RemCTL 2.0.3

RemCTL 2.0.3 keeps your tailnet token where it belongs: in the Keychain of each device that uses it.

Fixes

• No more tokens in shell files. Setting up another device on your tailnet used to tell you to export RemCTL's token from ~/.zshrc, and the other setup commands contained the token too, so it ended up in dotfiles, shell history, and app config files. Codex also passes variables like that to every shell command it runs by default. Now remctl mcp config --format tailscale prints commands without the token. Each device saves it once in its login Keychain, and Claude Code, Codex, Claude Desktop, and Hermes read it from there when they connect. remctl mcp token marks the token as sensitive. Thanks to eD! Thomas for the report (#51).

If you used the old instructions

On the Mac with RemCTL, run remctl mcp token --rotate. On each other device, save the new token with security add-generic-password -U -a remctl -s remctl-mcp-token -w, reconnect each app with the commands from remctl mcp config --format tailscale, and delete the old export REMCTL_MCP_TOKEN=… line from your shell file. mcp.md walks through it.

Install or update

Download RemCTL-arm64.dmg below, open it, and double-click 'Install RemCTL'. Coming from an earlier 2.0 release, it asks for your Mac password once, to install this release's Python. From a checkout: git pull, then ./install.sh --from-source.

Validation: 850 tests; the new setup tested end to end with Claude Code, Codex, Hermes, and Claude Desktop's mcp-remote bridge; both apps and the disk image notarized by Apple with stapled tickets; Gatekeeper accepts the disk image and both apps from a quarantined download.

SHA-256 (RemCTL-arm64.dmg): 553eaba5196db571934e29d54ebf02e5dd9567813c21a5c6cc2bb29e50c60c1d