AgentReach CLI
The reach CLI points a coding agent at any machine over SSH: keys and conversation stay with you and the target installs nothing
- 219 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The agent runs commands and edits files on a remote machine and the target's content flows into its context
- A hostile server can feed the agent instructions and there is no defence against prompt injection
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/agentreachDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs commands and edits files on a remote machine and the target's content flows into its context
- A hostile server can feed the agent instructions and there is no defence against prompt injection
This is third-party code. Review the repository files before installing.
What it does
AgentReach (the reach command) runs a coding agent on your computer and executes the work the agent hands to the operating system on a remote machine. An agent touches a computer two ways: it runs shell commands and reads or writes files. reach intercepts both on your side and sends the requests over one SSH connection. The API key and the conversation stay local and the target needs no agent and no install. Shell commands are redirected through each agent's own mechanism: Claude Code through CLAUDE_CODE_SHELL_PREFIX, Goose through GOOSE_SHELL, Codex through its remote-environment protocol, opencode through custom tools, and Gemini CLI and Grok Build by replacing the shell. Files work in exec mode (the agent's own Read, Write and Edit are disabled and it goes through the remote shell) and mirror mode (reach answers those calls itself and pulls the file over the same SSH, for Claude Code). Targets are user@host:path, ssh://, docker:// and podman:// addresses. The reach up, down, status, doctor and log commands show sessions and what ran on the target.
Who it is for. Developers and administrators who work on other people's or disposable machines (build boxes, staging VMs, containers) and do not want to install an agent with a key there.
Good fit when
- You need to fix a build server or a client staging box where you cannot keep your API key
- You do not want to bake an agent into every dev container image
- An agent should run commands on the target and read files over the same SSH
- You want to see and audit sessions on the target with reach log
Not a fit when
- You need an agent running permanently on a server: reach keeps the agent on your machine
- The target is not a POSIX system: reach expects POSIX targets, and the client can be Linux, macOS or Windows
- The server may hold hostile text and secrets sit in the agent's environment: reach does not eliminate prompt injection
Example request
Run reach build-box claude and find out what is eating disk space on that machineLimitations
The project is not stable yet: interfaces may change before 1.0, and the promised constants are the file-operation protocol, the session format and the rule that nothing lands on your server unless you asked for it. Claude Code is best verified and other agents are described in docs/harnesses at varying readiness. Interception does not protect from prompt injection: text from the target flows into the agent's context, so keep secrets out of the agent's local environment and read what it writes to local disk. Mirror mode copies files on demand and reads can be slightly stale. The last commit dates from 23 September 2026.
How to disable. Close the session with reach down and remove helper files from the target with reach helper uninstall. reach itself is deleted like any binary from the go install directory.
FAQ
Which agents does reach support?
Claude Code, Codex, Kimi Code, opencode, Goose, Crush, Gemini CLI and Grok Build. Claude Code is best verified and the rest are described in docs/harnesses.
How do exec and mirror modes differ?
In exec the agent's own Read, Write and Edit are disabled and it works through the remote shell; this is the default. In mirror reach answers those calls itself and copies the file over SSH on open and on change; this works for Claude Code.
What is installed on the target?
Nothing by default: tier zero needs only a POSIX shell and writes nothing. Crush is an exception: crush server runs on the target, so crush must be installed there.
Do I need SSH agent forwarding?
No. Agent forwarding is off and cannot be turned on: on a hostile server it would let someone authenticate as you elsewhere. reach uses your installed ssh with ProxyJump, IdentityFile and 2FA.
How is it different from SSHFS or an MCP server?
reach mounts no filesystem and syncs no files: it sits at the seam where the agent hands work to the OS and answers each request separately. The README has a comparison with SSHFS, an MCP server and plain SSH.
Discussion
No questions or reviews yet.
Related
CLI toolsA command-line SSH tool for agents: remote execution, file upload and download, and command allow and block lists.
A self-hosted control center for coding agents: Claude Code, Codex, Copilot, OpenCode and Pi from your phone, desktop and terminal
A Docker sandbox for coding agents: a Debian image with Copilot CLI, Codex and Pi, and SSH, RDP and Docker enabled by flags.
Brig runs Claude Code and other coding agents inside an isolated microVM on your machine with access to one project only.
Containarium: isolated boxes for AI agents
Containarium
A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files
Agent of Empires
Agent of Empires (AoE)
A session manager for coding agents: runs Claude Code, OpenCode, Codex and other CLIs in parallel, isolated tmux sessions with a TUI and web dashboard
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| AgentReach (this card) | no | 219 | ||
| SSH MCP | no | API key | 875 | an MCP server for running SSH commands, while reach redirects the agent's own work to the target with no install |
| MCP SSH Manager | no | API key | 539 | manages SSH connections through MCP, while reach intercepts the agent's built-in Bash and file calls |
README in short
The README explains the motivation (do not keep an agent key on someone else's machine), shows how command and file interception work, installation via go install or a container image, a table of agents with verification status, a command list, modes, the security model and project status.