Remote Pandrator targets

The MCP server is normally a local stdio sidecar launched by an agent host. One process is bound to one named target chosen in host configuration, outside model-visible tool arguments.

Local managed installation

The profile contains the Pandrator Manager workspace. The sidecar validates the Manager descriptor and process identity, discovers the current loopback application endpoint, and then connects. Release paths and ports may change without changing the target identity.

Home, LAN, or VPN

Prefer HTTPS even on a private network. Plain HTTP is allowed only when the profile explicitly acknowledges it and supplies the precise private CIDR. DNS must resolve entirely inside that CIDR. Link-local and cloud metadata addresses remain forbidden.

Use a stable DNS name or reserved address, configure Pandrator's exact public origin and trusted hosts, initialize a strong owner password, and restrict firewall access to the intended LAN or VPN.

External server

Expose Pandrator through an HTTPS reverse proxy with a valid certificate. Set the exact public origin and trusted proxy-hop count on the server. The profile uses that same origin; redirects are rejected. Keep the Manager's permanent local client endpoint private.

Direct app-down Manager recovery is optional. If enabled, expose a distinct HTTPS recovery origin and enroll a scoped, expiring automation credential through the human recovery UI. Never copy the Manager's local client secret.

Pod or container

Persist the Pandrator workspace and, for managed deployments, Manager state on durable volumes. Losing either volume changes the corresponding target identity and requires explicit re-enrollment. Terminate TLS at a trusted ingress, preserve the configured public origin, use deployment secrets for credentials, and apply network policy so only the required application and optional recovery routes are reachable.

Models in Codex, Antigravity, OpenCode, or Claude Code can help generate a pod, reverse-proxy, firewall, or system-service setup quickly. Treat that output as infrastructure code: give the agent the intended domain and platform, review the generated manifests, keep credentials in the platform secret store, and verify the resulting target with the MCP doctor command before enabling mutations.

A safe deployment request asks the agent to stop before deployment or public exposure, show the proposed listeners and trust boundaries, persist both application and Manager state, leave secret placeholders instead of values, and provide validation and rollback commands. The operator still owns DNS, TLS, firewall, proxy-hop, and volume decisions.

Workstation enrollment sequence

For an HTTPS server or pod, use this sequence on the workstation that runs the MCP host:

1. Add the fixed target and least-privilege application scopes.
2. Run pandrator-mcp target login NAME.
3. Pin the authenticated application identity.
4. Optionally run target configure-recovery NAME --origin HTTPS_ORIGIN, then separately run target login NAME --manager-recovery.
5. Run pandrator-mcp doctor --target NAME.
6. Generate the selected host fragment with pandrator-mcp host-config HOST --target NAME.

Application and recovery enrollment use browser owner consent and S256 PKCE. The CLI stores each result directly in the operating-system keyring.

Rotation, revocation, and removal

Re-running pandrator-mcp target login NAME rotates the application credential for the same client ID. The target revokes the preceding token and replaces the local keyring entry. Manager recovery rotates separately with --manager-recovery.

Revocation is authoritative on the target. Removing only a local profile or keyring item does not revoke a server-side credential. Revoke first, verify that access fails, then remove local configuration.

Practical validation

• Verify the canonical application and Manager identities after enrollment.
• Confirm that redirects, mixed-zone DNS, metadata addresses, and an unexpected certificate fail closed.
• Confirm that read-only scopes cannot mutate sessions, work, or Manager state.
• Confirm that the application and optional recovery credentials have different audiences and can be revoked independently.