remote-mcp
An MCP server that lets you execute commands, manage files, run persistent shell sessions, transfer large files, and control background processes on remote machines via a lightweight HTTP agent, useful when SSH/WinRM/SMB are unavailable.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sch246
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
remote_hostsList configured remote hosts and which one is active (the default for tools called without a `host`).
remote_readRead a file from a remote host and return its text content. For binary files or large payloads use remote_download instead.
remote_writeWrite a UTF-8 text file to a remote host. Capped at 8 MiB — use remote_upload for larger files.
remote_editApply a targeted text edit to a file on a remote host. old_text must occur exactly once in the file, else the edit fails (same semantics as the local edit tool).
remote_bashRun a one-off shell command on a remote host and return stdout/stderr/exit code. Windows targets default to cmd.exe. For long-running or stateful work use remote_spawn / remote_shell_exec.
remote_shell_execExecute a command in a persistent remote shell session. Unlike remote_bash (one-shot), state persists across calls: cd, env vars, virtualenvs, REPL state. The session is lazily created on first use; a 404/410 (agent restarted) is recovered by re-opening once. On timeout the output captured so far is…
remote_shellManage persistent remote shell sessions. action: list | peek | close | input | interrupt | resize | relabel. Unlike remote_shell_exec this does NOT auto-create sessions — a session must exist first (list to see open ones).
remote_uploadStream a local file to a remote host with end-to-end sha256 verification. local_path is an absolute/relative path on THIS machine; remote_path is a remote path sent verbatim. Use for large files (over ~8 MiB).
remote_downloadStream a remote file to a local path with end-to-end sha256 verification. Local parent directories are auto-created. local_path is on THIS machine; remote_path is a remote path sent verbatim.
remote_envDescribe a remote host: OS, platform, shells, and installed tools with versions. Run this once at the start of remote work to know what's there.
remote_spawnStart a long-running background process on a remote host and return its pid immediately. Use `stdout` to name a file for output capture; otherwise output is silently discarded. Monitor with remote_proclist, stop with remote_kill. The process survives this tool call.
remote_proclistList processes started via remote_spawn on a remote host. Only shows processes spawned through THIS agent, not arbitrary OS processes.
remote_killStop a process previously started via remote_spawn on a remote host. Refuses PIDs the agent doesn't track. signal: TERM (graceful on POSIX) or KILL (Windows always force-kills regardless).
remote_shutdownCleanly shut down the agent.py process on the remote host (NOT the OS). Designed for hot-reloading a new agent.py. After it runs, the host is unreachable until agent.py is restarted. Use with extreme caution.
REMOTE_AGENT_CONFIG环境变量覆盖配置路径。REMOTE_AGENT_HOST环境变量覆盖默认主机（优先级：显式 host= 参数 > 环境变量 > 配置 active）。REMOTE_AGENT_TOKEN它会把自己的 token 写到脚本旁边的 agent.token 文件（或设环境变量 ）。这个 token 要填进下面的配置里。PI_REMOTE_AGENT_TOKENREMOTE_AGENT_TOKEN — 覆盖 agent 的 token（旧名 仍兼容）。LOGNAMETool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
14/14 tools missing one or more hints — remote_hosts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); remote_read (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); remote_write (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +11 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Destructive tools are labelled
1 tool perform destructive updates without destructiveHint — remote_download deletes at line 488 (os.remove(tmp))
Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.
Tool inputs are validated
13/14 tool handlers declare input schemas (93%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 3/14 tool handlers wrap calls in try/catch (21%)
Wrap each tool handler body in try/catch and return a structured error response.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sch246/remote-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check