'No devices yet.'; return; }
+  if (!data.devices.length) { root.textContent = 'No paired devices.'; return; }
   for (const device of data.devices) root.append(deviceRow(device));
 }
+
 $('#pair').onclick = async () => {
   try {
     const pairing = await api('/api/pair/create', { method: 'POST', body: '{}' });
     $('#pairing').classList.remove('hidden');
     $('#pair-command').textContent = pairing.command;
     const expiry = new Intl.DateTimeFormat(undefined, { hour: 'numeric', minute: '2-digit' }).format(new Date(pairing.expiresAt));
-    $('#pair-expiry').textContent = `Expires ${expiry}`;
+    $('#pair-expiry').textContent = `One-time command · expires ${expiry}`;
   } catch (error) { showError(error); }
 };
 
@@ -90,6 +91,6 @@ onAuthStateChanged(auth, async user => {
   $('#dashboard').classList.toggle('hidden', !signedIn);
   $('#auth-error').textContent = '';
   if (!signedIn) return;
-  $('#user-label').textContent = user.email || user.uid;
+  $('#user-label').textContent = user.email || user.displayName || user.uid;
   try { await refreshDevices(); } catch (error) { showError(error); }
 });

package/public/authorize.html

@@ -8,7 +8,7 @@
   <title>Authorize · ReMCP</title>
   <meta name="description" content="Authorize an MCP client to access computers paired to your ReMCP account.">
   <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/style.css?v=remcp-012">
+  <link rel="stylesheet" href="/style.css?v=remcp-013">
   <meta property="og:site_name" content="ReMCP">
   <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
   <link rel="icon" href="/favicon.ico" sizes="any">
@@ -28,43 +28,32 @@
     <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
     <span translate="no">ReMCP</span>
   </a>
-  <nav aria-label="Primary"><a href="/docs">Docs</a><a href="/docs#install">Install</a><a href="/docs#update">Update</a><a href="/security">Security</a><a href="/support">Support</a></nav>
+  <nav aria-label="Primary"><a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a></nav>
 </header>
 <main id="oauth-main" class="oauth-shell">
   <section class="oauth-card">
     <div id="oauth-login">
       <p class="eyebrow">Secure authorization</p>
       <h2 id="oauth-title">Sign in to ReMCP</h2>
-      <p class="muted">Verify your account before reviewing this MCP client’s access request.</p>
-      <button id="google" class="button google-button" type="button">
-  <svg class="google-icon" viewBox="0 0 18 18" aria-hidden="true" focusable="false">
-    <path fill="#4285F4" d="M17.64 9.205c0-.638-.057-1.252-.164-1.841H9v3.481h4.844a4.14 4.14 0 0 1-1.796 2.715v2.259h2.909c1.702-1.567 2.683-3.874 2.683-6.614Z"/>
-    <path fill="#34A853" d="M9 18c2.43 0 4.468-.806 5.957-2.181l-2.909-2.259c-.806.54-1.835.859-3.048.859-2.344 0-4.328-1.585-5.037-3.714H.956v2.332A9 9 0 0 0 9 18Z"/>
-    <path fill="#FBBC05" d="M3.963 10.705A5.41 5.41 0 0 1 3.682 9c0-.592.102-1.168.281-1.705V4.963H.956A9 9 0 0 0 0 9c0 1.452.347 2.827.956 4.037l3.007-2.332Z"/>
-    <path fill="#EA4335" d="M9 3.581c1.321 0 2.507.454 3.441 1.346l2.581-2.581C13.464.892 11.426 0 9 0A9 9 0 0 0 .956 4.963l3.007 2.332C4.672 5.166 6.656 3.581 9 3.581Z"/>
-  </svg>
-  <span>Continue with Google</span>
-</button>
-      <div class="divider"><span>or use email</span></div>
-      <label for="email">Email</label>
-      <input id="email" name="email" type="email" autocomplete="email" inputmode="email" autocapitalize="none" spellcheck="false">
-      <label for="password">Password</label>
-      <input id="password" name="password" type="password" autocomplete="current-password">
-      <div class="button-row"><button id="email-login" class="button secondary" type="button">Sign In</button><button id="email-register" class="button ghost" type="button">Create Account</button></div>
+      <p class="muted">Continue with Google or GitHub, then review the MCP client’s access request.</p>
+      <div class="provider-stack">
+        <button id="google" class="provider-button google-button" type="button"><svg class="provider-icon" viewBox="0 0 18 18" aria-hidden="true"><path fill="#4285F4" d="M17.64 9.205c0-.638-.057-1.252-.164-1.841H9v3.481h4.844a4.14 4.14 0 0 1-1.796 2.715v2.259h2.909c1.702-1.567 2.683-3.874 2.683-6.614Z"/><path fill="#34A853" d="M9 18c2.43 0 4.468-.806 5.957-2.181l-2.909-2.259c-.806.54-1.835.859-3.048.859-2.344 0-4.328-1.585-5.037-3.714H.956v2.332A9 9 0 0 0 9 18Z"/><path fill="#FBBC05" d="M3.963 10.705A5.41 5.41 0 0 1 3.682 9c0-.592.102-1.168.281-1.705V4.963H.956A9 9 0 0 0 0 9c0 1.452.347 2.827.956 4.037l3.007-2.332Z"/><path fill="#EA4335" d="M9 3.581c1.321 0 2.507.454 3.441 1.346l2.581-2.581C13.464.892 11.426 0 9 0A9 9 0 0 0 .956 4.963l3.007 2.332C4.672 5.166 6.656 3.581 9 3.581Z"/></svg><span>Continue with Google</span></button>
+        <button id="github" class="provider-button github-button" type="button"><svg class="provider-icon" viewBox="0 0 24 24" aria-hidden="true"><path fill="currentColor" d="M12 .7a11.5 11.5 0 0 0-3.64 22.41c.58.11.79-.25.79-.56v-2.24c-3.22.7-3.9-1.37-3.9-1.37-.53-1.34-1.29-1.7-1.29-1.7-1.05-.72.08-.71.08-.71 1.16.08 1.77 1.19 1.77 1.19 1.04 1.77 2.72 1.26 3.38.96.1-.75.4-1.26.73-1.55-2.57-.29-5.27-1.29-5.27-5.68 0-1.26.45-2.29 1.19-3.1-.12-.29-.52-1.47.11-3.06 0 0 .97-.31 3.16 1.18a10.9 10.9 0 0 1 5.76 0c2.19-1.49 3.16-1.18 3.16-1.18.63 1.59.23 2.77.11 3.06.74.81 1.19 1.84 1.19 3.1 0 4.4-2.71 5.38-5.29 5.67.42.36.79 1.07.79 2.16v3.21c0 .31.21.68.8.56A11.5 11.5 0 0 0 12 .7Z"/></svg><span>Continue with GitHub</span></button>
+      </div>
     </div>
     <div id="oauth-consent" class="hidden">
       <p class="eyebrow">Access request</p>
       <h2>Authorize ReMCP Access</h2>
       <p class="muted">This MCP client is requesting access to operate computers paired to this ReMCP account.</p>
-      <ul class="scope-list"><li><span>Control paired devices</span><strong>remcp:control</strong></li><li><span>Maintain the authorized connection</span><strong>offline_access</strong></li></ul>
+      <ul class="scope-list"><li><span>Identify your ReMCP account</span><strong>openid</strong></li><li><span>Share your verified email for workspace access rules</span><strong>email</strong></li><li><span>Control paired devices</span><strong>remcp:control</strong></li><li><span>Maintain the authorized connection</span><strong>offline_access</strong></li></ul>
       <p class="oauth-meta">Client: <span id="client-id"></span></p>
       <div class="oauth-actions"><button id="authorize" class="button" type="button">Authorize ReMCP Access</button><a class="button ghost" href="/">Not Now</a></div>
     </div>
     <p id="status" class="muted" aria-live="polite"></p>
     <p id="error" class="error" role="alert" aria-live="assertive"></p>
-    <p class="footer-mini"><a href="/docs">Docs</a> · <a href="/docs#install">Install</a> · <a href="/docs#update">Update</a> · <a href="/security">Security</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a></p>
+    <p class="footer-mini"><a href="/docs">Docs</a> · <a href="/security">Security</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a></p>
   </section>
 </main>
-<script type="module" src="/oauth-app.js?v=36155fefb47e"></script>
+<script type="module" src="/oauth-app.js?v=remcp-013"></script>
 </body>
 </html>

package/public/copy.js

@@ -14,13 +14,7 @@ function legacyCopy(text) {
 
 async function copyText(text) {
   if (window.isSecureContext && navigator.clipboard?.writeText) {
-    try {
-      await navigator.clipboard.writeText(text);
-      return;
-    } catch {
-      legacyCopy(text);
-      return;
-    }
+    try { await navigator.clipboard.writeText(text); return; } catch {}
   }
   legacyCopy(text);
 }
@@ -30,20 +24,17 @@ document.addEventListener('click', async event => {
   if (!button) return;
   const target = document.querySelector(button.dataset.copy);
   if (!target) return;
-
-  const original = button.textContent;
-  const originalLabel = button.getAttribute('aria-label') || 'Copy command';
+  const text = ('value' in target ? target.value : target.textContent).trim();
+  const label = button.getAttribute('aria-label') || 'Copy';
   try {
-    await copyText(target.textContent.trim());
-    button.textContent = 'Copied';
-    button.setAttribute('aria-label', 'Copied to clipboard');
+    await copyText(text);
+    button.dataset.copied = 'true';
+    button.setAttribute('aria-label', 'Copied');
   } catch {
-    button.textContent = 'Copy failed';
-    button.setAttribute('aria-label', 'Copy failed. Select the command manually.');
+    button.setAttribute('aria-label', 'Copy failed');
   }
-
   window.setTimeout(() => {
-    button.textContent = original;
-    button.setAttribute('aria-label', originalLabel);
+    delete button.dataset.copied;
+    button.setAttribute('aria-label', label);
   }, 1400);
 });

package/public/docs.html

@@ -8,7 +8,7 @@
   <title>Docs · ReMCP</title>
   <meta name="description" content="Connect a computer to ReMCP and configure the hosted MCP endpoint.">
   <link rel="preconnect" href="https://www.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/style.css?v=remcp-012">
+  <link rel="stylesheet" href="/style.css?v=remcp-013">
   <meta property="og:site_name" content="ReMCP">
   <meta property="og:image" content="https://remcp.delio24.com/assets/og-remcp.png">
   <link rel="icon" href="/favicon.ico" sizes="any">
@@ -28,57 +28,56 @@
     <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
     <span translate="no">ReMCP</span>
   </a>
-  <nav aria-label="Primary"><a href="/docs" aria-current="page">Docs</a><a href="/docs#install">Install</a><a href="/docs#update">Update</a><a href="/security">Security</a><a href="/support">Support</a></nav>
+  <nav aria-label="Primary"><a href="/docs" aria-current="page">Docs</a><a href="/security">Security</a><a href="/support">Support</a></nav>
 </header>
 <main id="main" class="doc-shell">
   <aside class="doc-nav" aria-label="Documentation"><a href="/docs" aria-current="page">Setup</a><a href="/docs#install">Install</a><a href="/docs#update">Update</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a></aside>
   <article class="prose">
     <p class="eyebrow">Documentation</p>
-    <h1>Install, pair and keep ReMCP updated.</h1>
-    <p>Use <code>npx</code> once to pair a computer. With <code>--install</code>, ReMCP creates a persistent global CLI and a user service, so normal operation no longer depends on the temporary npx cache.</p>
+    <h1>Install and pair ReMCP.</h1>
+    <p>Install the CLI first. Pairing happens from the signed-in workspace, which generates the real one-time command for your computer.</p>
 
-    <h2 id="requirements">1. Requirements</h2>
-    <p>Install Node.js 22.5 or newer. The computer needs outbound HTTPS/WSS access to <code>remcp.delio24.com</code>; no inbound device port is required.</p>
+    <h2 id="requirements">Requirements</h2>
+    <p>Node.js 22.5 or newer. The computer needs outbound HTTPS/WSS access to <code>remcp.delio24.com</code>. No inbound device port is required.</p>
 
-    <h2 id="pair">2. Get a pairing code</h2>
-    <p>Open <a href="/#connect">the ReMCP workspace</a>, sign in, and choose <strong>Generate Command</strong>. Pairing codes are short-lived and single-use.</p>
+    <h2 id="install">1. Install the CLI</h2>
+    <div class="copy-field"><code id="docs-install">npm install --global @remcp/remcp@latest</code><button class="copy-icon-button" type="button" data-copy="#docs-install" aria-label="Copy install command"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
+    <p>This installs the <code>remcp</code> command. It does not pair a computer and does not contain a placeholder code.</p>
 
-    <h2 id="install">3. Install and pair</h2>
-    <div class="code-row"><pre><code id="docs-command-1">npx --yes @remcp/remcp@latest connect --server https://remcp.delio24.com --code YOUR_CODE --install</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-1" aria-label="Copy command" aria-live="polite">Copy</button></div>
-    <p>This stores a device-specific credential locally, installs the persistent <code>remcp</code> CLI, installs the compatible local device runtime, and starts the ReMCP user service.</p>
+    <h2 id="pair">2. Pair a computer</h2>
+    <p>Open the <a href="/#connect">ReMCP workspace</a>, continue with Google or GitHub, and choose <strong>Generate pairing command</strong>. Run that exact generated command on the computer you want to pair.</p>
+    <div class="notice"><strong>Use the generated command.</strong><p>Pairing codes are short-lived and single-use. Do not type a made-up code or reuse an expired command.</p></div>
 
-    <h3>Verify the installation</h3>
-    <div class="code-row"><pre><code id="docs-command-2">remcp --version
-remcp status</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-2" aria-label="Copy command" aria-live="polite">Copy</button></div>
-    <p><code>status</code> shows the installed CLI version, paired device id, server URL and server health.</p>
+    <h2 id="verify">3. Verify</h2>
+    <div class="copy-field multiline"><pre><code id="docs-verify">remcp --version
+remcp status</code></pre><button class="copy-icon-button" type="button" data-copy="#docs-verify" aria-label="Copy verification commands"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
+    <p><code>status</code> shows the installed CLI version, pairing state and server health.</p>
 
     <h2 id="mcp">4. Add the MCP endpoint</h2>
-    <div class="code-row"><pre><code id="docs-command-3">https://remcp.delio24.com/mcp</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-3" aria-label="Copy MCP endpoint" aria-live="polite">Copy</button></div>
-    <p>Choose OAuth when your MCP client asks for authentication. ReMCP uses authorization code flow with PKCE and refresh tokens.</p>
+    <div class="copy-field"><code id="docs-mcp">https://remcp.delio24.com/mcp</code><button class="copy-icon-button" type="button" data-copy="#docs-mcp" aria-label="Copy MCP endpoint"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
+    <p>Add this endpoint to your MCP client and use OAuth when prompted. ReMCP uses authorization code flow with PKCE and refresh-token rotation.</p>
 
-    <h2 id="update">Update ReMCP</h2>
-    <div class="code-row"><pre><code id="docs-command-4">remcp update</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-4" aria-label="Copy command" aria-live="polite">Copy</button></div>
-    <p>The update command installs the latest published ReMCP CLI, refreshes the compatible local runtime, and restarts the user service when it is installed. Verify afterwards with <code>remcp --version</code> or <code>remcp status</code>.</p>
+    <h2 id="update">Update</h2>
+    <div class="copy-field"><code id="docs-update">remcp update</code><button class="copy-icon-button" type="button" data-copy="#docs-update" aria-label="Copy update command"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
+    <p>Updates the installed ReMCP CLI and compatible local runtime, then restarts the user service when present.</p>
 
     <h2 id="service">Service commands</h2>
-    <div class="code-row"><pre><code id="docs-command-5">remcp status
+    <div class="copy-field multiline"><pre><code id="docs-service">remcp status
 remcp doctor
 remcp install
-remcp start</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-5" aria-label="Copy command" aria-live="polite">Copy</button></div>
-    <p><code>start</code> runs the agent in the foreground. <code>install</code> repairs or reinstalls the persistent user service for an already paired computer.</p>
+remcp start</code></pre><button class="copy-icon-button" type="button" data-copy="#docs-service" aria-label="Copy service commands"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
+    <p><code>install</code> installs or repairs the background user service for an already paired computer. <code>start</code> runs the agent in the foreground.</p>
 
     <h2 id="uninstall">Uninstall</h2>
-    <div class="code-row"><pre><code id="docs-command-6">remcp uninstall</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-6" aria-label="Copy command" aria-live="polite">Copy</button></div>
-    <p>This stops and removes the background user service but keeps the CLI and local pairing configuration.</p>
-    <div class="code-row"><pre><code id="docs-command-7">remcp uninstall --purge</code></pre><button class="copy-button code-copy" type="button" data-copy="#docs-command-7" aria-label="Copy command" aria-live="polite">Copy</button></div>
-    <p><code>--purge</code> also removes the globally installed ReMCP packages. The local pairing configuration remains in <code>~/.config/remcp</code> so it is not silently destroyed.</p>
+    <div class="copy-field"><code id="docs-uninstall">remcp uninstall</code><button class="copy-icon-button" type="button" data-copy="#docs-uninstall" aria-label="Copy uninstall command"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
+    <p>Removes the background service. To also remove globally installed ReMCP packages:</p>
+    <div class="copy-field"><code id="docs-purge">remcp uninstall --purge</code><button class="copy-icon-button" type="button" data-copy="#docs-purge" aria-label="Copy purge command"><svg class="icon-copy" viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M15 9V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3"/></svg><svg class="icon-check" viewBox="0 0 24 24" aria-hidden="true"><path d="m5 12 4 4L19 6"/></svg></button></div>
 
     <h2 id="connection-model">Connection model</h2>
-    <p>The device agent creates an outbound secure WebSocket connection to the relay. You do not need to expose a listener on the computer.</p>
-    <div class="notice"><strong>Review mutating actions.</strong><p>Some tools can write files or run processes. Review the action requested by your MCP client before approving it.</p></div>
+    <p>The device agent opens an outbound secure WebSocket connection to the relay. MCP clients connect to the HTTPS MCP endpoint through OAuth. Only devices paired to the signed-in account are exposed to that account.</p>
 
     <h2 id="self-hosting">Self-hosting</h2>
-    <p>The central ReMCP service runs in Docker with persistent account, device and OAuth metadata. Device agents run natively so host access does not require a privileged container.</p>
+    <p>The server can be self-hosted with Docker. Keep it behind TLS, persist its data volume, and proxy WebSocket upgrades for the device-agent route. See the repository README for deployment variables.</p>
   </article>
 </main>
 <footer class="site-footer">
@@ -86,9 +85,9 @@ remcp start</code></pre><button class="copy-button code-copy" type="button" data
     <img class="brand-mark" src="/android-chrome-192x192.png" width="30" height="30" alt="" aria-hidden="true">
     <span translate="no">ReMCP</span>
   </div>
-  <nav aria-label="Footer"><a href="/docs">Docs</a><a href="/docs#install">Install</a><a href="/docs#update">Update</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a></nav>
+  <nav aria-label="Footer"><a href="/docs">Docs</a><a href="/security">Security</a><a href="/support">Support</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a></nav>
   <p>Open-source remote MCP infrastructure.</p>
 </footer>
-<script type="module" src="/copy.js?v=remcp-012"></script>
+<script type="module" src="/copy.js?v=remcp-013"></script>
 </body>
 </html>