Reachpad/reachpad-mcp

reachpad lets Claude, Codex and other coding agents build full-stack apps in
persistent workspaces and share them by link, without a separate deployment. A
workspace is a cloud development computer an agent operates itself: a repo, a
filesystem, installed dependencies and build state that all survive between
calls, not an ephemeral sandbox that forgets. Processes are the exception; see
below.
This is the MCP server. It lets Claude, ChatGPT, Cursor, OpenCode or your own
agent create a workspace, run commands in it, fork it, and come back to it
later, without a developer keeping a laptop open for them.
- **It persists.** Pause it and the disk is sealed; the next call boots from
that seal with the files, installs and git state intact, rather than
rebuilding. Processes are the exception: a start is always a cold boot.
- **It forks.** Twenty attempts from one prepared state cost a delta each, not
twenty rebuilds — because the workspace is a snapshot chain, not a machine.
- **It can keep secrets out of the workspace.** A brokered credential is called at
the boundary on your behalf and its value never enters the workspace, the
log or the store. A credential written into the workspace instead is
readable there, by design.
- **It is agent-agnostic.** The REST API is canonical; this server, the SDK and
the CLI are translations of it. Bring your own agent.
The API is the product boundary, not a web UI: reachpad.dev.
Install
In Claude Code:
Two transports, one implementation
stdio is what a local client talks to; Streamable HTTP is what a remote
connector talks to. Same tools, same behaviour — added rather than forked,
because two implementations of one surface is how they drift.
The HTTP side answers **405 to GET**: every tool here is request/response, and
the spec permits declining the server-initiated stream rather than holding a
connection open for traffic that never comes. There are **no sessions** —
nothing is held across calls that a restart could not rebuild. And it carries
**no credential of its own**: whatever authorizes the HTTP request is what
authorizes reachpad.
It is **authenticated by default**. Set REACHPAD_MCP_HTTP_TOKEN and that is
the bearer token; set nothing and one is generated for the run and printed on
stderr, because a port that bridges to your account with run_command behind
it should not be open to every other process on the machine:
Serving with no authentication is still available and is now something you say
out loud: REACHPAD_MCP_HTTP_NO_AUTH=1.
Configure
| variable | meaning |
|---|---|
| REACHPAD_ENDPOINT | your reachpad host. Plaintext http:// to anything but loopback is refused before a socket opens. |
| REACHPAD_IDENTITY_CREDENTIAL | your per-user credential. It names one account and can act for no other — the server takes the identity from the credential's own record, never from the request. |
| REACHPAD_API_KEY | optional, per-workspace scoped and revocable. When set, run_command uses it and needs no identity exchange. |
| REACHPAD_MCP_HTTP_PORT | serve HTTP instead of stdio. |
| REACHPAD_MCP_HTTP_HOST | default 127.0.0.1. This process bridges to a control plane with your credentials, so binding it to the world is a decision made on purpose, behind a proxy that terminates TLS. |
| REACHPAD_MCP_HTTP_TOKEN | bearer token, compared in constant time. Absent, one is **generated for the run and printed on stderr** — the endpoint is never unauthenticated by omission. |
| REACHPAD_MCP_HTTP_NO_AUTH | 1 serves with no authentication at all: **every caller that can reach the port is authorized**. An affirmative choice, not a default. |
| REACHPAD_MCP_ALLOWED_ORIGINS | comma-separated. A request carrying an unlisted Origin is refused — a browser cannot forge it, which closes DNS rebinding. No Origin at all is a non-browser client and is allowed. |