Reachpad Mcp

io.github.ReachpadPublished by GitHub account Reachpadv0.4.2Updated Oct 24, 2026

Coding agents build full-stack apps in persistent workspaces and share them by link.

Overview

AI-generated overview

Reachpad's MCP server lets a coding agent build and publish full-stack apps in persistent cloud workspaces and share them by link, without separate deployment.

What you can do
Create, read, update, publish and trash apps, and roll back to earlier versions or change who can open them (owner, organization, public link with password and expiry). Share apps by email, list and revoke shares, and preview what a live link serves as an image. Browse and organize apps in folders: list, tree, create, move and delete empty folders. Read and query a function app's own database with single SQL statements, and read recent logs from a live function app. Manage organization secrets by name: list, set (rotating onto bound versions) and remove. Check the signed-in account and organizations, and search apps by name, slug or page text.
When to use it
Useful when an agent should produce a working web app and hand out a link rather than just code, and when apps need versioning, access control, sharing, folder organization or small data fixes through SQL. Also suits teams that keep app secrets in an organization store instead of in files.
Requirements
A Reachpad account and a per-user credential from reachpad.dev, supplied as the REACHPAD_IDENTITY_CREDENTIAL environment variable. Runs as a remote endpoint or as a local npm package (npx @reachpad/mcp) over stdio or streamable HTTP; REACHPAD_ENDPOINT sets the host and defaults to m1.reachpad.dev. Network access to the Reachpad host is required.
Before you install
The credential names one account and acts for it, so treat it as a secret. Publishing creates a live link at once, and access defaults to anyone signed in to the organization; public links can be opened by anyone with the URL. Setting a secret replaces its value and rotates it onto every published version that binds it, and removing one deletes it from those versions. Query tools can change rows, and trashing an app immediately stops its link. Port links are not private URLs.

Installation

In SourceWeft

  1. Open Reachpad Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Reachpad%2Freachpad-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "reachpad": {
      "type": "http",
      "url": "https://reachpad.dev/mcp"
    }
  }
}

README

@reachpad/mcp

reachpad lets Claude, Codex and other coding agents build full-stack apps in persistent workspaces and share them by link, without a separate deployment. A workspace is a cloud development computer an agent operates itself: a repo, a filesystem, installed dependencies and build state that all survive between calls, not an ephemeral sandbox that forgets. Processes are the exception; see below.

This is the MCP server. It lets Claude, ChatGPT, Cursor, OpenCode or your own agent create a workspace, run commands in it, fork it, and come back to it later, without a developer keeping a laptop open for them.

  • It persists. Pause it and the disk is sealed; the next call boots from that seal with the files, installs and git state intact, rather than rebuilding. Processes are the exception: a start is always a cold boot.
  • It forks. Twenty attempts from one prepared state cost a delta each, not twenty rebuilds — because the workspace is a snapshot chain, not a machine.
  • It can keep secrets out of the workspace. A brokered credential is called at the boundary on your behalf and its value never enters the workspace, the log or the store. A credential written into the workspace instead is readable there, by design.
  • It is agent-agnostic. The REST API is canonical; this server, the SDK and the CLI are translations of it. Bring your own agent.

The API is the product boundary, not a web UI: reachpad.dev.

Install

sh
npx -y @reachpad/mcp          # stdio, for a local client

In Claude Code:

sh
claude mcp add reachpad -e REACHPAD_IDENTITY_CREDENTIAL=… -- npx -y @reachpad/mcp

Two transports, one implementation

sh
npx @reachpad/mcp                                  # stdioREACHPAD_MCP_HTTP_PORT=8722 npx @reachpad/mcp      # streamable http

stdio is what a local client talks to; Streamable HTTP is what a remote connector talks to. Same tools, same behaviour — added rather than forked, because two implementations of one surface is how they drift.

The HTTP side answers 405 to GET: every tool here is request/response, and the spec permits declining the server-initiated stream rather than holding a connection open for traffic that never comes. There are no sessions — nothing is held across calls that a restart could not rebuild. And it carries no credential of its own: whatever authorizes the HTTP request is what authorizes reachpad.

It is authenticated by default. Set REACHPAD_MCP_HTTP_TOKEN and that is the bearer token; set nothing and one is generated for the run and printed on stderr, because a port that bridges to your account with run_command behind it should not be open to every other process on the machine:

reachpad mcp: streamable http on http://127.0.0.1:8722reachpad mcp: no REACHPAD_MCP_HTTP_TOKEN was set, so this one was generated for this run:
    Authorization: Bearer 3Qk…
reachpad mcp: it changes every restart. Set REACHPAD_MCP_HTTP_TOKEN to pin it, orreachpad mcp: REACHPAD_MCP_HTTP_NO_AUTH=1 to serve with no authentication at all.

Serving with no authentication is still available and is now something you say out loud: REACHPAD_MCP_HTTP_NO_AUTH=1.

Configure

variablemeaning
REACHPAD_ENDPOINTyour reachpad host. Plaintext http:// to anything but loopback is refused before a socket opens.
REACHPAD_IDENTITY_CREDENTIALyour per-user credential. It names one account and can act for no other — the server takes the identity from the credential's own record, never from the request.
REACHPAD_API_KEYoptional, per-workspace scoped and revocable. When set, run_command uses it and needs no identity exchange.
REACHPAD_MCP_HTTP_PORTserve HTTP instead of stdio.
REACHPAD_MCP_HTTP_HOSTdefault 127.0.0.1. This process bridges to a control plane with your credentials, so binding it to the world is a decision made on purpose, behind a proxy that terminates TLS.
REACHPAD_MCP_HTTP_TOKENbearer token, compared in constant time. Absent, one is generated for the run and printed on stderr — the endpoint is never unauthenticated by omission.
REACHPAD_MCP_HTTP_NO_AUTH1 serves with no authentication at all: every caller that can reach the port is authorized. An affirmative choice, not a default.
REACHPAD_MCP_ALLOWED_ORIGINScomma-separated. A request carrying an unlisted Origin is refused — a browser cannot forge it, which closes DNS rebinding. No Origin at all is a non-browser client and is allowed.

If several credentials are set, the narrowest wins, and a refused credential is never retried under a broader one — falling back would be privilege escalation nobody chose to perform.

Tools

toolwhat it does
get_credit_balance()remaining compute credits. One credit runs one standard workspace for one minute.
create_workspace(repo?, ref?, name?)a new workspace, optionally with a repository cloned into $HOME/work. Reachpad generates its display name when omitted.
list_workspaces()your workspaces and how many forks each has
get_workspace(workspace)what it boots from: its head snapshot, its log position and its fork tree
run_command(workspace, argv, cwd?, env?, timeout_ms?)one command, its exit code and its output. A paused workspace resumes to serve it.
checkpoint_workspace(workspace, name?)fork from the last sealed snapshot; the original is untouched
expose_port(workspace, port, check?)open a port to the web and get the link that reaches it. Idempotent per port.
list_ports(workspace)the ports this workspace has open, oldest first, with their links
revoke_port(workspace, port)close one port. Re-opening it later mints a different link.
delete_workspace(workspace)archive it and free the plan slot. Nothing is deleted — snapshots and history survive.

Renamed in 0.4.0. Six tools used to be spelled *_environment and took an environment argument, while the CLI, the manual and the dashboard all said workspace. There was only ever one object; now there is only one word for it. The old names and the old argument still work and are not advertised, so nothing that already calls them breaks — but write new calls against the workspace spelling.

Not here, deliberately: starting an agent inside the workspace. It is in reachpad's roadmap and not in the fleet yet — a tool that always fails costs a model a turn and teaches it to distrust the rest, so this server advertises nothing it cannot serve.

What a port link is, and is not

Worth reading before you hand one to somebody, because none of it is discoverable from the URL:

  • Anyone signed in to Reachpad who has the link can open it. It is not a private URL and not a secure one. Treat it like a preview deployment.
  • The link is an address, not a copy. Restart the app on the same port and the same link serves the new version.
  • A running process does not survive a pause. The workspace cold-boots with its files intact and nothing running, so after a pause the link answers with an error until something is listening on that port again. A visitor's request wakes a paused workspace; it does not restart anything inside it.
  • expose_port dials the port afterwards and tells you if nothing answered, because a link to a port nothing is serving looks exactly like a link that works. Pass check: false to skip it — the dial resumes a paused workspace.
  • With only REACHPAD_API_KEY, the key must be --role owner. A collaborator key is refused: listing hands back live tokens, and a token is a capability.

The rules it is built to

These are the ways a naive client of a streaming exec API misleads a model, and what this one does instead.

  • An unterminated stream is UNKNOWN, never success. If the response ends without a terminal event, the tool says so in those words. It is not a zero exit, and an agent must not retry a non-idempotent command on the strength of it.
  • Its deadline is looser than the server's, so a server-side answer always wins the race. A client that gives up first turns "your build finished" into "unknown", and the numbers are mirrored from the server rather than guessed.
  • Refusals carry remedies, not codes. At your plan limit you get the limit, your current count, and what to do — the numbers come from the server, because a limit hardcoded in a client is a lie the moment your plan changes.
  • Results are handles, not payloads. Output is tailed with the dropped byte count named. Build logs can be megabytes, and an MCP result that size destroys the caller's context window.
  • A refusal is a result, not a transport error, so the model can read it and act. Only an unknown tool is a protocol error.

Test

sh
node --test 'test/*.test.mjs'

No network and no credentials. The protocol suite spawns the shipped server as a child process and speaks real JSON-RPC over its stdio against a stub control plane on a real socket, so nothing under test is an internal import. One test runs the same arc against a real reachpad and skips when no endpoint is configured.

Repository

This repository is the source. It is deliberately separate from the reachpad backend: this code is public, it is published to npm, and its release workflow holds publishing rights — none of which belong in the same repository as the control plane. Nothing here can read the backend's source, and no job in the backend copies files out to here.

Two server constants are mirrored in src/client.js — the exec grace period and the default exec timeout. A mirrored constant normally rots; this one does not, because the backend's own CI fetches this published package and fails if they disagree. The check lives where the number would change.

Source: README.md at commit a4ee8f2

Tools

25

whoami

Who am I

Report the account and the organization this connection is signed in as: user id, email and name, plus org id and name, and `orgs`, every organization the account is in with the current one marked. Takes no arguments. Every app is created in the current organization and nowhere else, so call this before publishing when the person named an organization to publish into, and stop if the org id is not the one they named: switching is done at reachpad.dev/apps, from the organization name at the top of the sidebar, and this connection follows it.

Takes no parameters.

search_apps

Search apps

Find apps in the caller's organization by text. This matches substrings of the name and the slug, and whole words on the live version's page, not meaning: search for a word that appears in the title or on the page rather than describing the app. Returns ids and live URLs.

Parametersqtypelimitcreated_byupdated_by

read_app

Read an app

Read one app before update_app: its name, type, access level and publishing mode, plus base_version_id and its files, which both describe the version the next edit builds on. Each text file carries its content, so this is how you see what an app already contains before changing it. A file marked content_omitted answer budget did not fit in this answer and read_app_file fetches it; one marked too large is past what any tool answer carries. Pass that base_version_id to update_app. version is what the link serves now, and head_version is the version base_version_id names on the apps where that is not the live one, which is every app with a version staged by publish false. pending_version is the number of that staged version, and publish_app_version is what makes it live.

Parametersapp_idrequired

read_app_preview

See an app

Look at the picture of what an app's link serves right now, as an image. Use it for an app whose files you cannot read: a function app's module stays with the people who develop it, so this is how you see what the app actually shows. It is the live version only, and an app published before its picture was taken, or one whose capture has not run yet, answers that there is no picture rather than an error.

Parametersapp_idrequired

list_app_versions

List versions

List an app's versions, newest first. Versions are immutable and numbered from 1. Earlier versions open for the app's editors; the live link follows the app's access setting. Pass the next_cursor from a previous call to get the next page.

Parameterslimitapp_idrequiredcursor

read_app_version

Read a version

Read one version by its number, with its files and each text file's content. Use it to see what an earlier publish contained, and to copy a file back out of a version you want to return to. Earlier versions open for the app's editors; the live link follows the app's access setting.

Parametersapp_idrequirednumberrequired

read_app_file

Read one file

Read one file out of an app as text, at most 256 KB. Use it for a file that read_app left out with content_omitted: "answer budget", or to fetch a single file without the rest of the app. A file that is not text, and a text file over that size, are refused rather than truncated. Reads the newest version unless you name one, which is the same version read_app lists.

Parameterspathrequiredapp_idrequirednumber

query_app_db

Run one SQL statement

Run one SQL statement against a function app's own database, to read rows and to fix data. Not for schema: a table or a column belongs in the version's migrations/NNNN_name.sql, and a statement that changes the schema is refused. Owners and editors only. Answers rows and rowCount for a select, and changes with lastInsertRowid for a write.

Parameterssqlrequiredapp_idrequiredparams

list_secrets

List secrets

List the organization's secrets: each name, who set it, when, and the apps whose versions bind it. Names only. No tool anywhere returns a secret value.

Takes no parameters.

set_secret

Set a secret

Set one organization secret, so a function can bind it by name in its manifest secrets list. Any member of the organization. Setting a name that already exists replaces the value and rotates it onto every published version that binds it. Answers the name, how many versions took the new value, and the ids of any that did not.

Parametersnamerequiredvaluerequired

remove_secret

Remove a secret

Remove one organization secret and delete it from every published version that binds it. A version the deletion did not reach keeps the name in the list with that version in failed, and running this again retries exactly those.

Parametersnamerequired

trash_app

Move an app to the trash

Move an app to the trash. Its link stops opening at once. Owner only. The app and its versions are kept and can be restored from Trash at reachpad.dev/apps/trash, which is also the only place an app is deleted for good.

Parametersapp_idrequired

create_app

Publish a new app

Publish new files as an app and get its URL back. Version 1 goes live at once, so show the person the content and the destination before calling this. Access defaults to org_link, which lets anyone signed in to the same organization open the link.

Parametersnamerequiredslugtypefilesrequiredaccessmessagemanifestvalidate

update_app

Publish a new version

Publish a new version of an existing app. Read the app first and pass the base_version_id read_app returns: it names the version this edit builds on, and a base that has moved is refused rather than overwritten. By default the new version replaces the whole file set and goes live immediately unless the app is set to review before publishing. Send mode merge to publish only the files that changed and keep the rest of that version's files, with remove for paths to drop. Two merges in a row build on each other, staged versions included. Send validate true to check the call without publishing, or publish false to stage the version and make it live later with publish_app_version.

Parametersmodefilesrequiredapp_idrequiredremovemessagepublishmanifestvalidatebase_version_idrequired

publish_app_version

Make a version live

Make one version of an app live by its number. This is how a version staged with publish false goes on the link, and how an app is rolled back: name an older number and that version is what the link serves again. Nothing is rebuilt, the pointer moves.

Parametersapp_idrequirednumberrequired

set_app_access

Set who can open an app

Change who can open an app: restricted (only the owner and named people), org_link (anyone signed in to the organization), or public_link (anyone with the URL). A password and an expiry apply to a public link only. Owner only.

Parameterslevelrequiredapp_idrequiredpasswordexpires_atclear_expiryclear_password

share_app

Share an app

Give one email address access to an app as a viewer or an editor. An address without an account gets a grant that starts working the first time they sign in. The owner or an editor may use this when the owner has enabled editor-managed sharing.

Parametersrolerequiredemailrequiredapp_idrequired

list_app_shares

List shares

List the people an app is shared with, their roles, and whether the grant has attached to an account yet. The owner and editors can read this list.

Parametersapp_idrequired

revoke_app_share

Remove a share

Remove one share by its id, from list_app_shares. The app itself is untouched. The owner or an editor may use this when editor-managed sharing is enabled.

Parametersapp_idrequiredshare_idrequired

ls

List a folder

List what is directly inside one folder: its subfolders and the apps filed in it. Omit folder_id for the top level. Each folder carries the updated_at that mv needs.

Parameterslimitfolder_id

tree

Read the folder tree

The whole folder tree for the organization, nested, with the number of apps filed in each folder and the count sitting at the top level. Each node carries the updated_at that mv needs.

Takes no parameters.

mkdir

Create a folder

Create a folder, at the top level or inside another one.

Parametersnamerequiredparent_id

mv

Move an app or folder

Move an app into a folder, or move a folder under another folder. Name exactly one of app_id or folder_id as the thing being moved, and to_folder_id as the destination, or null for the top level. Moving a folder also needs base_updated_at, the value read from ls or tree, so a move made against a stale reading is refused instead of undoing someone else's.

Parametersapp_idfolder_idto_folder_idrequiredbase_updated_at

rmdir

Delete an empty folder

Delete an empty folder. This refuses while the folder still holds apps or subfolders, and it never deletes an app. Move the contents out first.

Parametersfolder_idrequired

get_app_logs

Read app logs

Read recent log lines from the live version of a function app. An app that serves files has no process and answers that it has no logs. Function logs are not captured yet either, and the answer says so: until they are, have the function catch its own errors and return them in the response.

Parameterslimitsinceapp_idrequired

Version history

1
  1. v0.4.2LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts