GitHub - Reachpad/reachpad-mcp: MCP server for reachpad — give any coding agent a persistent cloud development environment it can create, run commands in, fork and resume. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
Reachpad
reachpad-mcp
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Latest commit
History<br>17 Commits<br>17 Commits
Folders and files<br>NameNameLast commit message<br>Last commit date<br>.github/workflows
.github/workflows
src
src
test
test
.gitignore
.gitignore
Dockerfile
Dockerfile
LICENSE
LICENSE
README.md
README.md
glama.json
glama.json
package.json
package.json
server.json
server.json
View all files
Repository files navigation
@reachpad/mcp
Development infrastructure for coding agents. A reachpad environment is a<br>cloud development computer an agent operates itself: a repo, a filesystem,<br>installed dependencies and build state that all survive between calls — not an<br>ephemeral sandbox that forgets. Processes are the exception; see below.
This is the MCP server. It lets Claude, ChatGPT, Cursor, OpenCode or your own<br>agent create an environment, run commands in it, fork it, and come back to it<br>later, without a developer keeping a laptop open for them.
It persists. Pause it and the disk is sealed; the next call boots from<br>that seal with the files, installs and git state intact, rather than<br>rebuilding. Processes are the exception: a start is always a cold boot.
It forks. Twenty attempts from one prepared state cost a delta each, not<br>twenty rebuilds — because the environment is a snapshot chain, not a machine.
It can keep secrets out of the box. A brokered credential is called at<br>the boundary on your behalf and its value never enters the environment, the<br>log or the store. A credential written into the environment instead is<br>readable there, by design.
It is agent-agnostic. The REST API is canonical; this server, the SDK and<br>the CLI are translations of it. Bring your own agent.
The API is the product boundary, not a web UI: reachpad.dev.
Install
npx -y @reachpad/mcp # stdio, for a local client
In Claude Code:
claude mcp add reachpad -e REACHPAD_IDENTITY_CREDENTIAL=… -- npx -y @reachpad/mcp
Two transports, one implementation
npx @reachpad/mcp # stdio<br>REACHPAD_MCP_HTTP_PORT=8722 npx @reachpad/mcp # streamable http
stdio is what a local client talks to; Streamable HTTP is what a remote<br>connector talks to. Same tools, same behaviour — added rather than forked,<br>because two implementations of one surface is how they drift.
The HTTP side answers 405 to GET : every tool here is request/response, and<br>the spec permits declining the server-initiated stream rather than holding a<br>connection open for traffic that never comes. There are no sessions —<br>nothing is held across calls that a restart could not rebuild. And it carries<br>no credential of its own : whatever authorizes the HTTP request is what<br>authorizes reachpad.
Configure
variable<br>meaning
REACHPAD_ENDPOINT<br>your reachpad host. Plaintext http:// to anything but loopback is refused before a socket opens.
REACHPAD_IDENTITY_CREDENTIAL<br>your per-user credential. It names one account and can act for no other — the server takes the identity from the credential's own record, never from the request.
REACHPAD_API_KEY<br>optional, per-environment scoped and revocable. When set, run_command uses it and needs no identity exchange.
REACHPAD_MCP_HTTP_PORT<br>serve HTTP instead of stdio.
REACHPAD_MCP_HTTP_HOST<br>default 127.0.0.1. This process bridges to a control plane with your credentials, so binding it to the world is a decision made on purpose, behind a proxy that terminates TLS.
REACHPAD_MCP_HTTP_TOKEN<br>bearer token, compared in constant time. Absent, every caller that can reach the port is authorized , and the server says so on stderr.
REACHPAD_MCP_ALLOWED_ORIGINS<br>comma-separated. A request carrying an unlisted Origin is refused — a browser cannot forge it, which closes DNS rebinding. No Origin at all is a non-browser client and is allowed.
If several credentials are set, the narrowest wins, and a refused credential<br>is never retried under a broader one — falling back would be privilege<br>escalation nobody chose to perform.
Tools
tool<br>what it does
get_credit_balance()<br>remaining compute credits. One credit runs one standard environment for one minute.
create_environment(repo?, ref?, name?)<br>a new environment, optionally with a repository cloned into /work. Reachpad generates its display name when omitted.
list_environments()<br>your environments and how many...