@remcp/runtime 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+## 0.2.0
+
+First feature-complete first-party release. ReMCP no longer needs to install an upstream MCP server
+on a user's computer.
+
+Tools (23, up from 19):
+
+- add `copy_file` with an explicit `overwrite` flag;
+- add `wait_for_process_output` so a model can wait for a pattern instead of polling
+  `read_process_output`;
+- add read-only `get_runtime_info` and `get_runtime_stats`;
+- `edit_block` falls back to whitespace-tolerant matching when the exact block is not found, reports
+  when it did, and still refuses ambiguous matches; `allow_fuzzy: false` keeps it strict.
+
+Security:
+
+- `allowedRoots` is now enforced against the resolved real path of the deepest existing ancestor.
+  Before this release a symlink inside an allowed root (`<allowed>/link -> /etc`) passed the lexical
+  prefix check and allowed reads, writes, searches, and listings outside the allowed directories.
+- add a built-in catastrophic-command guardrail (`dangerousCommands: block|warn|allow`) covering
+  filesystem formatting, raw block-device writes, repartitioning, host power control, fork bombs,
+  root-path recursive deletion, root chmod/chown, history wiping, and Windows disk destruction;
+- add `maxWriteBytes` so a single write cannot fill the disk through the relay;
+- `kill_process` refuses the ReMCP agent process in addition to pid 1 and the runtime itself;
+- blocked-command matching is case-insensitive and whitespace-normalized.
+
+Usage metrics:
+
+- opt-out metrics for tool names, durations, outcomes, and session counts, with a whitelisted event
+  schema that cannot carry paths, commands, arguments, or output;
+- delivered as an MCP notification to the paired agent only - no telemetry endpoint, no install ping,
+  no postinstall script, no third-party processor, no remote feature flags;
+- one-time notice on first run, `--describe` reports the state, `remcp telemetry off` disables it.
+
+## 0.1.0
+
+Initial runtime: 19 tools for files, search, terminal sessions, and processes, with one dependency
+(`@modelcontextprotocol/sdk`), no postinstall script, and no network calls.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anton Baider
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,157 @@
+# ReMCP local runtime
+
+`@remcp/runtime` is the local device runtime for [ReMCP](https://remcp.delio24.com). It is an MCP
+server that runs on a computer you paired with ReMCP and executes the file, search, terminal, and
+process tools that the hosted ReMCP MCP endpoint exposes to ChatGPT and Codex.
+
+The ReMCP device agent starts this runtime as a child process and talks to it over stdio. The runtime
+never talks to the network on its own: it only answers the paired agent, which holds the device
+credential you can revoke at any time.
+
+## Install
+
+The runtime is installed automatically by the ReMCP device client:
+
+```bash
+npm install -g @remcp/remcp
+remcp install
+```
+
+To run it directly:
+
+```bash
+npx @remcp/runtime --describe   # version, limits, configuration, telemetry state
+npx @remcp/runtime --print-tools
+npx @remcp/runtime              # MCP server over stdio
+```
+
+## Tools
+
+23 tools, all implemented in this repository.
+
+| Tool | Behavior |
+| --- | --- |
+| `read_file`, `read_multiple_files` | Read text files, with line paging and per-file errors in batch reads. |
+| `list_directory`, `get_file_info` | Inspect directory contents and file metadata. |
+| `write_file`, `edit_block` | Create, replace, or append file content; apply an exact-context text edit with a whitespace-tolerant fallback. |
+| `create_directory`, `move_file`, `copy_file` | Create directories; move, rename, or copy without overwriting an existing path unless asked. |
+| `start_search`, `get_more_search_results`, `stop_search`, `list_searches` | Streaming filename and content search with pagination, using `rg` when it is installed. |
+| `start_process`, `read_process_output`, `wait_for_process_output`, `interact_with_process`, `force_terminate`, `list_sessions` | Run and drive terminal sessions, including REPLs, with pattern waits instead of polling. |
+| `list_processes`, `kill_process` | Inspect and terminate operating-system processes. |
+| `get_runtime_info`, `get_runtime_stats` | Read-only introspection of configuration, limits, guardrails, and local counters. |
+
+There is deliberately no `set_config_value`: a model must not be able to rewrite its own device
+limits. Configuration is file- and environment-based, owned by the person at the computer.
+
+`--print-tools` prints the exact JSON contract (schemas and annotations) the runtime advertises, and
+`src/catalog.mjs` is the single source of truth for it.
+
+## Usage metrics
+
+Usage metrics are **opt-out**, matching the ReMCP client. They cover tool names, durations, outcomes,
+coarse error classes, and session counts. They never include file paths, file contents, command
+strings, tool arguments, or tool output - the event schema is a whitelist, so a tool cannot leak
+those fields even by accident.
+
+Transport is the point that matters: the runtime has **no telemetry endpoint**. Events are emitted as
+an MCP notification (`notifications/remcp/telemetry`) to the agent that started the runtime, and the
+agent forwards them over the WebSocket connection it already holds to your own ReMCP account. There
+is no install ping, no postinstall script, no third-party processor, no remote feature flags, and no
+A/B assignment.
+
+Turn it off in any of these ways:
+
+```bash
+remcp telemetry off                       # the ReMCP client writes both config files
+export REMCP_RUNTIME_DISABLE_TELEMETRY=1  # environment
+```
+
+```json
+{ "telemetryEnabled": false }
+```
+
+in `~/.config/remcp/runtime.json`. `--describe` always reports the current state.
+
+## Safety model
+
+- **No network calls.** The runtime opens no sockets. Every byte it emits goes to the paired agent.
+- **Symlink-aware confinement.** `allowedRoots` is enforced against the resolved real path of the
+  deepest existing ancestor, not against the lexical string, so `<allowed>/link -> /etc` cannot be
+  used to read or write outside the allowed directories.
+- **No silent overwrites.** `move_file` fails when the destination exists; `copy_file` requires
+  `overwrite: true`; `edit_block` fails unless the number of matched blocks equals
+  `expected_replacements`.
+- **Catastrophic-command guardrail.** Commands that format filesystems, write raw block devices,
+  repartition disks, power off the host, fork-bomb, or recursively destroy a root path are refused
+  before they run (`dangerousCommands: block`, the default). `warn` runs them and reports the match;
+  `allow` disables the built-in list. User `blockedCommands` entries are always enforced.
+- **Secret masking.** `list_processes` masks command arguments that look like tokens, passwords, or
+  API keys before returning them.
+- **Bounded everything.** Tool results are capped (`maxOutputBytes`), writes are capped
+  (`maxWriteBytes`), buffered session output is capped (`maxBufferedLines`), and reads are paged.
+- **Protected processes.** `kill_process` refuses pid 1, the runtime itself, and the ReMCP agent that
+  hosts it.
+
+These are guardrails, not an operating-system sandbox. A user who can run a shell can reach anything
+their account can reach; use a container, a VM, or a dedicated user account when that matters.
+
+ReMCP device credentials are scoped to the paired computer and can be revoked from the ReMCP
+workspace; revoking a device disconnects the agent that spawns this runtime.
+
+## Configuration
+
+Optional settings live in `~/.config/remcp/runtime.json` (override the directory with
+`REMCP_RUNTIME_CONFIG_DIR`):
+
+```json
+{
+  "name": "workstation",
+  "allowedRoots": ["~/projects", "/srv/data"],
+  "blockedCommands": ["rm -rf /", "shutdown"],
+  "dangerousCommands": "block",
+  "telemetryEnabled": true,
+  "maxOutputBytes": 1048576,
+  "maxReadLines": 2000,
+  "maxBufferedLines": 50000,
+  "maxWriteBytes": 8388608,
+  "defaultShell": "/bin/bash"
+}
+```
+
+Every value can also be set with an environment variable: `REMCP_RUNTIME_ALLOWED_ROOTS`,
+`REMCP_RUNTIME_BLOCKED_COMMANDS`, `REMCP_RUNTIME_DANGEROUS_COMMANDS`, `REMCP_RUNTIME_TELEMETRY`,
+`REMCP_RUNTIME_DISABLE_TELEMETRY`, `REMCP_RUNTIME_MAX_OUTPUT_BYTES`, `REMCP_RUNTIME_MAX_READ_LINES`,
+`REMCP_RUNTIME_MAX_BUFFERED_LINES`, `REMCP_RUNTIME_MAX_WRITE_BYTES`, `REMCP_RUNTIME_SHELL`,
+`REMCP_RUNTIME_NAME`.
+
+`allowedRoots` is empty by default, which means the paired device can reach anything the operating
+system user running the agent can reach. Set it when you want the device to be scoped to specific
+directories.
+
+## Session behavior
+
+Terminal sessions and searches live in memory for the lifetime of the runtime process. They end when
+the agent restarts, and exited sessions are dropped 30 minutes after they finish.
+
+## Development
+
+```bash
+npm install
+npm run check
+npm test
+```
+
+## Relationship to other MCP servers
+
+This runtime is an independent implementation written for ReMCP. It is not a fork of, and shares no
+code with, Desktop Commander or any other MCP server. Compared with
+[DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP) it keeps the same core
+remote-computer workflow while dropping the parts ReMCP does not want on a user's machine: 34 runtime
+dependencies (Supabase, Puppeteer/md-to-pdf, sharp, exceljs, Tiptap), the install-tracking postinstall
+script, remote feature flags and A/B tests, unredacted local tool logs, URL fetching in `read_file`,
+and `set_config_value`. What it adds is symlink-aware confinement, the catastrophic-command
+guardrail, `copy_file`, pattern waits, whitespace-tolerant edits, and read-only introspection.
+
+## License
+
+MIT.

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@remcp/runtime",
+  "version": "0.2.0",
+  "description": "First-party ReMCP local device runtime: file, search, terminal and process tools over MCP for computers paired with ReMCP.",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://remcp.delio24.com",
+  "author": "Anton Baider",
+  "bin": {
+    "remcp-runtime": "src/index.mjs"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "scripts": {
+    "start": "node src/index.mjs",
+    "check": "node scripts/check.mjs",
+    "test": "node --test test/*.test.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/antonbaider/remcp-runtime.git"
+  },
+  "bugs": {
+    "url": "https://github.com/antonbaider/remcp/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "remcp",
+    "remote",
+    "terminal",
+    "filesystem",
+    "self-hosted"
+  ]
+}

package/src/catalog.mjs

@@ -0,0 +1,363 @@
+import { fileToolHandlers } from './tools/files.mjs';
+import { searchToolHandlers } from './tools/search.mjs';
+import { terminalToolHandlers } from './tools/terminal.mjs';
+import { systemToolHandlers } from './tools/system.mjs';
+import { statsToolHandlers } from './tools/stats.mjs';
+
+const readOnly = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false };
+const readOnlyNonIdempotent = { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: false };
+const additive = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false };
+const mutating = { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false };
+const command = { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true };
+
+export const toolDefinitions = [
+  {
+    name: 'read_file',
+    title: 'Read file',
+    description: 'Read a text file on this computer. Use offset and length to page through large files; a negative offset reads from the end of the file.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to read. Relative paths resolve against the runtime working directory.' },
+        offset: { type: 'number', description: 'Zero-based first line to read. Negative values read the last N lines.' },
+        length: { type: 'number', description: 'Maximum number of lines to return.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.read_file,
+  },
+  {
+    name: 'read_multiple_files',
+    title: 'Read multiple files',
+    description: 'Read several text files in one call. Each file is returned separately and a failure to read one file does not stop the others.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        paths: { type: 'array', items: { type: 'string' }, description: 'Absolute paths of the files to read, at most 50 per call.' },
+      },
+      required: ['paths'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.read_multiple_files,
+  },
+  {
+    name: 'list_directory',
+    title: 'List directory',
+    description: 'List the files and directories at a path. Entries are prefixed with [DIR], [FILE], or [LINK]; depth controls how many directory levels are included.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the directory to list.' },
+        depth: { type: 'number', description: 'Directory levels to list, from 1 to 5. Default 1.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.list_directory,
+  },
+  {
+    name: 'get_file_info',
+    title: 'Get file info',
+    description: 'Return metadata for a file or directory: type, size, timestamps, permissions, and for small text files the line count.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path to inspect.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.get_file_info,
+  },
+  {
+    name: 'write_file',
+    title: 'Write file',
+    description: 'Create a file or replace its full content. Parent directories are created automatically. Use mode "append" to add to the end instead of replacing the file.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to write.' },
+        content: { type: 'string', description: 'Full file content, or the text to append.' },
+        mode: { type: 'string', enum: ['rewrite', 'append'], description: 'rewrite replaces the file content, append adds to the end. Default rewrite.' },
+      },
+      required: ['path', 'content'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.write_file,
+  },
+  {
+    name: 'edit_block',
+    title: 'Edit file',
+    description: 'Replace an exact block of text in a file. Provide enough surrounding context to make old_string unique; the call fails unless the number of matches equals expected_replacements. When the exact text is not found, a whitespace-tolerant match is attempted and reported.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        file_path: { type: 'string', description: 'Absolute path of the file to edit.' },
+        old_string: { type: 'string', description: 'Exact existing text to replace.' },
+        new_string: { type: 'string', description: 'Replacement text.' },
+        expected_replacements: { type: 'number', description: 'Number of matches required for the edit to apply. Default 1.' },
+        allow_fuzzy: { type: 'boolean', description: 'Allow a whitespace-tolerant fallback when the exact text is not found. Default true.' },
+      },
+      required: ['file_path', 'old_string', 'new_string'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.edit_block,
+  },
+  {
+    name: 'create_directory',
+    title: 'Create directory',
+    description: 'Create a directory, including any missing parent directories. Succeeds when the directory already exists.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the directory to create.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: additive,
+    handler: fileToolHandlers.create_directory,
+  },
+  {
+    name: 'move_file',
+    title: 'Move or rename',
+    description: 'Move or rename a file or directory. The call fails when the destination already exists, so nothing is overwritten.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        source: { type: 'string', description: 'Absolute path to move.' },
+        destination: { type: 'string', description: 'Absolute destination path.' },
+      },
+      required: ['source', 'destination'],
+      additionalProperties: false,
+    },
+    annotations: additive,
+    handler: fileToolHandlers.move_file,
+  },
+  {
+    name: 'copy_file',
+    title: 'Copy file',
+    description: 'Copy one file to a new path. The call fails when the destination exists unless overwrite is true. Directories are not copied recursively.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        source: { type: 'string', description: 'Absolute path of the file to copy.' },
+        destination: { type: 'string', description: 'Absolute destination path.' },
+        overwrite: { type: 'boolean', description: 'Replace the destination when it already exists. Default false.' },
+      },
+      required: ['source', 'destination'],
+      additionalProperties: false,
+    },
+    annotations: additive,
+    handler: fileToolHandlers.copy_file,
+  },
+  {
+    name: 'start_search',
+    title: 'Start search',
+    description: 'Start a filename or content search on this computer and return the first results. Content searches return "path:line: text" rows. Use get_more_search_results to page and stop_search to stop a long search.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the directory or file to search.' },
+        pattern: { type: 'string', description: 'Regular expression for content searches, or a glob such as "*.ts" when searchType is files.' },
+        searchType: { type: 'string', enum: ['content', 'files'], description: 'Search file contents (default) or file names.' },
+        filePattern: { type: 'string', description: 'Optional relative glob that limits which files are searched, such as "*.ts".' },
+        ignoreCase: { type: 'boolean', description: 'Case-insensitive content matching.' },
+        maxResults: { type: 'number', description: 'Stop the search after this many results. Default 200.' },
+        includeHidden: { type: 'boolean', description: 'Include hidden files and directories.' },
+        includeIgnored: { type: 'boolean', description: 'Also search directories normally skipped, such as node_modules, dist, build, and virtualenvs.' },
+        contextLines: { type: 'number', description: 'Number of context lines to return around each content match, up to 10.' },
+        literalSearch: { type: 'boolean', description: 'Treat the pattern as literal text instead of a regular expression.' },
+      },
+      required: ['path', 'pattern'],
+      additionalProperties: false,
+    },
+    annotations: readOnlyNonIdempotent,
+    handler: searchToolHandlers.start_search,
+  },
+  {
+    name: 'get_more_search_results',
+    title: 'Get more search results',
+    description: 'Read more results from a search started with start_search. Offset is zero-based; a negative offset returns the last N results.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        sessionId: { type: 'string', description: 'Search id returned by start_search.' },
+        offset: { type: 'number', description: 'Zero-based first result to return. Negative values read from the end.' },
+        length: { type: 'number', description: 'Maximum number of results to return. Default 100.' },
+      },
+      required: ['sessionId'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: searchToolHandlers.get_more_search_results,
+  },
+  {
+    name: 'stop_search',
+    title: 'Stop search',
+    description: 'Stop a running search. Results collected so far stay readable until the search is cleaned up.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        sessionId: { type: 'string', description: 'Search id returned by start_search.' },
+      },
+      required: ['sessionId'],
+      additionalProperties: false,
+    },
+    annotations: additive,
+    handler: searchToolHandlers.stop_search,
+  },
+  {
+    name: 'list_searches',
+    title: 'List searches',
+    description: 'List active and recent searches on this computer with their status and result counts.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    annotations: readOnly,
+    handler: searchToolHandlers.list_searches,
+  },
+  {
+    name: 'start_process',
+    title: 'Start process',
+    description: 'Run a shell command on this computer and return its initial output. The process keeps running so read_process_output or interact_with_process can be used later. Commands can change local or external state.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        command: { type: 'string', description: 'Shell command to run.' },
+        timeout_ms: { type: 'number', description: 'How long to wait for initial output before returning, in milliseconds. Default 1000.' },
+      },
+      required: ['command'],
+      additionalProperties: false,
+    },
+    annotations: command,
+    handler: terminalToolHandlers.start_process,
+  },
+  {
+    name: 'read_process_output',
+    title: 'Read process output',
+    description: 'Read buffered output from a session started with start_process. Without an offset it returns output produced since the previous read.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        pid: { type: 'number', description: 'Session pid returned by start_process.' },
+        offset: { type: 'number', description: 'Zero-based line number to start from, counted across everything the session has produced; a negative value reads the last N lines. Omit for new output. Lines evicted by the buffer cap are no longer available.' },
+        length: { type: 'number', description: 'Maximum number of lines to return.' },
+        timeout_ms: { type: 'number', description: 'How long to wait for new output when no offset is given, in milliseconds.' },
+      },
+      required: ['pid'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: terminalToolHandlers.read_process_output,
+  },
+  {
+    name: 'interact_with_process',
+    title: 'Interact with process',
+    description: 'Send one line of input to a running session and return the output it produces. Use this for REPLs and other interactive commands.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        pid: { type: 'number', description: 'Session pid returned by start_process.' },
+        input: { type: 'string', description: 'Line of input to send; a newline is appended.' },
+        timeout_ms: { type: 'number', description: 'How long to wait for the response, in milliseconds. Default 1000.' },
+      },
+      required: ['pid', 'input'],
+      additionalProperties: false,
+    },
+    annotations: command,
+    handler: terminalToolHandlers.interact_with_process,
+  },
+  {
+    name: 'wait_for_process_output',
+    title: 'Wait for process output',
+    description: 'Wait until output from a running session matches a regular expression or literal string, then return the output collected since the previous read. Use this instead of polling read_process_output in a loop.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        pid: { type: 'number', description: 'Session pid returned by start_process.' },
+        pattern: { type: 'string', description: 'Regular expression or literal text to wait for.' },
+        timeout_ms: { type: 'number', description: 'How long to wait before returning the output collected so far, in milliseconds. Default 10000.' },
+      },
+      required: ['pid', 'pattern'],
+      additionalProperties: false,
+    },
+    annotations: readOnlyNonIdempotent,
+    handler: terminalToolHandlers.wait_for_process_output,
+  },
+  {
+    name: 'force_terminate',
+    title: 'Stop session',
+    description: 'Stop a session started with start_process, escalating from SIGTERM to SIGKILL when it does not exit.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        pid: { type: 'number', description: 'Session pid returned by start_process.' },
+      },
+      required: ['pid'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+    handler: terminalToolHandlers.force_terminate,
+  },
+  {
+    name: 'list_sessions',
+    title: 'List sessions',
+    description: 'List terminal sessions started during this ReMCP runtime session with their status and how long they have been running.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    annotations: readOnly,
+    handler: terminalToolHandlers.list_sessions,
+  },
+  {
+    name: 'list_processes',
+    title: 'List processes',
+    description: 'List running operating-system processes on this computer, highest CPU first, with pid, parent pid, CPU and memory usage, and command. Values that look like secrets are masked.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        limit: { type: 'number', description: 'Maximum number of processes to return. Default 100, maximum 1000.' },
+      },
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: systemToolHandlers.list_processes,
+  },
+  {
+    name: 'kill_process',
+    title: 'Kill process',
+    description: 'Terminate an operating-system process by pid. Terminates the process and its children on Windows.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        pid: { type: 'number', description: 'Process id to terminate.' },
+      },
+      required: ['pid'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+    handler: systemToolHandlers.kill_process,
+  },
+  {
+    name: 'get_runtime_info',
+    title: 'Get runtime info',
+    description: 'Report this device runtime: version, configuration, allowed roots, command policy, output limits, and whether usage metrics are enabled. Read-only; configuration cannot be changed through MCP.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    annotations: readOnly,
+    handler: statsToolHandlers.get_runtime_info,
+  },
+  {
+    name: 'get_runtime_stats',
+    title: 'Get runtime stats',
+    description: 'Report local counters for this runtime session: tool calls and failures, blocked commands, active terminal and search sessions, and usage-metric queue state.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    annotations: readOnly,
+    handler: statsToolHandlers.get_runtime_stats,
+  },
+];
+
+export const toolHandlers = new Map(toolDefinitions.map(definition => [definition.name, definition]));