{"id":"134cea02-c9fc-43dd-b0cc-67110763c6ac","slug":"rmte","kind":"mcp","name":"rmte","summary":"Remote Terminal Relay & Cloud IDE","owner":"milio48","repoUrl":"https://github.com/milio48/rmte","license":"MIT","licenseTier":"permissive","trust":"community","stars":8,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-05-17T02:49:44.000Z","addedAt":"2026-10-21T17:24:56.686Z","logoUrl":"https://avatars.githubusercontent.com/u/31167054?u=d3f093541b02b7c00d6a35ef8fa4e8540b423a7b&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools"],"tags":["collaboration","e2ee","golang","multiplexer","single-binary","terminal","websocket","sshx-alternative"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T02:00:10.331Z","sample":false,"url":"https://conduits.dev/tools/rmte","language":"Go","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# RMTE β Remote Terminal Relay & Cloud IDE (v0.8.0)\n\n> \"I love sshx, but my endless curiosity to build it from scratch got the best of me π₯²\"\n\nRMTE is a secure, real-time, multi-user remote terminal sharing system and lightweight Cloud IDE. It is built entirely in Go with a centralized WebSocket relay architecture, securing all traffic with **AES-GCM 256-bit End-to-End Encryption (E2EE)**.\n\nIt allows hosts to share terminal sessions, navigate directories using a clean absolute-path File Explorer, edit files in real-time via a multi-tab Web UI, and inspect local web servers via an embedded Mini Browserβall packed into a single binary.\n\n---\n\n## Screenshots & Showcase\n\n| π±/π» Workspaces & Mobile UI | π‘οΈ Relay Admin Dashboard | π Secure Login |\n| :---: | :---: | :---: |\n| ![\"Overview](\"screenshots/overview.jpg\")
| ![\"Admin](\"screenshots/admin.jpg\")
| ![\"Login](\"screenshots/login.jpeg\")
|\n| Overview: Multi-Tab, Split IDE & Mobile | Live Traffic, Bandwidth & Session Monitor | Zero-Knowledge Auth Interface |\n\n> π‘ *Click any image to view in full resolution.*\n\n---\n\n\nβ¨ Key Features (click to expand)
\n\n* **AI Agent Gateway & Model Context Protocol (MCP) (`π€`):**\n * Direct zero-dependency **Model Context Protocol (MCP)** integration over stdio (`rmte mcp`) enabling local AI coding agents (Claude Desktop, Cursor, Claude Code, Antigravity) to work directly inside remote locked-down hosts/containers.\n * 7 powerful AI tools built-in: `rmte_exec` (synchronous execution in persistent isolated `[AI]` tab or dedicated background tabs), `rmte_read_file`, `rmte_write_file`, `rmte_upload_file`, `rmte_download_file`, `rmte_list_files`, `rmte_get_info`.\n * **Headless CLI Execution (`rmte exec`)**: Execute remote commands from local shell scripts and receive exact exit codes and clean stdout/stderr over E2EE.\n * **Read-Only Human Spectator Protection**: Live visual feedback of AI commands in the Web IDE without allowing human spectators to disrupt the AI's PTY.\n* **Embedded Web Browser Preview (`π`):**\n * Built-in mini-browser directly inside the Web IDE tab bar, allowing developers to test local web apps (Vite, Next.js, React, Bun, Python, Dufs, Go, etc.) without leaving RMTE.\n * **Relay-Assisted Reverse Proxy**: Proxies any local port via path `/p///` over the single relay port with **zero external DNS dependency** (runs on plain raw IP).\n * **Anti-Lag Transport**: Uses an isolated secondary WebSocket (`{$ws-path}-proxy`) multiplexed with `smux v2` so high-bandwidth downloads never lag the PTY terminal.\n * **Full HMR & WebSocket Hijacking**: Automatically hijacks WebSocket upgrade requests for live Hot Module Reloading.\n * **Interactive Toolbar & Responsive 390px Mobile View**: Smart address bar, navigation controls (`[β] [βΆ] [β³]`), and mobile device inspection frame.\n* **Windows Native ConPTY:**\n * Full pseudo-terminal support on Windows 10/11 using ConPTY: command history recall with arrow keys (`β` / `β`), horizontal cursor navigation (`β` / `β`), tab completion, and native ANSI color rendering.\n* **E2EE Terminal, Files, Commands & Chat (AES-GCM 256-bit):** Terminal I/O, file contents, control messages (file operations, `ai_exec`, chat) are encrypted and authenticated locally; the relay only routes ciphertext and never receives your password. Web Preview traffic and the relay-served browser UI are the remaining places where the relay must be trusted. See the security model limits below and [SECURITY.md](SECURITY.md).\n* **Single-Command Setup:** Run `rmte serve` to start a relay and host session in one process. A random password and a shareable link are printed automatically.\n* **HTTP Compatible:** Works on plain HTTP (no HTTPS required). A built-in crypto polyfill (asmcrypto.js) handles AES-GCM when `crypto.subtle` is unavailable.\n* **Shareable Links & Auto-fill UI:** Running a host session generates a web URL with pre-filled `?server=` and `?session=` parameters. The Web UI parses these and auto-focuses the password input for seamless onboarding.\n* **Modern Web Redesign:** A sleek, split-viewport interface using OKLCH atmospheric themes, Space Grotesk/Inter/JetBrains Mono typography, and portable CSS design tokens (`tokens.css`).\n* **Split-Workspace Cloud IDE:** Toggle the folder icon `π` in the browser tab bar to open a split-view workspace:\n * **Left Panel**: Advanced File Explorer with resizable drag handle (persisted across reloads).\n * **Right Panel**: Tabbed text editor powered by **CodeMirror** (syntax highlighting, line numbers, unsaved indicators `β`, direct `Ctrl + S` saving).\n * **Bottom Panel**: Interactive, multi-tab terminal shells (`+ Terminal`).\n* **Modern File Explorer & Manager:**\n * **Absolute PWD & Segment Breadcrumbs**: Displays the full host working directory with clickable path segments and a quick edit button (`βοΈ` or double-click) to type any path directly.\n * **Drag & Drop Upload & One-Click Download**: Drag files from your computer into the Explorer to upload; click the `β¬` icon to download host files locally.\n * **Parent Navigation (`..`)**: An always-visible `..` folder item allows walking backward up the host's directory structure.\n * **Inline Operations (Zero Browser Modals)**: Creating new files (`+π`) or folders (`+π`), renaming (`βοΈ`), and deleting (`π`) are performed via inline text inputs and non-intrusive confirmation strips (`[Yes] [No]`).\n * **Toast Notification HUD**: Directory and workspace errors are reported through transient, auto-dismissing inline Toasts.\n* **Host Audit Event Log (`rmte-.log`):**\n * Every session lifecycle event (host startup, client connects/disconnects, terminal tabs, and file reads/writes/creations/deletions) is securely logged to `rmte-.log` on the host machine.\n * Real-time streaming to the UI with a live unread badge and instant `π₯ Export` to download the log.\n* **Unified Sidebar & Real-Time Chat Bridge:**\n * Dedicated multi-tab sidebar for `π₯ Users` presence, `π¬ Chat` (live encrypted bridge between Web and CLI clients), and `π Activity Log`.\n* **Share Session Dialog (`π`):** Convenient modal to copy browser links or CLI join commands with one click.\n* **Dynamic Max Buffer & Relay Adaptive Clamping:**\n * Set customizable memory limits via CLI (e.g. `--buffer=5` for 5MB limits) to configure both the terminal ring buffer and the maximum allowed file sizes.\n * **Relay Adaptive Clamping (`--max-buffer`)**: Self-hosted and public relays can set a maximum buffer threshold. If a connecting host requests more memory than allowed, the relay adaptively clamps the session without rejecting the host, and enforces transport-level WebSocket frame ceilings (`SetReadLimit`) to prevent DoS.\n* **Relay Resource & DoS Protection:**\n * **Session Capacity (`--max-sessions`)**: Limits total concurrent active sessions (default: `100`, `0` = unlimited).\n * **Viewer Concurrency Ceiling (`--max-viewers`)**: Limits total active WebSocket connections per session across all viewer IDs and tabs (default: `50`, `0` = unlimited).\n * **Lean Smux Multiplexing**: Slices proxy stream buffers to 512 KB and session receive pools to 4 MB (~87.5% memory reduction).\n* **Zero-copy Binary Data Channel (Tab ID `255`):** Avoids heavy Base64 parsing overhead. Files are sent as pure, encrypted binary frames over a reserved channel.\n* **Background / Quiet Mode (`-q` / `--quiet` & `rmte stop`):**\n * Run `rmte serve` or `rmte share` as a detached background daemon. Prints the connection banner, shareable link, and PID to stdout, then immediately returns control to your shell.\n * Stop background sessions cleanly anytime using `rmte stop `.\n* **State Persistence & Auto-Reconnect:** Connection credentials live safely in `sessionStorage` for immediate recovery upon page refresh.\n* **Relay Admin Dashboard (`--admin-pass` & `--admin-path`):**\n * Built-in administrative web dashboard for self-hosted relays (`standalone`, `hybrid`, `relay`).\n * Live monitoring of active sessions, session capacity limits, connected viewers, and cumulative TX / RX network bandwidth.\n * Force-terminate sessions with one click and ban abusive IP addresses in real time.\n * Configurable dashboard route (default: `/admin`) protected against URI collision.\n\n \n\n---\n\n\nποΈ Architecture & Security Model (click to expand)
\n\n```\nβββββββββββββββββ ββββββββββββββββ βββββββββββββββββ\nβ β E2EE control β β E2EE control β β\nβ β (sealed JSON) β β (sealed JSON) β β\nβ βββββββββββββββββββΊβ ββββββββββββββββββββ€ β\nβ Host Go β β Relay Go β β Viewer JS β\nβ Workspace β E2EE terminal + β (WebSockets)β E2EE terminal + β Browser β\nβ β file (Tab 255) β β file (Tab 255) β β\nβ ββββββββββββββββββββ€ βββββββββββββββββββΊβ β\nβββββββββββββββββ (Raw Binary) ββββββββββββββββ (Raw Binary) βββββββββββββββββ\n```\n\n1. **E2EE Key Derivation**: Keys are derived locally with PBKDF2-HMAC-SHA256 (600,000 iterations) from the password, salted with the session id, then split with HKDF into separate encryption, relay-auth and preview subkeys. The relay only sees the auth subkey, so guessing a password costs a full PBKDF2 run per guess. Nothing is stored on disk or on the relay: the same session id and password always give the same keys, so a host resumes its session after a restart or reboot.\n2. **AES-GCM Binary Frames**: Terminal I/O and file contents (Tab 255) are encrypted with AES-GCM and a random 12-byte IV per frame. The frame header (direction, tab id, transfer id) is authenticated as additional data, so the relay cannot redirect, reflect or re-wrap frames.\n3. **Sealed Control Envelope**: Every viewerβhost control message (file operations, `ai_exec` and its output, tab management, presence, chat) is sealed with AES-GCM, bound to the session id and direction, and carries a per-sender sequence number plus the host's per-process epoch. The relay sees only a routing id; it cannot read, forge, reorder or replay these messages, including across host restarts.\n\n**Current limits: the relay is still trusted for the following.**\n\n* **Web Preview is not E2EE.** The browser talks HTTP to the relay, which can see preview requests, responses and cookies.\n* **The browser UI is served by the relay.** A malicious relay (or anyone on the network when using plain HTTP) can serve JavaScript that captures the password before encryption, and then act as a legitimate viewer. CLI clients (`rmte join`, `exec`, `mcp`) are not affected by this.\n* **Replay** of a captured terminal frame on the same tab is still possible (binary frames have no sequence number yet).\n* **Metadata**: the relay sees routing ids, message sizes and timing, and can drop messages or spoof its own status notices (host connected/disconnected, viewer left).\n\nWith `--allow-exec`, anyone holding the session password can run commands; prefer a relay you run yourself when browsers join.\n\n \n\n---\n\n## π¦ Installation\n\n### 1-Line Quick Install & Launch\nRun RMTE instantly without manual setup. The installer detects your OS and architecture automatically:\n\n**Linux & macOS:**\n```bash\n# 1. Download to current directory (default)\ncurl -sSf https://rmte.biz.id/install.sh | sh\n\n# 2. Run immediately without saving to current dir (uses /tmp)\ncurl -sSf https://rmte.biz.id/install.sh | sh -s run\n\n# 3. Install system-wide (~/.local/bin or /usr/local/bin)\ncurl -sSf https://rmte.biz.id/install.sh | sh -s install\n\n# 4. Download and run in one shot\ncurl -sSf https://rmte.biz.id/install.sh | sh -s download run\n\n# 5. Run immediately in background daemon (quiet)\ncurl -sSf https://rmte.biz.id/install.sh | sh -s run -q\n```\n\n**Windows (PowerShell):**\n```powershell\n# 1. Download to current directory (default)\nirm https://rmte.biz.id/install.ps1 | iex\n\n# 2. Run immediately from temp folder\n& ([scriptblock]::Create((irm https://rmte.biz.id/install.ps1))) run\n\n# 3. Install to ~/.local/bin and add to User PATH\n& ([scriptblock]::Create((irm https://rmte.biz.id/install.ps1))) install\n\n# 4. Download and run in one shot\n& ([scriptblock]::Create((irm https://rmte.biz.id/install.ps1))) download run\n\n# 5. Run immediately in background daemon (quiet)\n& ([scriptblock]::Create((irm https://rmte.biz.id/install.ps1))) run -q\n```\n\n### Pre-built Binaries\nGet the latest pre-built releases for your operating system directly from the GitHub releases page:\nπ **[RMTE GitHub Releases](https://github.com/milio48/rmte/releases)**\n\n### Build from Source\nGot Go installed (v1.21+)? Let's build the binary:\n```bash\ngit clone https://github.com/milio48/rmte.git\ncd rmte/rmte\ngo build -ldflags \"-s -w\" -o rmte\n```\n\n\nπ οΈ Development & Testing Guide (click to expand)
\n\nRMTE is designed with zero frontend dependencies. All web assets in `rmte/ui/` (`tokens.css`, `app.css`, `app.js`, `index.html`) are embedded directly into the Go binary at compile time via `//go:embed ui/*` without requiring Node.js, npm, or bundlers.\n\n1. **Run locally without building:**\n ```bash\n cd rmte/rmte\n go run . serve --dir=\"../\"\n ```\n2. **Run Unit Tests:**\n ```bash\n cd rmte/rmte\n go test -v ./...\n ```\n3. **Build Binary with Custom Version (`-ldflags`):**\n ```bash\n cd rmte/rmte\n go build -ldflags \"-s -w -X main.appVersion=0.7.6\" -o rmte\n ```\n\n \n\n---\n\n## π§ Terminology\n\n| Term | Meaning | How |\n| :--- | :--- | :--- |\n| **Relay** | The machine that **opens a port** (HTTP Web UI + WebSocket routing) | `rmte serve` |\n| **Host** | The **controlled machine** (shell + files) | `rmte serve` (standalone/hybrid) or `rmte share` |\n| **Client** | Whoever controls the host: **Web** browser or **CLI/TUI** | Shareable link or `rmte join` |\n\n## βοΈ Commands & Modes\n\n| Feature / Role | `serve --mode=standalone` *(default)* | `serve --mode=hybrid` | `serve --mode=relay` | `rmte share` / `rmte` | `rmte join` | `rmte exec` | `rmte mcp` |\n| :--- | :---: | :---: | :---: | :---: | :---: | :---: | :---: |\n| **Role Summary** | Relay + Local Host | Relay + Local Host | Dedicated Relay Only | Outbound Host | Client (TUI) | Client (Headless Exec) | Client (AI MCP Server) |\n| **Opens Listening Port** | β
Yes (8048) | β
Yes (8048) | β
Yes (8048) | β No (Outbound) | β No | β No | β No |\n| **Local PTY & Files (Host)** | β
Yes | β
Yes | β No | β
Yes | β No | β No | β No |\n| **Accepts External Hosts** | β No (Rejected) | β
Yes | β
Yes | β | β | β | β |\n| **Prints Session ID & Links** | β
Yes | β
Yes | β No | β
Yes | β | β | β |\n| **Key Flags** *(full list in Flag Reference)* | `--pass`, `--id`, `--dir`, `--allow-exec` | `--public`, `--pass`, `--id`, `--allow-exec` | `--public`, `--admin-pass`, `--max-buffer` | `--server-relay`, `--pass`, `--id`, `--allow-exec` | `--server-relay`, `--id`, `--pass` | `--server-relay`, `--id`, `--pass`, `--timeout` | `--server-relay`, `--id`, `--pass` |\n\n---\n\n## π Quick Start Guide\n\n### 0. Instant E2EE Share (Zero-Configuration)\nRun `rmte` directly without subcommands to instantly connect to the public relay `my.rmte.biz.id` with Web Preview enabled:\n```bash\n./rmte\n```\nOr run detached in the background:\n```bash\n./rmte -q\n```\nOr with custom credentials:\n```bash\n./rmte --id=\"mysession\" --pass=\"supersecret\" -q\n```\n\n### 1. Quick local session (Self-hosted standalone)\n```bash\n./rmte serve\n```\nOutput:\n```\nRMTE v0.8.0 β Mode: standalone\nββββββββββββββββββββββββββββββββββββββββββββββββ\nBind: 127.0.0.1:8048\nRmte Port: 8048\nOpen to Relay: β No\nDirectory: /workspace\nCustom Password: β No (generated: YJNhJkzGHEhc)\nSession ID: 16fd7ce2\nBuffer limit: 1 MB\nWeb Path: /\nWS Path: /ws-rmte\n\nShareable link (Web Version):\n http://localhost:8048/?server=ws%3A%2F%2Flocalhost%3A8048%2Fws-rmte&session=16fd7ce2\n\nJoin CLI / TUI Version:\n rmte join --server-relay=\"ws://localhost:8048/ws-rmte\" --id=\"16fd7ce2\" --pass=\"YJNhJkzGHEhc\"\n```\n\n### Case 1: Single VPS (self-contained)\nOne machine is both the relay and the host. External hosts are rejected.\n```bash\n./rmte serve --public --public-url=\"https://rmte.example.com\" --pass=\"supersecret123\"\n```\n```\nββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ\nβ VPS_1: RELAY + HOST (rmte serve --public) β\nβ β HTTP port 8048 (Web UI) β\nβ β WebSocket /ws-rmte (routing) β\nβ β Local shell & files β\nβ β External hosts rejected (standalone) β\nβββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββ\n βββββββββββββββΌβββββββββββββββ\n ββββΌβββ ββββΌβββ βββββΌβββββ\n β CLI β β WEB β β WEB β\n βββββββ βββββββ ββββββββββ\n join browser browser\n```\n\n### Case 2: Multi-VPS (central relay + separate hosts)\nOnly the relay opens a port. Hosts connect **outbound**, so they need no open ports.\n```bash\n# VPS_1 (relay only)\n./rmte serve --mode=relay --public --public-url=\"https://relay.example.com\"\n\n# VPS_2, VPS_3, VPS_4 (each becomes a host with its own Session ID)\n./rmte share --server-relay=\"ws://relay.example.com:8048/ws-rmte\" --pass=\"supersecret123\" --buffer=5\n```\n```\nβββββββββββββββββ βββββββββββββββββ βββββββββββββββββ\nβ VPS_2: HOST β β VPS_3: HOST β β VPS_4: HOST β\nβ (rmte share) β β (rmte share) β β (rmte share) β\nβ β no open portβ β β no open portβ β β no open portβ\nβββββββββ¬ββββββββ βββββββββ¬ββββββββ βββββββββ¬ββββββββ\n β outbound WS β β\n βββββββββββββββββββββΌββββββββββββββββββββ\n βΌ\nββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ\nβ VPS_1: RELAY (rmte serve --mode=relay --public) β\nβ β HTTP port 8048 (Web UI) β\nβ β WebSocket /ws-rmte (routing) β\nβββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββ\n βββββββββββββββΌβββββββββββββββ\n ββββΌβββ ββββΌβββ βββββΌβββββ\n β CLI β β WEB β β WEB β\n βββββββ βββββββ ββββββββββ\n join browser browser\n```\n> Want the relay machine to also be a host? Use `--mode=hybrid` instead of `--mode=relay`.\n\n### Join via CLI Client (TUI)\n```bash\n./rmte join --server-relay=\"ws://relay.example.com:8048/ws-rmte\" --id=\"a1b2c3d4\" --pass=\"supersecret123\"\n```\nYou'll enter an interactive TUI menu:\n* `[j]` **Join Tab:** Dive into the active terminal shell (Press `Ctrl + ]` to escape).\n* `[n]` **New Tab:** Spawn a concurrent shell on the host.\n* `[s]` **Switch Tab:** Hop between active terminal tabs.\n* `[c]` **Chat:** Enter the real-time chat room.\n* `[q]` **Quit:** Disconnect gracefully.\n\n### Join via Web Client\nOpen the shareable link printed by `serve`/`share` (or browse to the relay's web path β the server URL is auto-filled).\n1. Enter the E2EE **Password** and click **Establish Connection**.\n2. Toggle the folder icon `π` in the tab bar to access the workspace editor.\n3. Double-click the breadcrumb to input any absolute path directly.\n\n### π€ AI Agent Integration (MCP & Headless CLI Exec)\nYou can connect local AI coding agents (Claude Desktop, Cursor, Claude Code, Antigravity) to execute commands, read/write files, and transfer data inside remote host environments over secure E2EE with zero open inbound ports! **Fully supported on Linux, macOS, and Windows hosts.**\n\n#### 1. Enable on Remote Host:\nStart the host session with `--allow-exec`:\n```bash\n./rmte share --allow-exec\n# or for self-hosted standalone:\n./rmte serve --allow-exec\n```\n> **Platform Execution Details:**\n> - **Linux & macOS Hosts**: Commands execute inside an isolated interactive PTY shell in tab `[AI]`.\n> - **Windows Hosts**: Commands execute via headless process pipes (`pwsh.exe` $\\rightarrow$ `powershell.exe` $\\rightarrow$ `cmd.exe`) with full UTF-8 output encoding support and automatic process-tree cleanup on timeout. Live command outputs stream in real-time to the web viewer's `[AI]` spectator canvas without console prompt noise.\n> - **Non-Interactive Stdin**: Executed commands run non-interactively (stdin is non-interactive; commands requiring input should accept CLI flags or environment variables).\n\n#### 2. Headless CLI Execution (`rmte exec`):\nRun remote commands from local shell scripts and propagate exit codes:\n```bash\n# Execute command and return remote exit code:\n./rmte exec --id=\"session_id\" --pass=\"secret\" -- \"uname -a\"\n\n# Windows host example:\n./rmte exec --id=\"session_id\" --pass=\"secret\" -- \"dir\"\n\n# Launch long-running commands in a dedicated background tab:\n./rmte exec --id=\"session_id\" --pass=\"secret\" --bg --tab-name=\"DevServer\" -- \"npm run dev\"\n```\n\n#### 3. Model Context Protocol (MCP) Setup:\nConfigure your local AI coding assistant to communicate with RMTE via stdio:\n\n**Claude Desktop Configuration (`claude_desktop_config.json`):**\n```json\n{\n \"mcpServers\": {\n \"rmte\": {\n \"command\": \"rmte\",\n \"args\": [\n \"mcp\",\n \"--server-relay=wss://my.rmte.biz.id/ws-rmte\",\n \"--id=\",\n \"--pass=\"\n ]\n }\n }\n}\n```\n\n**Cursor MCP Configuration:**\nAdd a new stdio MCP server:\n- Name: `rmte`\n- Command: `rmte mcp --server-relay=wss://my.rmte.biz.id/ws-rmte --id= --pass=`\n\n**Available MCP Tools:**\n* `rmte_exec`: Run shell commands in the persistent `[AI]` tab or in dedicated background tabs.\n* `rmte_read_file`: Read UTF-8 text from remote host files.\n* `rmte_write_file`: Write or overwrite text files on the remote host.\n* `rmte_upload_file`: Upload local files from your machine to the remote host.\n* `rmte_download_file`: Download remote files to your local machine.\n* `rmte_list_files`: List directory contents on the remote host.\n* `rmte_get_info`: Inspect remote host environment metadata (OS, architecture, hostname, working directory, PID, active tabs).\n\n> π **Complete Documentation & Config Generator:** For a deep dive into security sandboxing, persistent vs background AI tabs, and interactive configuration generation for Claude Desktop and Cursor, see the **[RMTE AI & MCP Guide](https://rmte.biz.id/mcp.html)** (or [`docs/mcp.html`](docs/mcp.html)).\n\n### π‘οΈ Relay Admin Dashboard\nSelf-hosting your own relay server (`standalone`, `hybrid`, or `relay`)? You can enable the real-time web administration dashboard by specifying `--admin-pass`:\n```bash\n# Start a relay server with Admin Dashboard enabled\n./rmte serve --mode=relay --public --admin-pass=\"supersecret123\" --admin-path=\"/admin\" -q\n```\nThen navigate to `http://your-relay:8048/admin` in your browser and enter the password:\n* **Live Overview:** Real-time statistics including active sessions, connected viewers, and cumulative TX / RX bandwidth.\n* **Session Management:** Inspect active host session IDs and view connected viewer counts.\n* **Instant Termination:** Force-close suspicious or hung sessions immediately with one click (`/admin/api/terminate`).\n* **IP Banning:** Permanently ban malicious remote IP addresses in real time (`/admin/api/ban`).\n* **Custom Route:** Customize the path via `--admin-path` (e.g. `--admin-path=\"/control\"`). It cannot collide with `/p` (Web Preview), `/favicon.ico`, or the Web UI.\n\n---\n\n## π Flag Reference\n\n> This reference is kept identical to the one on [rmte.biz.id](https://rmte.biz.id/).\n\n### `rmte` & `rmte share`\nConnects outbound from your local terminal workspace to an RMTE relay. Running `rmte` without a subcommand is the same as `rmte share` with all defaults. Defaults to the public relay `wss://my.rmte.biz.id/ws-rmte`.\n\n| Flag & Aliases | Default Value | Description |\n| :--- | :--- | :--- |\n| `--server-relay`, `--server` | `wss://my.rmte.biz.id/ws-rmte` | Relay WebSocket URL. Supports secure WebSocket (`wss://`) and local/custom relays (`ws://`). |\n| `--pass`, `--password` | *Auto-generated (12 chars)* | Session password. Keys are derived from it with PBKDF2 (see SECURITY.md). Printed on startup if generated. |\n| `--pass-file` | *Disabled (empty)* | Read the password from a local file instead, keeping it out of `ps aux` listings. Permissions `0600` are checked on Unix. |\n| `--id` | *Auto-generated (8 chars)* | Custom Session ID (`a-z`, `0-9`, max 10 chars). Restarting with the same `--id` and password resumes the session. |\n| `--dir` | *Current working directory* | Initial directory for the Web File Explorer and terminal. |\n| `--sandbox`, `--dir-only` | `false` | Confine the File Explorer and file tools to `--dir` (blocks path traversal and symlink escapes). Files only: the shell is not jailed. |\n| `--buffer` | `1` (MB) | Terminal scrollback buffer and maximum file transfer size. |\n| `--max-chat` | `50` | Chat messages kept in host memory for viewers who join later (`0` disables retention). |\n| `--web-preview`, `--preview` | `true` | Embedded Web Browser Preview reverse proxy for local dev servers (e.g. ports 3000, 5173). |\n| `--preview-ports` | *Ports opened by viewers* | Fixed preview allowlist, e.g. `3000,5173,8000-8010`. Without it, the host only forwards ports a viewer opens explicitly (logged). |\n| `--allow-exec`, `--enable-ai` | `false` | Allow remote command execution via `rmte exec` and MCP. Commands run in a visible `[AI]` tab. |\n| `-q`, `--quiet` | `false` | Run in the background: print connection info and PID, then return to the shell. |\n| `--insecure`, `--skip-tls-verify` | `false` | Skip TLS certificate verification (self-signed relays). Process-wide, also affects update downloads. |\n\n### `rmte serve`\nRuns an RMTE relay with the Web UI and an optional admin dashboard. Modes: `standalone` (relay + local host only), `hybrid` (relay + local host + external hosts) or `relay` (router only, no local shell).\n\n| Flag & Aliases | Default Value | Description |\n| :--- | :--- | :--- |\n| `--mode` | `standalone` | `standalone`, `hybrid` or `relay`. |\n| `--port` | `8048` | TCP port for the Web UI and WebSocket traffic. |\n| `--public` | `false` (`127.0.0.1`) | Bind `0.0.0.0` instead of loopback, making the relay reachable from the network. |\n| `--public-url`, `--url` | *Disabled (empty)* | Public base URL or domain used in printed links (e.g. `https://my.rmte.biz.id` or `http://host:8041`). Picks TLS/WSS schemes and keeps custom ports. |\n| `--web-path` | `/` | HTTP path of the Web UI (e.g. `/web`). |\n| `--ws-path` | `/ws-rmte` | WebSocket endpoint for hosts and clients. |\n| `--no-web` | `false` | Don't serve the Web UI (WebSocket and admin API only). |\n| `--no-cli` | `false` | Reject CLI / TUI clients (soft restriction: clients self-declare). |\n| `--pass` | *Auto-generated (12 chars)* | Password of the local host session. *(Not used in `relay` mode.)* |\n| `--pass-file` | *Disabled (empty)* | Read the password from a local file (`0600` on Unix). *(Not used in `relay` mode.)* |\n| `--id` | *Auto-generated (8 chars)* | Session ID of the local host session. *(Not used in `relay` mode.)* |\n| `--dir` | *Current working directory* | Root directory for the File Explorer and terminal. *(Not used in `relay` mode.)* |\n| `--sandbox`, `--dir-only` | `false` | Confine the File Explorer and file tools to `--dir` (files only; the shell is not jailed). *(Not used in `relay` mode.)* |\n| `--buffer` | `1` (MB) | Terminal scrollback buffer and maximum file transfer size. *(Not used in `relay` mode.)* |\n| `--max-chat` | `50` | Chat messages kept in host memory (`0` disables retention). *(Not used in `relay` mode.)* |\n| `--web-preview`, `--preview` | `false` | Enable the Embedded Web Browser Preview reverse proxy. |\n| `--preview-ports` | *Ports opened by viewers* | Fixed preview allowlist, e.g. `3000,5173,8000-8010`. Without it, only ports a viewer opens explicitly are forwarded. *(Not used in `relay` mode.)* |\n| `--allow-exec`, `--enable-ai` | `false` | Allow remote command execution via `rmte exec` and MCP on the local host. *(Not used in `relay` mode.)* |\n| `-q`, `--quiet` | `false` | Run in the background and print the process PID. |\n| `--admin-pass`, `--password-admin` | *Disabled (empty)* | Enables the Relay Admin Dashboard (live sessions, traffic, termination, IP bans). Failed logins are rate-limited. |\n| `--admin-path`, `--path-admin` | `/admin` | HTTP path of the Relay Admin Dashboard. Cannot collide with `/p` (Web Preview), `/favicon.ico` or the Web UI. |\n| `--max-buffer` | `0` (= 256 MB) | Largest host buffer accepted per session, also bounding WebSocket frame size. Larger host requests are clamped. Lower it for multi-tenant relays. |\n| `--max-sessions` | `100` (`0` = unlimited) | Maximum concurrent sessions. New sessions over the limit are rejected; host reconnects are always allowed. |\n| `--max-viewers` | `50` (`0` = unlimited) | Maximum viewer connections per session, across all viewers and tabs. |\n| `--trusted-proxies` | `loopback` | Proxies whose `CF-Connecting-IP` / `X-Forwarded-For` / `X-Real-IP` headers are trusted for client IPs (bans, login throttling): CIDRs/IPs, `loopback`, `private` or `none`. |\n| `--ws-origins` | *Own origin only* | Extra browser origins allowed to open WebSockets, e.g. `https://ui.example.com`. |\n| `--insecure`, `--skip-tls-verify` | `false` | Skip TLS certificate verification (process-wide). |\n\n### `rmte join`\nConnects from another terminal into a shared session as an interactive CLI / TUI client.\n\n| Flag & Aliases | Default Value | Description |\n| :--- | :--- | :--- |\n| `--server-relay`, `--server` | `wss://my.rmte.biz.id/ws-rmte` | Relay WebSocket URL (override for self-hosted relays). |\n| `--id` | *Required* | Session ID to join. |\n| `--pass`, `--password` | *Required* | Session password (or `--pass-file` / `RMTE_PASS`). |\n| `--pass-file` | *Disabled (empty)* | Read the password from a local file. |\n| `--name` | *Interactive prompt* | Display name shown in presence and chat. |\n| `--insecure`, `--skip-tls-verify` | `false` | Skip TLS certificate verification (self-signed relays). |\n\n### `rmte exec`\nRuns one shell command on a host started with `--allow-exec`, prints its output and exits with the command's exit code. Ideal for scripts and CI/CD.\n\n| Flag & Aliases | Default Value | Description |\n| :--- | :--- | :--- |\n| `--server-relay`, `--server` | `wss://my.rmte.biz.id/ws-rmte` | Relay WebSocket URL. |\n| `--id` | *Required* | Session ID of the target host. |\n| `--pass`, `--password` | *Required* | Session password (or `--pass-file` / `RMTE_PASS`). |\n| `--pass-file` | *Disabled (empty)* | Read the password from a local file. |\n| `--timeout` | `60` (seconds) | Execution timeout; the process is terminated when it is exceeded. |\n| `--bg`, `--background` | `false` | Run in a dedicated background tab instead of the shared `[AI]` tab and return immediately. |\n| `--tab-name`, `--name-tab` | *Empty* | Title of the background tab (e.g. `--tab-name=DevServer`). |\n| `--name` | `rmte-exec` | Client name shown in the Web IDE presence badge. |\n| `--insecure`, `--skip-tls-verify` | `false` | Skip TLS certificate verification (self-signed relays). |\n| `-- ` | *Required* | Everything after `--` is the command to run. |\n\n### `rmte mcp`\nStarts a stdio JSON-RPC 2.0 Model Context Protocol server so AI agents (Claude Desktop, Cursor, Claude Code, Antigravity) can work on a host started with `--allow-exec`.\n\n| Flag & Aliases | Default Value | Description |\n| :--- | :--- | :--- |\n| `--server-relay`, `--server` | `wss://my.rmte.biz.id/ws-rmte` | Relay WebSocket URL. |\n| `--id` | *Required* | Session ID of the target host. |\n| `--pass`, `--password` | *Required* | Session password (or `--pass-file` / `RMTE_PASS`). |\n| `--pass-file` | *Disabled (empty)* | Read the password from a local file. |\n| `--name` | `Claude-MCP` | Bot name shown in the Web IDE presence badge (e.g. `[AI] Claude-MCP`). |\n| `--insecure`, `--skip-tls-verify` | `false` | Skip TLS certificate verification (self-signed relays). |\n\n### `rmte stop` & `rmte update`\nStops background sessions started with `-q`, and updates the binary in place from official GitHub releases (`rmte upgrade` is an alias).\n\n| Command / Flag | Usage / Target | Description |\n| :--- | :--- | :--- |\n| `rmte stop ` | Session ID (e.g. `a1b2c3d4`) | Stops the background session with that ID. |\n| `rmte stop ` | Process ID | Sends a graceful termination signal to that background process. |\n| `rmte update --check`, `-c` | Version check | Checks GitHub releases for a newer version without downloading. |\n| `rmte update` | In-place upgrade | Downloads the binary for your OS/arch, verifies it against `checksums.txt` (fail-closed) and replaces the executable. |\n| `rmte update --force` | Re-install | Downloads and replaces the binary even when already up to date. |\n| `rmte update --restart`, `-r` | Seamless restart | Updates, then restarts the running background session. Browsers reconnect automatically without re-entering credentials. |\n| `rmte update --skip-checksum-verify`, `--no-checksum` | Bypass integrity check | Skips SHA-256 verification against `checksums.txt`. Use with caution. |\n\n---\n\n## π Security & Environment Variables\n\n### Credential Precedence\nRMTE resolves credentials according to strict precedence across all subcommands (`share`, `serve`, `join`, `exec`, `mcp`):\n1. **CLI Flag (`--pass`)**: Overrides all other sources. *(Exposed in `ps aux`)*\n2. **Password File (`--pass-file `)**: Reads from disk. *(Checks for `0600` permissions on Unix; recommended for automated services)*\n3. **Environment Variable (`RMTE_PASS`)**: Ingested from process environment. *(Host prints anti-footgun warning banner if active to prevent unintentional re-use)*\n4. **Default**: Host generates a cryptographically secure 12-character random password.\n\n### Supported Environment Variables\nCredentials and defaults can come from environment variables (CI/CD runners, systemd units, scripts) instead of command-line flags visible in `ps aux`.\n\n| Variable | Applies To | Description |\n| :--- | :--- | :--- |\n| `RMTE_PASS` | `share`, `serve`, `join`, `exec`, `mcp` | Session password. The host prints a warning banner when it is used, to prevent accidental long-term reuse. |\n| `RMTE_SERVER` | `share`, `join`, `exec`, `mcp` | Default relay WebSocket URL (same as `--server-relay`). |\n| `RMTE_ID` | `share`, `serve`, `join`, `exec`, `mcp` | Session ID (same as `--id`). |\n| `RMTE_ADMIN_PASS` | `serve` | Relay Admin Dashboard password (same as `--admin-pass`). |\n| `RMTE_DNS_FALLBACK` | All commands | Set to `off` to never redirect DNS to public resolvers. By default only Go's built-in `127.0.0.1:53` / `[::1]:53` fallback is redirected, and only when no resolver is configured. |\n\n> π **Security Model & Reporting:** For details on our end-to-end encryption model, filesystem sandbox boundaries (`--sandbox` files $\\neq$ shell container), and responsible vulnerability disclosure, please read our [SECURITY.md](SECURITY.md).\n\n---\n\n\nπ Migrating from v0.3.x (click to expand)
\n\n| v0.3.x | v0.4.0 |\n| :--- | :--- |\n| `rmte serve --port=8080` (relay) | `rmte serve --mode=relay --public` |\n| `rmte serve --pass=\"x\"` | `rmte serve --pass=\"x\" --public` (standalone) |\n| `--server=\"ws://host:8080/ws\"` | `--server-relay=\"ws://host:8048/ws-rmte\"` |\n| Binds all interfaces | Binds `127.0.0.1` unless `--public` |\n| Protocol `0.3` | Protocol `0.4` β run the same version on relay, hosts and clients |\n\n \n"}