OfficialReachpad
This server lets agents manage persistent, forkable cloud development environments over MCP.
Check compute credits– see the account's remaining compute-credit balance.** Create environments**– spin up a persistent environment with an optional repo clone, ref, and display name.** List environments**– view your environments and how many forks each has.** Inspect environments**– see what an environment resumes from, whether memory persists, and its fork tree.** Run commands**– execute a command with argv, cwd, env, and timeout; get exit code and output, and d environments resume automatically.Fork/checkpoint environments– create a new environment from the last sealed snapshot without touching the original.** Archive environments**– free a plan slot while keeping snapshots and history intact.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@
followed by the MCP server name and your instructions, e.g., "@@reachpad/mcp
create a dev environment, clone my repo, and run the test suite"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
reachpad lets Claude, Codex and other coding agents build full-stack apps in persistent workspaces and share them by link, without a separate deployment. A workspace is a cloud development computer an agent operates itself: a repo, a filesystem, installed dependencies and build state that all survive between calls, not an ephemeral sandbox that forgets. Processes are the exception; see below.
This is the MCP server. It lets Claude, ChatGPT, Cursor, OpenCode or your own agent create an environment, run commands in it, fork it, and come back to it later, without a developer keeping a laptop open for them.
It persists. it and the disk is sealed; the next call boots from that seal with the files, installs and git state intact, rather than rebuilding. Processes are the exception: a start is always a cold boot.It forks. Twenty attempts from one prepared state cost a delta each, not twenty rebuilds — because the environment is a snapshot chain, not a machine.It can keep secrets out of the box. A brokered credential is called at the boundary on your behalf and its value never enters the environment, the log or the store. A credential written into the environment instead is readable there, by design.It is agent-agnostic. The REST API is canonical; this server, the SDK and the CLI are translations of it. Bring your own agent.
The API is the product boundary, not a web UI: reachpad.dev.
Install #
npx -y @reachpad/mcp # stdio, for a local client
In Claude Code:
claude mcp add reachpad -e REACHPAD_IDENTITY_CREDENTIAL=… -- npx -y @reachpad/mcp
Related MCP server: agent-jail-mcp
Two transports, one implementation #
npx @reachpad/mcp # stdio
REACHPAD_MCP_HTTP_PORT=8722 npx @reachpad/mcp # streamable http
stdio is what a local client talks to; Streamable HTTP is what a remote connector talks to. Same tools, same behaviour — added rather than forked, because two implementations of one surface is how they drift.
The HTTP side answers **405 to **
: every tool here is request/response, and the spec permits declining the server-initiated stream rather than holding a connection open for traffic that never comes. There are GET****no sessions — nothing is held across calls that a restart could not rebuild. And it carries no credential of its own: whatever authorizes the HTTP request is what authorizes reachpad.
Configure #
variable | meaning | | your reachpad host. Plaintext | | your per-user credential. It names one account and can act for no other — the server takes the identity from the credential's own record, never from the request. | | optional, per-environment scoped and revocable. When set, | | serve HTTP instead of stdio. | | default | | bearer token, compared in constant time. Absent, | | comma-separated. A request carrying an unlisted |
If several credentials are set, the narrowest wins, and a refused credential is never retried under a broader one — falling back would be privilege escalation nobody chose to perform.
Tools #
tool | what it does | | remaining compute credits. One credit runs one standard environment for one minute. | | a new environment, optionally with a repository cloned into | | your environments and how many forks each has | | what it boots from: its head snapshot, its log position and its fork tree | | one command, its exit code and its output. A d environment resumes to serve it. | | fork from the last sealed snapshot; the original is untouched | | open a port to the web and get the link that reaches it. Idempotent per port. | | the ports this environment has open, oldest first, with their links | | close one port. Re-opening it later mints a | | archive it and free the plan slot. Nothing is deleted — snapshots and history survive. |
Not here, deliberately: starting an agent inside the environment. It is in reachpad's roadmap and not in the fleet yet — a tool that always fails costs a model a turn and teaches it to distrust the rest, so this server advertises nothing it cannot serve.
What a port link is, and is not
Worth reading before you hand one to somebody, because none of it is discoverable from the URL:
Anyone signed in to Reachpad who has the link can open it. It is not a private URL and not a secure one. Treat it like a preview deployment.The link is an address, not a copy. Restart the app on the same port and the same link serves the new version.A running process does not survive a . The environment cold-boots with its files intact and nothing running, so after a the link answers with an error until something is listening on that port again. A visitor's request wakes a d environment; it does not restart anything inside it.expose_port****dials the port afterwards and tells you if nothing answered, because a link to a port nothing is serving looks exactly like a link that works. Passcheck: false
to skip it — the dial resumes a d environment.With onlyREACHPAD_API_KEY, the key must be**--role owner****.** Acollaborator
key is refused: listing hands back live tokens, and a token is a capability.
The rules it is built to #
These are the ways a naive client of a streaming exec API misleads a model, and what this one does instead.
An unterminated stream is UNKNOWN, never success. If the response ends without a terminal event, the tool says so in those words. It is not a zero exit, and an agent must not retry a non-idempotent command on the strength of it.Its deadline is looser than the server's, so a server-side answer always wins the race. A client that gives up first turns "your build finished" into "unknown", and the numbers are mirrored from the server rather than guessed.Refusals carry remedies, not codes. At your plan limit you get the limit, your current count, and what to do — the numbers come from the server, because a limit hardcoded in a client is a lie the moment your plan changes.Results are handles, not payloads. Output is tailed with the dropped byte count named. Build logs can be megabytes, and an MCP result that size destroys the caller's context window.A refusal is a result, not a transport error, so the model can read it and act. Only an unknowntoolis a protocol error.
Test #
node --test 'test/*.test.mjs'
No network and no credentials. The protocol suite spawns the shipped server as a child process and speaks real JSON-RPC over its stdio against a stub control plane on a real socket, so nothing under test is an internal import. One test runs the same arc against a real reachpad and skips when no endpoint is configured.
Repository #
This repository is the source. It is deliberately separate from the reachpad backend: this code is public, it is published to npm, and its release workflow holds publishing rights — none of which belong in the same repository as the control plane. Nothing here can read the backend's source, and no job in the backend copies files out to here.
Two server constants are mirrored in src/client.js
— the exec grace period and the default exec timeout. A mirrored constant normally rots; this one does not, because the backend's own CI fetches this published package and fails if they disagree. The check lives where the number would change.
Maintenance
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceProvides persistent memory and task management for coding agents via MCP tools, enabling mid-session recall and capture of durable knowledge.2533MIT
- FlicenseNot gradedqualityBmaintenanceProvides MCP tools for managing disposable Docker sandboxes that let AI agents safely execute commands in isolated, ephemeral environments. Nolane HabitatofficialFlicenseNot gradedqualityBmaintenanceProvides coding agents with a durable, revision-aware project workspace for semantic context, governed source changes, verification, task checkpoints, and observability through an MCP interface.1- AlicenseNot gradedqualityBmaintenanceA durable MCP control plane for starting, observing, steering, continuing, cancelling, and handing off long-running coding agents, with bounded MCP calls and persistent worktrees.235MIT
Related MCP Connectors
Create and drive plori cloud agents and workflows over MCP; each agent has its own environment.
Shared, governed long-term memory for AI agents across tools and sessions via MCP and REST.
Cloud-hosted MCP server for durable AI memory
Latest Blog Posts #
Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)ByOm-Shree-0709on .mcpAgent IdentityOAuth 2.1Your AI Chatbot Just Exposed Your CEO's Salary to an InternByOm-Shree-0709on .Agent IdentityMCP SecurityOAuth DelegationWhy MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)ByOm-Shree-0709on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Reachpad/reachpad-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server