rcmd runs commands on your servers without SSH, open ports or a VPN. Now your AI agent can too — scoped to the machines you name, expiring when you say, with every command it runs written down.
Still a first-class CLI for humans: exec, file copy faster than scp, tunnels that replace ssh -L, multi-target fan-out.
An agent that can run commands on production needs limits an SSH key cannot express. One command mints a token that has them.
$ rcmd agent-token --targets web1 --expires 4h --label claude
Token: tok_operator_9f2c…
Targets: web1 Expires: in 4h0m
MCP config, ready to paste — and the revoke command, right there.
An agent token must name the hosts it may touch — there is no accidental fleet-wide token. Try it on anything else and the relay refuses, and says why, so the agent stops retrying instead of hammering.
Four hours, a day, whatever the task needs. A token that outlives the job is a liability, and an agent is not around later to notice it still works.
Give a viewer token and the agent can look — list machines, check health — and cannot execute a thing. Investigation without exposure.
Every command, file transfer, tunnel and scheduled job lands in one audit trail: who, where, when, and the exit code it actually returned. Yours, your teammates', your agents'.
rcmd team revoke takes effect immediately. rcmd team list shows what can currently touch your fleet and how long each has left.
A retry loop with no backoff is the normal failure mode of an autonomous agent. The relay throttles per token and tells the caller how long to wait, so one noisy agent cannot take a host down or starve a teammate.
Speaks MCP — the 2026-07-28 revision, and the older handshake for clients that have not migrated. Works with Claude Code, Claude Desktop, and anything else that speaks MCP.
rcmd cp streams files through the relay with 2 MiB chunks, adaptive gzip, and parallel streams — benchmarked faster than scp over high-RTT links. Directories auto-tarred. No base64, no buffering.
rcmd tunnel replaces ssh -L. Expose a remote port locally through the relay — reach that database behind NAT without a VPN or a bastion.
Run one command across every server at once. rcmd exec --targets web1,web2,db1 --cmd "apt update" — results back as JSON, one per target.
rcmd mcp exposes exec, copy, health and target discovery as MCP tools, scoped by the token you hand over. Speaks the 2026-07-28 revision and the older handshake, so it works with clients that have not migrated yet. How it works.
Every command returns structured JSON — stdout, stderr, exit code, duration. Deterministic timeouts. No parsing, no guessing, no wasted tokens.
Cron without cron. rcmd cron add runs commands on a schedule from the relay — "restart nginx every day at 2am" without touching crontab on each box. Email alerts on failure.
Scoped sub-tokens with admin, operator, and viewer roles. Email invites, audit logs. Share server access without sharing your token or your SSH keys.
One curl command installs the daemon on any Linux server. No dependencies, no runtime, no config.
The daemon connects out to the relay. Zero inbound ports. Works behind NAT, CGNAT, firewalls, corporate proxies.
Run commands, copy files, open tunnels from your terminal. The relay routes everything. JSON in, JSON out.
curl -sSL https://rcmd.intrane.fr/install.sh | sh
Installs the rcmd CLI — then run rcmd signup --free --email you@company.com (no credit card) or rcmd signup --email you@company.com (Pro)
SSH requires open ports, key management, and VPN for NAT traversal. rcmd's daemon connects out to the relay — no inbound ports, no keys, no VPN. It works from anywhere.
Free gives you 3 servers on our hosted relay — no credit card, no setup. Pro removes the server limit and adds cron, tunnels, team access, alerts, and webhooks. Self-hosted is the open-source binary — you run the relay on your own VPS with everything unlocked.
Each target has a unique token. All traffic is over WebSocket with optional TLS. The relay never stores commands or output — it just routes traffic. You can also self-host the relay for full control.
Yes. rcmd was designed for AI agents. Every command returns structured JSON (stdout, stderr, exit code, duration). No parsing, no guessing, no wasted tokens.
Open an issue on GitHub or email arancibiajav@gmail.com.
Yes. No contracts, no lock-in. Your daemon keeps working with the free version if you cancel Pro.
Every machine on one page — health, history, a shell in the browser. It is a concept, not a product: whether it gets built depends on whether people want it. Two minutes to look, one click to say so.
See the concept