Dashboard

Your AI command center for remote computer management. Save the machines you control under friendly aliases, create a personal API key, and let any MCP client reach your machines by name instead of pasting session codes.

Machines

Give each machine a friendly alias and paste the session code its agent printed (looks like AIC-7K3P-WX9M-RTBN). A code does not rotate on its own — it changes only on reinstall or a manual change-code. Once a machine is linked to your account you can reach it by its alias at any time — until the owner blocks your account or resets the code (which clears all links and blocks) and you re-add it with the new one.

API keys

Put an API key in your MCP client to reach all your machines by alias, without pasting session codes. Treat a key like a password — anyone holding it can run commands on your machines.

Connected apps

Every app you approve through OAuth gets its own account-owned grant. Disconnecting an app immediately blocks its current access token, refresh token, and the entire refresh-token family. Reconnect from the app to authorize it again.

OAuth clients

Some MCP clients — like a Claude custom connector — let you paste an OAuth Client ID and Client Secret instead of a token. Create one here, then enter the Server URL https://aicommander.dev/mcp plus the ID and secret in the connector's advanced settings. You'll still sign in once in the browser to link the connector to your account. Treat the secret like a password.

The OAuth callback your MCP client returns to after sign-in. For Claude (Desktop, web, mobile) use https://claude.ai/api/mcp/auth_callback (pre-filled). For Claude Code add http://localhost/callback and http://127.0.0.1/callback (it uses a local port that we ignore). Must be https, or http on a loopback address. Separate multiple with commas. Then point the connector at https://aicommander.dev/mcp — connecting prompts a one-time sign-in that binds it to your account. (A confidential client is optional; most clients can just sign in.)

Service tokens

A service token is a long-lived, machine-facing credential for secure exec — it runs an allowlisted, sandboxed, non-root command on one machine and nothing else. Unlike an API key it never reaches the root command surface, has no expiry, and lives until you revoke it. Use one for CI or a server-to-server integration that must run a fixed set of commands unattended. Treat it like a password. Known shells, interpreters, argument runners and privilege/container clients are refused here and again by the agent.

Enter bare command names (no slashes or spaces), separated by commas or spaces. Shells/runtimes such as sh, python and node; runners such as env, find, xargs, awk and sed; and privilege/container clients such as sudo, docker and kubectl cannot be allowlisted.

Recent runs

The last secure-exec runs across your tokens. We record the command name, exit code, duration, caller IP and output size only — never arguments, input, or output.

Passkeys

Sign in with Face ID, Touch ID, Windows Hello, or a security key — no email link to wait for. Removing any passkey requires fresh confirmation with an existing passkey (including the one being removed) or an emailed code. You may remove your last passkey; email sign-in and email confirmation codes remain available, but passkey sign-in will stop until you add another.

Account