remote-access-mcp

List specialized task-agent profiles and their allowed capability scopes.

Create a persistent token-isolated automation rule. Trigger can be interval, tool, webhook, file, or health; actions execute through the normal policy gate.

List automations belonging only to the current token.

Show status and run counters for one owned automation.

Enable or disable one of the current token automations.

Manually trigger an owned automation rule after evaluating its conditions.

Delete one of the current token automations.

Run a bounded read-only security posture analysis for the current token.

Evaluate whether an action risk may execute at a requested autonomy level.

Create a bounded token-isolated self-healing rule for one known failure type.

List recovery rules owned by the current token.

Delete an owned recovery rule.

List token-isolated self-healing incidents.

Run one owned recovery rule once, subject to cooldown, attempt limits, autonomy, and normal tool policy.

Reset the bounded attempt counter of an owned recovery rule.

Open a public web page in a headless browser and return its title, URL, and visible text. SSRF-guarded.

Extract structured links and metadata from a public page using a headless browser.

Capture a screenshot of a public web page to a policy-allowed local path.

Begin a file change set. Mutating filesystem tools can attach to it so rollback also handles created and deleted paths.

Register a path in a change set by capturing its current state. Missing paths are tracked so rollback removes files created later.

Show a change set and its captured pre-mutation states.

Commit a change set. The recorded backups remain until explicit cleanup.

Idempotently restore every captured path. Created paths are removed; deleted or modified paths are restored. A crash during rollback leaves rolling_back state so the operation can be resumed.

Show context-engine mode, cache, memory and byte-saving statistics for the current token.

Return recent compact task memory for the current token only.

Save a context snapshot for the current token and return a short snapshot id.

Compare text with a saved context snapshot and return a compact line diff.

Compact arbitrary text to an explicit context-character budget.

Clear this token's local context cache and task memory.

Run a database query using an installed mysql, psql, or redis-cli client. Credentials are read from a named environment variable and never returned.

Inspect database schema using an installed mysql or psql client. Credentials stay in an environment variable.

Collect a structured system diagnostic snapshot: CPU, memory, load, uptime and disk summary.

Diagnose a service using status and recent journal/log output.

List a directory. Policy-checked.

Read a UTF-8 text file. Policy-checked.

Create or overwrite a file with UTF-8 text content. Policy-checked.

Replace exact text inside a file. Policy-checked.

Delete a file or a directory tree. Policy-checked locally. Destructive.

Recursive regex search under a directory. Policy-checked. Returns file:line:match.

Stat a file or directory: size, timestamps, permissions, owner. Policy-checked locally.

Run git commands in a repository (verbs whitelisted, options validated). Policy-checked.

Outbound HTTP request. SSRF-guarded: private/metadata ranges refused. 20s timeout.

Check if a TCP port is reachable on an external host. Refuses internal ranges. 5s timeout.

Probe availability and versions of Docker, kubectl, and cloudflared without changing the host.

List Docker containers. Read-only and shell-free.

Inspect one Docker container by name or ID.

Read recent Docker container logs.

Start, stop, or restart one Docker container. Requires mutation permission.

Read Kubernetes resources with kubectl get. No arbitrary kubectl flags.

Describe a Kubernetes resource using a fixed kubectl command.

Read recent logs from a Kubernetes pod/container.

Inspect cloudflared version and configured tunnel visibility. Never returns credentials.

Get the persisted developer profile for a project.

List project profiles belonging to the current token.

Persist a project profile under RAMCP data, isolated to the current token.

Build a lightweight reverse dependency graph and identify source files impacted by changes.

Read-only Git intelligence: status, recent history, changed files, branches and remotes.

Read a GitHub repository summary using owner/name.

List GitHub issues for a repository. Read-only.

Read a GitHub pull request and its changed files.

List Sentry projects available to the configured token.

List recent Sentry issues for an organization/project.

Inspect one Sentry issue.

Report Codebase Memory isolation, Context7 proxy and Context Mode local compatibility.

Run a shell command asynchronously in the local worker pool. Returns a job id.

Get status and recent output of a background job.

Read accumulated stdout/stderr from a background job.

List background jobs belonging to the current token.

Cancel a queued or running background job.

Queue multiple shell commands for parallel execution by the shared worker pool. Concurrency is bounded globally.

Last N lines of a text log file. Policy-checked. No follow (MCP is request/response).

Regex search in a log file, newest-first, with context lines. Policy-checked.

Query system logs for a service. journalctl on Linux, log show on macOS, Get-EventLog on Windows.

Start a persistent periodic health watcher for CPU/memory thresholds. Alerts are emitted through configured webhooks and survive gateway restart.

List active persistent health watchers for the current token.

Stop a persistent health watcher.

Show gateway environment variables with secrets masked. Read-only.

Inspect the local nginx configuration: parsed vhosts, enabled sites, upstreams. Read-only.

List installed packages. Auto-detects apt / brew / winget / choco, falls back to global npm.

Install a package using the platform manager (apt/brew/winget/choco) or npm -g for scoped names.

Remove a package. Refuses packages the gateway itself depends on.

Create a multi-step task plan the AI can track. Steps can be marked done via task_status.

Show a task plan, or mark steps done by index (1-based).

Snapshot files (copy) before a risky change. Roll back with rollback_changes. Policy-checked.

Restore files from a snapshot. Policy-checked.

List installed Remote Access MCP plugins and integrity verification status.

Install a local plugin after validating its manifest, filesystem tree and integrity fingerprint.

Remove an installed local plugin and its integrity record.

Show this token's path policy and shell flag.

Grant this token access to a directory path.

Revoke this token's access to a directory path.

Check whether shell command execution is allowed for this token.

Summarize a project: languages, file counts, LOC, entry points, manifests, frameworks. Policy-checked.

Quick health check: git dirty state, huge files, missing README, TODO/FIXME density. Policy-checked.

Return the current system resource as structured JSON.

Discover only the capabilities available to the current token. Use query/category/cost to keep context small.

Run multiple independent read-only tool calls in parallel. Maximum 8 calls; mutating tools are rejected.

Schedule a shell command: one-shot at an ISO time, or recurring every N seconds. Shell must be enabled.

List all scheduled tasks with their next run times.