Security

Security model.

ReMCP is remote access infrastructure. Account identity, device credentials and tool risk are kept separate so each layer can be revoked independently.

Account identity

The hosted service uses Firebase Authentication with Google and GitHub sign-in. ReMCP does not provide hosted email/password sign-in. MCP authorization is scoped to the authenticated ReMCP account.

Device pairing

Pairing commands contain short-lived, single-use codes. A successfully paired computer receives its own random device credential; the server stores only a one-way hash of that credential.

Network model

The local agent opens an outbound WSS connection to the relay. The computer does not need a public IP address or inbound listening port.

MCP authorization

The public MCP endpoint uses OAuth authorization code flow with PKCE S256. Access tokens are short-lived and refresh credentials rotate on use.

Tool risk

MCP tool descriptors declare read-only, destructive and open-world hints. Read-only tools such as read_file, list_directory, hash_file and get_system_info do not change device state. File writes, edits, archives, process execution and termination do change local state and are marked destructiveHint: true; terminal commands can also reach external systems, which is why start_process and interact_with_process are marked openWorldHint: true.

A tool call executes as soon as the model makes it: the user request is the authorization. The device runtime also refuses to terminate the process group that hosts it, so a model cannot cut its own connection, and it can warn about or refuse catastrophic host-level commands when the device operator configures that.

Review sandbox

The hosted service provides an isolated review-sandbox device for evaluation. It holds a per-account scratch workspace, never touches any real computer, and permits only pwd, ls, cat and echo through terminal execution. Devices you pair yourself are unaffected by those limits.

Revocation

Revoke a paired device from the workspace if it is lost, retired or no longer trusted. Revoked device credentials cannot reconnect.