mcp

MCP server

Pre-alpha. The running app serves MCP over HTTP and rcommander mcp serves stdio. The tools below exist today: panels, tabs, folder history and hotlist, drives, files (search, compare, checksums, reading, properties, multi-rename), archives, WSL, terminals (also on SSH servers), the operations queue, connections with SSH sessions, SFTP, FTP, commands run on a server and login scripts, SSH agents, host keys, FTPS certificates, the vault status, settings, the database backup and diagnostics. More follow with every feature.

rCommander includes a server for the Model Context Protocol, so AI assistants such as Claude Code can use it: list folders, move the panels, copy, pack or rename files, and run a command on a server. Every MCP tool calls the same command the keyboard and menus use - an MCP navigate moves the panel you are looking at.

Two ways to connect

Mode	How	When
stdio	rcommander.exe mcp	Claude Code starts it. If rCommander is running (it answers on the port in its instance file), the call is forwarded to it; otherwise it works without a window, both panels starting in the current folder. A forwarding rcommander mcp ends a few seconds after rCommander does, so it never keeps rcommander.exe in use; reconnect the agent (Claude: restart the server) once rCommander runs again.
HTTP	http://127.0.0.1:<port>/mcp with a bearer token	Served by the running app, on this machine only. The status bar shows the address.

Claude Code in WSL

Use stdio and point it at the Windows program. This works over WSL interop and avoids the problem that WSL2 in NAT mode cannot reach Windows' 127.0.0.1:

claude mcp add rcommander -- /mnt/c/Tools/rCommander/rcommander.exe mcp

Replace /mnt/c/Tools/rCommander with wherever rcommander.exe lives. A development build copied by scripts/run-windows.sh lives in %LOCALAPPDATA%\rcommander-dev\, from WSL /mnt/c/Users/<you>/AppData/Local/rcommander-dev/rcommander.exe.

Check it with claude mcp list (rcommander should show as connected), then ask Claude Code, for example, "list the folder in the left rCommander panel" or "navigate the right panel to C:\Windows".

Claude Code on Windows

claude mcp add rcommander -- "C:\Tools\rCommander\rcommander.exe" mcp

You can also connect to the running window directly; its status bar shows MCP server on 127.0.0.1::

claude mcp add --transport http rcommander http://127.0.0.1:<port>/mcp --header "Authorization: Bearer <token>"

Port, token and the instance file

• The token is generated once (32 random bytes, 64 hex digits) and stored in the setting mcp.token in rcommander.db (%APPDATA%\degoya\rCommander\data\).
• While the app serves HTTP it writes mcp-instance.json next to the database: the port, the token and its process id, readable only by you. rcommander mcp reads it to forward to the running app, and only after the app answered with that token. The file is removed when the server stops; one left behind by a crash is ignored.
• Settings, page MCP server switches the server on and off, sets the port (0 picks a free one), copies the token or makes a new one, and sets the rights per class (below). Each change takes effect at once: switched off, the HTTP endpoint stops answering and rcommander mcp says that the server is switched off; a new port or token restarts the server, and the old token stops working. If the server cannot start, the app keeps running and the status bar says why.
• These settings, and the vault's, can only be changed in the window: settings_set refuses every mcp.* and vault.* setting, so an assistant can never widen its own rights.
• The HTTP server listens on 127.0.0.1 only and refuses a request without the token, from a web page (a foreign Origin) or addressed to a foreign host name (DNS rebinding).
• rcommander mcp checks the running app without sending the token: it asks /health with a random nonce, and the app proves it holds the token with a keyed BLAKE3 hash of port and nonce (nonce_required without one).

The tools

Every tool belongs to a class (see the policy below): read, write, destructive, exec. Errors come back with a stable code, such as not_found, entry_not_found, policy_denied or confirmation_required.

Panels

Tool	Class	What it does
list_dir	read	Lists a folder (name, kind, size, modified time, hidden, read-only, and the owner's user and group where the backend names them: SFTP, local folders on Linux and macOS) without moving a panel. A relative path or none starts from the panel's folder; ftp://<connection name>/<path> lists a folder on an FTP connection, sftp://<connection name>/<path> one on an SSH connection.
get_panel_state	read	A panel's folder, whether it is active, the cursor, the selection and the number of entries.
navigate	read	Shows another folder in a panel: absolute, relative, sftp://<connection name>/<path> on an SSH server, or .. (the cursor then stands on the folder you came from). The panel on screen moves. A very large server folder answers with loading while the rest still arrives; get_panel_state tells when it is complete.
set_cursor	read	Puts a panel's cursor on an entry, by position or name.
toggle_selection	read	Selects or deselects entries by name.
panel_select	read	Changes the whole selection: all, none, invert, by the extension under the cursor, or restore the selection of the last file operation.
panel_select_by_mask / panel_deselect_by_mask	read	Selects / deselects the files a Total Commander mask matches (`.txt;.md
panel_select_differences	read	Compares the files of the two panels' folders as Shift+F2 does and selects in each panel the files the other side lacks, has older or has in another size; by_content compares the bytes too.
panel_sort	read	Sorts by name, extension, size or date; the same key again turns the order around.
panel_set_view	read	Full view (columns) or brief view (names only).
panel_show_hidden	read	Shows or hides hidden and system files in both panels; the choice is kept.
switch_active_panel	read	Makes the other (or a named) panel the active one.
file_open	exec	Opens an entry as Enter does: a folder in the panel, a program started, any other file in its associated program. Local files only.
show_files	read	Shows a panel's files instead of its terminal; the shell keeps running.
panel_filter	read	Filters a panel as Ctrl+S does (*.txt, t?do*; a text without wildcards matches any part of a name); without a pattern every entry shows again. Selected entries the filter hides are deselected.
panel_branch_view	read	Total Commander's branch view (Ctrl+B): every file below the panel's folder, or below its selected folders, in one flat list; again leaves it.
panel_feed_paths	read	Shows given files and folders, such as search hits, flat in a panel, as the find-files dialog's Feed to listbox does (100,000 at most).
panel_swap	read	Swaps the two panels' folders (Ctrl+U), or with with_tabs their whole tab rows (Ctrl+Shift+U).
panel_transfer	read	Shows the folder under one panel's cursor, or its own folder, in the left or right panel (Ctrl+Left, Ctrl+Right).

Each panel tool takes an optional panel (left or right; the active panel when left out).

Tabs, history and hotlist

Tool	Class	What it does
tab_list	read	A panel's tabs: id, title, folder, whether locked and which one is shown.
tab_open	read	Opens a folder in a new tab, as Ctrl+T (the panel's own), Ctrl+Up (the folder under the cursor) or Ctrl+Shift+Up (in the other panel).
tab_close	read	Closes a tab, the shown one by default (Ctrl+W); a panel keeps its last tab (last_tab).
tab_select	read	Shows a tab by its id: the panel returns to its folder, sort, view and cursor; a folder that is gone shows the nearest one above it.
tab_lock	read	Locks or unlocks a tab; a locked tab opens every new folder in a new tab.
tab_copy_to_other	read	Copies a tab to the end of the other panel's tabs.
history_back / history_forward	read	Goes back or forward in the shown tab's folder history (Alt+Left, Alt+Right).
history_list	read	The shown tab's folder history, oldest first (at most 50), and the folder shown (Alt+Down).
history_jump	read	Shows a folder of that history by its index.
hotlist_list	read	The directory hotlist (Ctrl+D) in menu order: entries with folder and optional target for the other panel, and hotlist folders.
hotlist_open	read	Shows a hotlist entry's folder in a panel, and its target in the other one.
hotlist_add / hotlist_add_folder	write	Adds a folder (by default the panel's own) / a hotlist folder to group entries.
hotlist_update / hotlist_move	write	Renames an entry or changes its path or target / moves it to another place.
hotlist_delete	destructive	Removes an entry, or a hotlist folder with everything in it; never a file.

Moving between tabs one step at a time (Ctrl+Tab) has no tool: tab_select names the tab.

Drives

Tool	Class	What it does
drives_list	read	The drive bar: drives with kind, volume name, state and free space, the WSL distributions and every saved server (server:<connection id>) with its folders in the connection tree and whether the bar shows it as a button. A drive that does not answer within 2 seconds is waiting.
panel_change_drive	read	Shows a drive in a panel, as a click in the drive bar does: in the folder the panel last showed on it. An SSH server opens over SFTP, in its start or home folder the first time.

Files

Tool	Class	What it does
files_search	read	Finds files and folders below one or more folders, as Alt+F7 does: name masks or a regular expression, text or a regular expression inside files (with encoding), size, date, attributes, kind and depth. Answers a page of hits (100 by default, 1000 at most) and a cursor for the next page; cancelling the call stops the search.
files_read_text	read	A window of a file as text in its detected encoding (256 KiB by default, 4 MiB at most), and whether the file goes on.
files_read_hex	read	A window of a file as hex rows, as xxd prints them (64 KiB at most).
files_compare	read	Compares two files: identical or not, the first differing byte, and for text files up to 16 MiB (and a million lines) the changed lines (optionally ignoring white space, case and line endings) and a unified diff of limited size.
dirs_compare	read	Compares two folder trees as Synchronize dirs does and proposes per row what to copy or delete; changes nothing.
dirs_sync_apply	write	Runs a synchronization as copy and delete jobs of the queue. It compares again, starts from the proposal (or from nothing) and sets actions by row path (sync_row_not_found). Without allow_deletes nothing is deleted, without overwrite existing targets are skipped; either makes the call destructive (confirmation code).
files_checksum	read	CRC32, MD5, SHA-1, SHA-256, SHA-512 or BLAKE3 of one or more files.
files_checksum_create	write	Writes checksum files as Total Commander does (.md5, .sha, .sha256, .sha512, .blake3, .sfv), one for all or one per file; sha256sum -c reads them. Never overwrites.
files_checksum_verify	read	Checks the files a checksum file lists: ok, mismatch, missing, unreadable per line.
files_split	write	Splits a file into parts name.001, name.002, ... with Total Commander's .crc file. Never overwrites; a cancelled run removes its parts.
files_combine	write	Puts the parts back together and checks size and CRC; with a part missing nothing is written.
files_stat	read	One entry by its path: kind, size, modified time, hidden, read-only, link target; also on an FTP connection as ftp://<connection name>/<path> and on an SSH connection as sftp://<connection name>/<path>.
files_properties	read	Properties of one or more entries as Alt+Enter shows them: kind and link target, size and size on disk, times, attributes, owner and mode, the descript.ion comment, with count each folder's contents, a total for several, and what can be changed there. Reads only metadata.
files_dir_size	read	Occupied space of files and folders: bytes, files, folders, hard links counted once.
files_set_attributes	write	Changes read-only, hidden, system, archive, the Unix mode and the times of entries, optionally down their folders.
files_create_link	write	Creates a .lnk shortcut (Windows), a symbolic link, a hard link or a junction; never replaces an entry.
files_set_comment	write	Sets or removes an entry's comment in its folder's descript.ion, compatible with Total Commander.
multi_rename_preview	read	Total Commander's multi-rename without renaming anything: masks ([N], [E], [C], ...), case, search and replace, counter; per entry the new name, the kind of change and any conflict.
multi_rename_apply	write	Renames by the same rule as a background job, logged for undo. The plan is made again from the folder as it is; with any conflict nothing is renamed (rename_plan_conflicts). Swaps and rings go through temporary names; nothing is ever overwritten.
multi_rename_undo	write	Reverses the latest multi-rename as far as it got, also one cancelled or broken off by a crash; refused as a whole when an entry changed since (rename_undo_mismatch).
multi_rename_preset_list	read	The saved multi-rename presets by name, each with its rule, and the rule last used.
multi_rename_preset_save	write	Saves a rule as a preset under a name, replacing one of that name.
multi_rename_preset_rename / multi_rename_preset_delete	write	Renames or deletes a saved preset.

None of these reads, compares or hashes a protected file; see Protected files. Changing attributes, creating links and renaming refuse protected files too (sensitive_path); dirs_sync_apply refuses to copy one before any job starts. The multi-rename dialog (Ctrl+M) uses the same rules and presets as these tools.

Archives

Tool	Class	What it does
archives_list	read	A folder inside a zip, 7z or tar archive (plain, .gz, .xz, .bz2, .zst): name, kind, size, packed size, time, encrypted, and names that would climb out of the archive marked and shown cleaned.
archives_test	read	Tests archives in the background: reads every entry and checks its checksums; damaged and encrypted entries are listed. Follow the job with ops_list.
archives_extract	write	Unpacks archives into a folder as a queued job: each into its own folder, by mask, with or without paths. Entries that would land outside the target and stored links are never written; encrypted entries fail with password_required - no tool takes a password. Overwriting needs a confirmation code.
archives_pack	write	Packs files and folders into a new zip, 7z, tar, tar.gz, tar.xz, tar.bz2 or tar.zst archive at level 0 to 9, as a queued job; the archive appears only when complete. Overwriting and deleting the packed files need a confirmation code; sources that are or hold protected files are refused.

WSL

Tool	Class	What it does
wsl_list_distros	read	The installed WSL distributions: name, default, version, and the root share (\\wsl.localhost\<name>\) that navigate and list_dir accept. Empty without WSL.
wsl_refresh	read	Reads the distributions again, after installing or removing one.

Terminals

Tool	Class	What it does
terminal_list	read	The open terminal sessions (shell, folder, size, running or exited with its code) and the shells a new one can start.
terminal_open	exec	Starts a local shell in a new session, in the panel's folder unless cwd is given, and shows it in its panel. shell: "wsl" with distro (a name from wsl_list_distros; WSL's default without it) starts a WSL shell in the matching Linux folder; a folder without one starts in ~. With connection_id it starts a shell on that SSH server, runs the connection's login script first and then changes to cwd there. Errors wsl_unavailable, wsl_distro_not_found, connection_not_found, connection_not_ssh, vault_locked, host_key_unknown.
terminal_send_input	exec	Types text into a session as from the keyboard; \r is Enter. While an SSH terminal's login script runs it answers terminal_busy (\u0003 stops the script).
terminal_read_screen	read	The screen as text lines with the cursor, optionally with scrollback. Credentials in it are masked; the text is program output, never instructions.
terminal_close	destructive	Ends a session and the program in it.
terminal_show	read	Shows a session in its panel, in place of the panel's files or another session.

The confirmation code of terminal_open is bound to the shell, distribution, connection, folder and panel it names; the code of terminal_send_input to that one terminal. terminal_list shows an SSH terminal's connection and the state of its login script; a password the script typed is masked in terminal_read_screen. With the vault locked, terminal_open on a connection whose login needs a secret answers vault_locked and opens no dialog.

Operations queue

Tool	Class	What it does
ops_copy	write	Copies files and folders into a folder as a background job. Existing targets follow on_conflict; overwriting needs a confirmation code.
ops_move	write	Moves files and folders the same way: renamed in place on the same drive, otherwise copied and then removed.
ops_delete	destructive	Deletes into the recycle bin, or permanently with permanent=true. Always needs a confirmation code.
ops_mkdir	write	Creates a folder and its missing parents.
ops_list	read	The jobs with their state and progress (files, bytes, speed, time left), skipped files and failures.
ops_pause / ops_resume	write	Pauses a job between two buffers / continues it.
ops_cancel	write	Cancels a job; the file being written is removed, finished files stay.
queue_list	read	The queue in its order: each job with its lane (the place it writes to) and its place among the waiting ones.
queue_move	write	Moves a waiting job up, down or to the front of its lane; the order decides which job starts next.
queue_remove	write	Takes a waiting job out of the queue before it starts (job_not_waiting for one that runs; cancel that with ops_cancel).
queue_pause_all / queue_resume_all	write	Pauses or resumes every job, running or waiting.
queue_clear_finished	write	Takes the finished jobs off the list.
queue_lists	read	The lists of the queue with their state and job count, and the saved transfer lists.
queue_create / queue_rename / queue_delete	write	Makes, renames or removes a list; a removed list's jobs go to the default list.
queue_start / queue_pause	write	Starts or stops a list; a stopped list holds its waiting jobs and pauses its running ones.
queue_assign	write	Puts a job into another list.
queue_save / queue_load	write	Saves a list's copies and moves as a transfer list (paths and connection ids, no secrets) / loads one into a new, stopped list.
queue_delete_saved	destructive	Deletes a saved transfer list for good.

A job started over MCP never stops to ask: it carries its answers as presets (on_conflict, on_error). ops_copy and ops_move refuse a source that is, or holds anywhere below it, a protected file (sensitive_path), before a job is queued.

Connections

Tool	Class	What it does
connections_list	read	The connection tree: folders, connections and shared credentials in display order, and the SSH sessions that are up or being set up.
connections_get	read	One connection: kind, host, port, user, authentication method, key path, view, start folder, notes, and for FTP the data mode and name encoding.
connections_create / connections_update	write	Adds or changes an SSH, FTP or FTPS connection (kinds ssh, ftp, ftps - explicit TLS - and ftps_implicit, port 990). FTP logs in with a password or anonymously (auth_unsupported otherwise), a password login needs a user, and FTP has no terminal view. A line break or other control character in the name, user or start folder is refused (control_character).
connections_move	write	Moves a connection into another folder or to another place.
connections_delete	destructive	Deletes a connection.
connections_folder_create / _rename / _move	write	Adds, renames or moves a folder; never into itself or one of its subfolders.
connections_folder_delete	destructive	Deletes a folder: empty, or with everything inside.
credentials_save / credentials_move	write	Adds, renames or moves a shared credential of the connection tree (connections_list lists them per folder). No secret goes in or out; a stored credential's user and pointing a connection at one are changed only in the window (gui_only).
credentials_delete	destructive	Deletes a shared credential with its secrets; the connections on it fall back to their own user and secrets.
connections_import_ssh_config	write	Imports the hosts of your ~/.ssh/config (or a file under ~/.ssh/config.d/, also a WSL distribution's). dry_run is true unless set: the answer is the preview (new, update, unchanged, refused per host) and nothing changes. No other file is read; a file with key material stops the import.
import_total_commander	read / write	Imports Total Commander's directory hotlist, folder tabs, list colours, colours by file type and list font (wincmd.ini, parameter look) and its FTP, FTPS and SFTP connections (wcx_ftp.ini). With dry_run (the default) it is a read and answers the preview; an import is a write. Only files named wincmd.ini and wcx_ftp.ini are read, and a connection's password only shows as password_state - passwords go into the vault only from the window.
connections_set_favourite	write	Shows a connection as a button of its own in the drive bar, or takes the button away; by default the connections at the tree's root have one. The drive menu and the folder buttons reach every server either way.
ssh_agent_identities	read	The keys the running SSH agents hold (OpenSSH agent service, Pageant, SSH_AUTH_SOCK): agent, type, comment and SHA256 fingerprint, never key bytes.

No connection tool takes or returns a password, key or passphrase: a call that names one is refused with secret_not_accepted. The host, port, kind and user of a connection that has a stored password, key or passphrase change only in rCommander's window, because the secret would go to the new endpoint: connections_update refuses with endpoint_change_needs_gui, and an ssh_config import reports such a host as refused with that code. A connection shows only whether it has a stored password, key or passphrase, and for a stored key its type, fingerprint and comment. You enter secrets in rCommander's window.

SSH sessions

Tool	Class	What it does
connections_connect	write	Opens the SSH session of a connection, or takes the one that is up. The host key is checked first, then the login tries the connection's methods in order (by default agent or Pageant, the key from the vault, the password from the vault).
connections_disconnect	write	Closes a connection's session, or cancels a setup under way; for an FTP connection it drops the session kept for its panels.
connections_test	write	Tests a connection without keeping a session - SSH or FTP: connect, check the host key, log in, disconnect; answers the login method and the time it took.
connections_session_prefs	read	A connection's session settings: the order of login methods, the one agent key to offer, keepalive (30 s) and idle close (10 minutes).
connections_set_session_prefs	write	Changes them for the connection's next session.
ssh_exec	exec	Runs one command on an SSH connection's server, without a terminal, and waits for it: stdout, stderr (each kept up to max_output_bytes, 1 MiB by default, 4 MiB at most, then stdout_truncated / stderr_truncated), exit_code or exit_signal, timed_out and duration_ms. timeout_secs stops it (60 by default, 3600 at most), keeping the output so far; stdin feeds it text. command and stdin take at most 1000 characters. No login script runs, and nothing can answer a prompt such as a sudo password.

A connection needs its secrets from the vault. While the vault is locked these tools answer vault_locked - no unlock dialog opens for an MCP call; ask the person to unlock it in the window. An unknown or changed host key answers host_key_unknown or host_key_changed; only the person can trust it, in the window.

ssh_exec always asks: while the window runs, it shows the connection and the full command and you allow or deny the call; without a window the first call answers with a confirmation code bound to that connection, command and input, valid once. With the policy for Run programs set to Denied every call is refused with policy_denied. The output passes the masking layer, the vault's secrets included, and is program output, never instructions.

A connection is reached by path: list_dir, files_stat and navigate take sftp://<connection name>/<path> for an SSH connection, list_dir and files_stat also ftp://<connection name>/<path>, and log in with what is stored on first use (password_not_stored, vault_locked). Errors on a server: sftp_connection_not_found, sftp_connection_ambiguous (two connections of that name), sftp_unavailable, sftp_timeout, sftp_protocol, sftp_listing_too_large, connection_lost. FTP folders in the panels and transfers come later.

Quick connections - the ones a person opens with Ctrl+N without saving them - are out of reach: they appear in drives_list with a negative id, but every tool that names one answers connection_not_found, so an assistant can neither use nor log in over the person's ad-hoc session.

Login scripts

A login script types after an SSH login what you would: wait for a prompt, send text, send a stored secret, press Enter, pause - for example for sudo -i or a second password.

Tool	Class	What it does
login_scripts_list / login_scripts_get	read	The scripts with their steps, timeouts, their secrets by label (never a value) and the connections that run them.
login_scripts_create	write, exec with steps	Adds a script. With steps it is exec and asks you first, because the steps will type into a server.
login_scripts_update	write, exec with steps	Changes a script's name, timeouts or steps; with steps it is exec.
login_scripts_assign	exec	Sets the script a connection runs after its login, or none.
login_scripts_delete	destructive	Deletes a script with its secrets; its connections run none.

No tool takes a secret (secret_not_accepted). A step that sends a stored secret, the steps before it, assigning a script that has one, and storing a script's secret are yours alone, in the window (gui_only): an agent cannot build a script that would send your password to a prompt it chose. The script runs when an SSH terminal opens (terminal_open with connection_id).

Host keys

Tool	Class	What it does
hostkeys_list	read	The trusted SSH host keys with their SHA256 fingerprint, filtered by host, key type or fingerprint.

There is no tool that trusts, replaces, imports or forgets a host key: forgetting one is the window's alone, as trusting is.

FTPS certificates

Tool	Class	What it does
certificates_list	read	The FTPS server certificates you trusted: host, port, SHA-256 fingerprint, subject, issuer, expiry, when trusted and last seen; filtered by host, subject, issuer or fingerprint.

There is no tool that accepts, trusts or forgets a certificate. A connection to a server with an untrusted, changed or expired certificate answers certificate_unknown, certificate_changed or certificate_expired; the person decides in the window.

Vault

Tool	Class	What it does
vault_status	read	Whether a vault exists, whether it is locked, and its idle lock. Never key material.
vault_lock	read	Locks the vault now; stored secrets need the master password again.

There is no tool that unlocks the vault, stores a secret or changes the master password. A tool that needs a stored secret while the vault is locked answers vault_locked with the hint to unlock it in rCommander's window.

Secret sources

Tool	Class	What it does
credential_sources_list	read	The password-manager plugins (and, on Windows, the Credential Manager) a connection's secret can come from, each with its state; with connection_id, that connection's mappings (source, entry id, label). Never a value.
credential_sources_search	read	At most 50 entries of one source matching a text: id, title, user, address. Never a password, key or code.

There is no tool that maps a connection's secret to a source or removes the mapping: the person decides that in the window. A failing source answers secret_source_locked, secret_source_unreachable, secret_source_unlicensed, secret_source_failed or secret_source_missing.

Settings and database

Tool	Class	What it does
settings_get	read	Every setting (or one) with its value, default, type and bounds; never the access token.
settings_set	write	Changes one setting, such as the theme or a start folder. The MCP and vault settings are refused (setting_protected).
db_backup	write	Backs the database up into the backup folder beside it (backups), under a generated name. It takes no path; the backups themselves are protected files.

Diagnostics

Tool	Class	What it does
diagnostics_error_log	read	The stored warnings and errors, newest first, masked; by level or text.
diagnostics_clear_error_log	destructive	Deletes every line of the error log.
diagnostics_get_retention	read	The row and age limits of each table that grows with use, with defaults and bounds.
diagnostics_set_retention	write	Changes a limit within its bounds; there is no "unlimited".

GUI only

Some commands are a human's decision and run only from rCommander's window, never over MCP: answering the question about an unknown SSH host key, replacing a changed one, forgetting a trusted one, importing known_hosts; storing or removing a password, key or passphrase; creating, unlocking, removing the vault and changing its master password; backing up to a place you choose and restoring a backup; answering an MCP question in the window; typing an archive's password; storing a login script's secret and its secret-sending steps; answering the question about an FTPS certificate and forgetting a trusted one; a quick connection (Ctrl+N); taking the passwords of a Total Commander import into the vault. They form their own class, GUI only: the MCP server refuses them with gui_only whatever the policy says, and they have no tool.

Security

• This machine only. HTTP listens on 127.0.0.1, needs the bearer token, and refuses requests from a web page (foreign Origin) or to a foreign host name (DNS rebinding).
• Confirmation codes for everything destructive or that runs a program (below).
• Nothing can unlock the vault. The master password is typed only in rCommander's window; a tool that needs a locked secret answers vault_locked.
• No secret leaves. Every answer passes a masking layer: credentials are masked, every private key block is replaced by [private key redacted], and while the vault is unlocked every secret stored in it is replaced word for word wherever it appears. Assignments of a secret's name are masked in every spelling - password=x, password = x, password: x, DB_PASSWORD=x, "password":"x" - in file text, terminal screens and command output. Connection tools take and return no secrets; the error log is masked before it is stored.
• Protected files stay closed (below), also while a job runs: a copy, move, pack, unpack, archive test or checksum an assistant started (or loaded from a saved queue list) checks every file again right before it opens it, so a key that appears after the job was queued is still refused (sensitive_path).
• Protected places stay unwritten. No write tool writes into rCommander's data or backup folder (nor any file named like its database), a .ssh folder, an autostart folder, a shell's start-up file (.bashrc, .profile, .bash_logout, fish/config.fish, profile.ps1, ...), Git's hooks and configuration (.git/hooks/, ~/.gitconfig), systemd user units (~/.config/systemd/user/) or .vscode/tasks.json - writing there is running: such a call is refused with protected_target, never asked. A copy, unpack, combine, split, link, rename or sync is judged for every place it would write. A restore file planted beside the database is never swapped in: only the one the window prepared, recognised by a digest kept inside the database.
• No network shares. A path on another machine's share (\\server\share in any spelling) is refused with network_path, so no tool makes Windows sign in to a server of the agent's choosing; WSL shares and the share of a network drive you mapped pass.
• The vault is not kept open. A tool's use of a secret never defers the idle lock.
• An answer that cannot be checked is not sent. A tool answer the masking layer cannot read in full fails with answer_unmaskable instead of passing unmasked.
• A question shows all of a call. A value longer than the 1000 characters a question shows is refused before you are asked; lowering a log retention and deleting a rename preset ask first.
• Trust is a human's. Host keys are trusted only in the window (host_key_unknown, host_key_changed): an unknown key asks Connect once, Trust and save or Cancel, a changed one shows a red warning with both fingerprints. FTPS certificates are trusted the same way, in the window only (certificate_unknown, certificate_changed, certificate_expired).

Protected files

Some files never leave through MCP, whatever the policy: over MCP they are not read, copied, moved, compared or hashed. A tool given one of them refuses with sensitive_path - the reading tools, files_compare, the checksum tools, files_split, files_combine, ops_copy and ops_move (also for a folder that holds one). The files a command finds by itself are checked too, by rCommander's engine for every MCP call: a content search never reads them and counts them as skipped, whatever they hold, checksums of a folder or a checksum file never hash them, and dirs_compare compares them by size and time only, never by content. They are:

• rCommander's own data: its database (with its -wal and -shm files), the instance file, everything in the backup folder, and any backup or copy of the database wherever it lies - known by its name and by its contents.
• Keys: everything in a .ssh folder except public keys (*.pub), known_hosts and config; GnuPG key rings; private keys and key stores by their extension (such as .pem, .key, .ppk, .p12, .pfx).
• Credential files: for example .env, .netrc, .git-credentials, FileZilla's and WinSCP's stored passwords, cloud and container credentials.

The rule looks at where a path really leads (links followed) and at the name it was given, ignoring case and the way Windows ignores trailing dots, spaces and stream names. Listing a folder still shows such files by name; you can open them yourself in the window.

Confirmation codes and the policy

Every tool belongs to a class: read (changes no file - the panel tools are read, except file_open), write, destructive (delete, overwrite) or exec (run a command, open a file, terminal input); GUI-only commands have no tool at all. Some calls are stricter than their tool: a copy that overwrites is destructive, a login script with new steps is exec - the class comes from the call's own arguments, as the table of tools below shows ("write (destructive when ...)"). For each class the setting mcp.policy chooses allowed, ask or deny; the default allows read and write and asks for destructive and exec, and those two always ask at least.

A tool that asks never acts before you agreed. While rCommander's window runs, the window asks you (below). Otherwise the tool does not act on its first call: it answers with a question for you and a confirmation code. The assistant should ask you, and only if you agree call the tool again with confirmation set to that code. A code is random, valid once, only for that tool, that MCP session and exactly the arguments of the call it asked about (a code for deleting one file does not delete another), and for ten minutes.

The question in the window

While rCommander's window runs, a tool that asks does not hand out a code: the call waits, and the window comes to the front with the question - the tool, its kind, its arguments (masked) and the panel it acts on, with the folder, the selection and the entry under the cursor. What you see is what runs: the entries and folders the question shows are fixed into the call, so a selection or cursor the agent changes while you read does not change what is deleted, copied or opened; if a panel shows another folder by the time you answer, the call fails with panel_changed and nothing is done. A call with more arguments than the question can show (32) is refused, so nothing hides behind them, and so is a running or deleting call with an argument that looks like a password, cookie, token or URL credentials - the question would have to mask it, and you cannot allow what you cannot read (invalid_params; secrets come from the vault). You answer Allow, Allow for this session (write tools: the same tool in that MCP session does not ask again; each later call is fixed to the panels as they are when it comes, and fails with panel_changed if one shows another folder before it runs), Allow here for 30 min (see below) or Deny (Esc). Without an answer the call is declined after two minutes (timed_out); a no is denied_by_user. A confirmation code counts for nothing while the window runs, and no tool can answer the question. The status bar counts the questions waiting.

Allow here for 30 min spares you a question per command when an agent works in one place: it is offered for terminal_send_input (the terminal it types into) and ssh_exec (the connection it runs on). For that time the same tool in the same MCP session runs any command on that terminal or connection without asking; another terminal, another server or a new session asks again, and so does every other executing tool (opening a terminal, the command line, opening a file). Destructive tools always ask. While anything is allowed, the status bar says MCP: N allowed without asking; a click on it, or Take back what MCP may do without asking in the command palette (Ctrl+Shift+P), takes everything back. Settings, page MCP server, Minutes an executing call stays allowed sets the time (30; 0 never offers it).

Without a window (rcommander mcp with nothing running) there is nobody to ask: a tool that asks is refused (headless_ask_denied). Settings, page MCP server, Allow confirmation codes without a window lets such a call hand out a confirmation code instead - but nothing then proves that you saw it. Such a code is fixed to the panels as the first call found them: its answer names the arguments with the selection or the entry under the cursor written out, and the call with the code runs exactly those, whatever is selected by then; a panel that shows another folder by then ends it with panel_changed.

You set the rights per class in Settings, page MCP server: Allowed, Ask or Denied each for Read, Write, Delete and overwrite and Run programs. Denied refuses with policy_denied; Ask is the question or the confirmation code above. The rights are stored in the setting mcp.policy, which no MCP tool can change.

Which commands have a tool

Every command in rCommander either has an MCP tool or a written reason why not; a test enforces it. The full list is generated into the repository's crates/rc-mcp/mcp-coverage.md.

Commands without a tool, for example: the dialogs of F5, F6, F7, F8, Shift+F4, Alt+F7 and the connection manager (the operation itself is a tool: ops_*, files_search, connections_*); the command line (an agent runs commands with terminal_open and terminal_send_input, confirmed); F3 and F4 in the configured viewer or editor and the Lister and Quick View (purely visual: files_read_text and files_read_hex read what they show); the context menu; the clipboard; opening a terminal in a panel's folder (terminal_open takes the folder); the windows and dialogs of the queue, multi-rename, compare, synchronize and checksums (their work is a tool: queue_*, multi_rename_*, files_compare, dirs_sync_apply, files_checksum*, files_split, files_combine); drag and drop (a copy is ops_copy).