Changelogv0.1.75: CLI login and Linux Full Access

Every agent. Every device.Connected by Connectra.

Connectra is a private outbound bridge for remote MCP. Any MCP client can find your machines, read and edit code inside the folders you allow, and run commands, with approval and rollback on the machine itself.

Download Connectra Read the quickstart

Open source, MIT
No inbound ports
Approval on the machine

mini-01mini-02mini-03mini-04mini-05mini-06mini-07mini-08mini-09mini-10

How it works

A remote MCP server that dials out from your machine.

Three parts, one direction. Your machine opens the connection; nothing on it listens for the internet.

MCP client

Streamable HTTP + OAuth 2.1

Cloudflare Worker

/mcp · one registry per GitHub login

Connectra Desktop

Rust core · final local authority

Your Allowed Roots

files, tests, builds

Outbound only: The desktop opens an authenticated WebSocket to the Worker. No local listener, no inbound tunnel, no public IP.
Scoped to your login: The Worker serves /mcp and keeps one device registry per GitHub login, so a client only ever sees your own machines.
Decided locally: Each machine's Rust core validates, asks and executes. The Worker routes requests; it never authorizes them.

Limits, from the docs

inbound ports: 0; The desktop dials out. Nothing on it listens.
approval timeout: 60 s; No answer fails closed, and so does a closed app.
per read_file: 1 MB; UTF-8 text; read_files takes 1–20 per call.
steps per run_steps: 20; One bounded workflow, run in order.

Without / With

Ten machines used to mean ten terminals.

With Connectra it is one conversation, and every machine still makes its own decisions.

Without Connectra

A session per machine, keys on every box, and you do the fan-out by hand.

10 machines · 10 terminals · 10 sets of keys

With Connectra

One MCP connection. The agent finds every device and runs on each one, with approval on the machine.

assistant.example.com

Update the model and restart the agent on every machine.

list_devices10 devices

run_command × 100/10 exit 0

All 10 machines updated. Agents restarted and reconnected.

1 chat · 1 MCP connection · approval on each machine

Product

Built for agents that do real work on real machines.

Discovery, edits, commands and approvals over one MCP connection, with the machine in charge of every decision.

Fleet

One conversation reaches every machine.

Ask once. The agent calls list_devices, then run_command on each device it needs. Every machine signed in with your GitHub account appears in the same list.

Structured argv with a working directory. No shell chaining, pipes or expansion.
Timeouts, bounded arguments and environment, output capped at 500 KB.
run_steps runs up to 20 commands in order as one bounded workflow.

assistant.example.com

Update the model and restart the agent on every machine.

list_devices10 devices

Found 10 online devices. Running the update on each one.

run_command × 100/10

run_commandmini-01./bin/agent-update --model latest --restartqueued

run_commandmini-02./bin/agent-update --model latest --restartqueued

run_commandmini-03./bin/agent-update --model latest --restartqueued

run_commandmini-04./bin/agent-update --model latest --restartqueued

run_commandmini-05./bin/agent-update --model latest --restartqueued

run_commandmini-06./bin/agent-update --model latest --restartqueued

run_commandmini-07./bin/agent-update --model latest --restartqueued

run_commandmini-08./bin/agent-update --model latest --restartqueued

run_commandmini-09./bin/agent-update --model latest --restartqueued

run_commandmini-10./bin/agent-update --model latest --restartqueued

All 10 machines updated. Agents restarted and reconnected.

Message

Approvals

Sensitive actions wait for you, on that machine.

Mutations and higher-risk commands pause in Connectra Desktop with the exact command, folder and requester. Nothing runs until you decide.

Deny, Allow once, or Allow for session.
No answer within 60 seconds fails closed, and so does a closed app.
Allow once is bound to a single request ID.

Approvals

Sensitive actions wait for you, on that machine.

Mutations and higher-risk commands pause in Connectra Desktop with the exact command, folder and requester. Nothing runs until you decide.

Deny, Allow once, or Allow for session.
No answer within 60 seconds fails closed, and so does a closed app.
Allow once is bound to a single request ID.

1Approval neededThe edit pauses on mini-04 with the file, the diff and who asked.
2Allow onceOne click approves this request ID, and only this one.
3RunningThe patch is applied atomically and a snapshot is saved first.
4UndoUndo in Activity restores the file from that snapshot.

1/4 Approval needed · The edit pauses on mini-04 with the file, the diff and who asked.

Recovery

Edits you can preview, fence and undo.

Every edit carries the SHA-256 the agent last read, so a stale write never lands on newer work. Each mutation is snapshotted before it is written.

patch_file, apply_patch and apply_change_set show a diff in the approval.
apply_change_set edits many files atomically: all of them, or none.
rollback_to_checkpoint previews by default and never pretends to undo a command or network call.

Connectramini-04

Live

patch_fileconfig/agent.toml+2 −1

expected_sha256 9f2c71…e41a

 [agent]-model = "v3"+model = "latest"+restart_on_update = true queue = "default"

Activity2 events

patch_file · config/agent.toml (+2 −1)

14:06:12

Undo

run_command · npm test · exit 0

14:05:40

Developer runtime

The toolchain you already use, resolved predictably.

Connectra doesn't inherit an interactive shell PATH. It finds Homebrew, Cargo, Bun, Volta, asdf, pyenv, mise, pnpm, NVM, node_modules/.bin and Python virtualenvs, and rejects temporary or world-writable locations.

inspect_execution_environment shows what a device can resolve before anything runs.

run_steps

{  "path_or_workspace_id": "ws_...",  "stop_on_error": true,  "steps": [    { "command": "npm", "args": ["test"],      "relative_cwd": "cloudflare-remote-mcp" },    { "command": "npm", "args": ["run", "typecheck"],      "relative_cwd": "cloudflare-remote-mcp" },    { "command": "cargo",      "args": ["test", "-p", "connectra-core", "--lib"],      "relative_cwd": "." }  ]}

Headless CLI: connectra-cli drives device status, Allowed Roots, workspaces, trust, approvals and operations, with text or JSON output and deterministic exit codes.
Verified updates: The desktop checks a public release feed and validates the version, HTTPS origin, artifact path and SHA-256 before offering an update.
Durable results: Every operation ends with an explicit outcome, and the result is redelivered after a reconnect until the Worker acknowledges it.

MCP tools

A small, explicit tool surface.

Every tool works on a device you own and inside an Allowed Root. Nothing is generic shell access.

A small, explicit tool surface.
Group	Tools	Behaviour
Discover	list_devices get_device_info list_directory stat_file search_files search_text	Find devices, folders and code. Bounded depth, entries and results; .git, `node_modules` and build output are skipped.
Read	read_file read_files inspect_changes	UTF-8 text up to 1 MB per file, 1–20 files per call. Git status and patches relative to HEAD or a checkpoint.
Change	create_file write_file patch_file apply_patch apply_change_set rollback_to_checkpoint	SHA-256 fenced, diff preview, local approval, snapshot and atomic write.
Run	inspect_execution_environment run_command run_steps	Structured argv inside an Allowed Root. Timeouts and output caps; shell launchers stay blocked.
Long turns	begin_turn get_turn_status get_task_handoff	Declare a turn budget, poll the time left, and resume from a compact handoff brief.

Use cases

What it is for.

mini-08 v0.1.73 · the rest v0.1.74

Security model

Cloud requests. Local decides.

Cloudflare and AI clients are never the authorization authority. The Rust core on each machine makes every policy and security decision, and fails closed when in doubt.

What happens to every call

1
Tenant check
The Worker authenticates the MCP client and routes only to devices registered to the same GitHub login.
2
Hard validation
Allowed Roots, canonical paths and the sensitive-file list are checked first. Failures are rejected immediately.
PATH_OUTSIDE_ALLOWED_ROOTSENSITIVE_FILE_BLOCKED
3
Local permission engine
Each capability is set to Allow, Ask or Deny. Ask uses an active session grant or prompts on the machine.
USER_DENIED
4
Prompt on the machine
Deny, Allow once or Allow for session. No answer within 60 seconds, or a closed app, fails closed.
APPROVAL_TIMEOUT
5
Execute and record
Approved work runs locally with snapshots and a durable receipt.

Trust modes

Pick how much the machine asks, per scope.

Guarded

Ask when local policy requires approval.

Approve for Me

Automatically approve routine developer work; ask on risk or boundary.

Full Access

Keep working without operation approval prompts inside this scope. Commands use your normal host environment, and tokens are never injected into child processes.

On Linux only Full Access is available today. Guarded and Approve for Me fail closed with SANDBOX_UNAVAILABLE until a Linux confinement backend exists.

Hard boundaries no approval can override

Allowed Roots.: The agent works only inside folders you choose. Everything else stays invisible.
Path guards.: Paths are canonicalized; .. traversal and symlink escapes are rejected.
Sensitive files.: .env, .pem, .key, credential dotfiles, binaries and archives are hard-blocked.
Session grants.: Kept in memory, scoped to one capability and root, and gone on disconnect or quit.
SHA-256 fencing.: Edits carry the expected hash, so a stale write never lands over newer work.
Safe environment.: Secret, loader, proxy and credential variables are refused in run_command.

Limits

Limit	Value
`read_file` size	1 MB
`read_files` per call	1–20 files
`run_steps` per call	1–20 steps
`run_command` arguments	100 · 8 KiB each
Environment entries	20 · 2 KiB each
Command output	500 KB
Approval timeout	60 s, fail closed
`apply_patch` input	196,608 bytes

Clients and platforms

Works with the MCP clients you already use.

Connectra is a standard remote MCP server. A client that can add a remote server over Streamable HTTP with OAuth can reach your machines.

Add it to your client

Paste your Worker URL. Each format follows that client's own docs.

01Open Customize → Connectors.
02Select +, then Add custom connector.
03Name it, paste the URL, select Continue through the sign-in settings, then Add and finish GitHub sign-in.

On Team and Enterprise plans an owner adds it under Organization settings → Connectors.

Remote MCP server URL

https://YOUR-WORKER/mcp

Client menus change between versions, so check the client's docs if a step moved. No partnership or endorsement is implied.

Protocol

Endpoint: https://YOUR-WORKER/mcp
Transport: Streamable HTTP · legacy SSE at /sse
Sign-in: OAuth 2.1 with PKCE, GitHub identity
Named in the docs: Claude, Cursor, ChatGPT, web agents
Test client: MCP Inspector

Platforms

Platform	How it runs	Status
macOS	Desktop app with a launchd supervisor	v0.1.75 installer for Apple Silicon
Windows	Desktop app with a supervisor sidecar	Not in the v0.1.75 release; last installer v0.1.68
Linux	Headless supervisor and `connectra-cli`, sample container	Full Access only; desktop build last shipped in v0.1.68

macOS
Desktop app with a launchd supervisor
v0.1.75 installer for Apple Silicon
Windows
Desktop app with a supervisor sidecar
Not in the v0.1.75 release; last installer v0.1.68
Linux
Headless supervisor and connectra-cli, sample container
Full Access only; desktop build last shipped in v0.1.68

Docs

Quickstart

From install to the first tool call. Commands are taken from the Connectra README.

01Install Connectra Desktop and open it.
02Set Remote MCP Worker to your Worker origin. Don't append /mcp.
03Sign in with GitHub. The app shows a Device Flow code and opens the verification page.
04Add Allowed Roots, ideally project folders rather than your whole home directory, then Connect.
05Add the server to your MCP client, finish GitHub OAuth and try a first prompt.

MCP client

# Server URL to add in your MCP clienthttps://YOUR-WORKER/mcp# Optional: test the connection with MCP Inspector$ npx @modelcontextprotocol/inspector@latest# A first promptUse list_devices. Then call read_file on the onlinedevice for ~/project/README.md and summarize it.

Changelog

Recent releases

Connectra Desktop, the Worker and the CLI ship together.

All releases

v0.1.75
Sep 30, 2026
Latest
CLI login and Linux Full Access
- connectra-cli login (GitHub Device Flow) and device connect for headless hosts.
- Linux Full Access with process-group ownership; Full Access children can't read bridge tokens.
- Unknown credential backends now fail supervisor start instead of falling back.
v0.1.74
Sep 30, 2026
Client turn clock and reaped capacity
- begin_turn and get_turn_status let a client declare a turn budget and poll the time left.
- get_task_handoff returns a compact resume brief.
- Reaped processes free their device slot immediately.

Earlier releases v0.1.72–v0.1.73

v0.1.73
Sep 30, 2026
GitHub device sign-in reliability
- Device Flow polling starts before the browser opens, so a hung browser can't block sign-in.
- Longer Worker timeouts so slow TLS can finish.
v0.1.72
Sep 28, 2026
CLI v1 and retryable terminal outbox
- connectra-cli: device status, Allowed Roots, workspaces, trust, approvals and operations, as text or JSON.
- Terminal results are retried after transient bridge failures.

FAQ

Questions, answered from the docs.

Something else? Write to email

01Do I need to open a port or run a tunnel?

No. Connectra Desktop makes an outbound, authenticated WebSocket connection to the Worker. There is no local listener, no inbound tunnel and no public IP.

02Who decides whether an action runs?

The machine. Cloudflare and the AI client are never the authorization authority; the Rust core on the device applies Allowed Roots, the permission engine and your approvals.

03What happens if I don't answer an approval?

It fails closed after 60 seconds with APPROVAL_TIMEOUT. A closed app fails closed too.

04Can an approval unlock .env files or folders outside my roots?

No. Approvals and session grants can never override Allowed Roots or the sensitive-file rules for .env, .pem, .key and credential files.

05Can I undo what an agent changed?

File mutations are snapshotted, and rollback_to_checkpoint can preview or restore tracked changes. It never pretends that a command, dependency install or network call was undone.

06Can the agent run shell pipelines?

No. Commands are structured argv with a working directory. Send separate steps with run_steps instead of cd ... &&, pipes, redirects or shell expansion, so the approval matches exactly what runs.

07Does it work on a server without a desktop?

Yes. connectra-supervisor and connectra-cli run headless; the repository includes a Linux sample container. On Linux, Full Access is the only mode for now.

08Which AI clients work?

Any MCP client that supports remote servers over Streamable HTTP with OAuth. The docs name Claude, Cursor, ChatGPT and web agents, and use MCP Inspector for testing.

Remote AI. Local authority.

Install Connectra on one machine, connect your MCP client and approve the first call.

Open source under the MIT licence. Early and moving fast. v0.1.75.

Download Connectra Read the quickstart

Every agent. Every device.Connected by Connectra.

A remote MCP server that dials out from your machine.

Ten machines used to mean ten terminals.

Built for agents that do real work on real machines.

One conversation reaches every machine.

Sensitive actions wait for you, on that machine.

Sensitive actions wait for you, on that machine.

Edits you can preview, fence and undo.

The toolchain you already use, resolved predictably.

A small, explicit tool surface.

What it is for.

Cloud requests. Local decides.

What happens to every call

Trust modes

Hard boundaries no approval can override

Limits

Works with the MCP clients you already use.

Add it to your client

Protocol

Platforms

Quickstart

Recent releases

CLI login and Linux Full Access

Client turn clock and reaped capacity

GitHub device sign-in reliability

CLI v1 and retryable terminal outbox

Questions, answered from the docs.

Remote AI. Local authority.