I built rcmd — a relay-based remote execution tool. Your server connects out to a relay; you connect to the same relay from your laptop; the relay routes commands between you. No SSH keys, no open ports, no VPN. It works behind NAT, CGNAT, corporate firewalls — anywhere that allows outbound HTTPS, which is everywhere.
Until now it was self-hosted-only: you run the relay on your own VPS, you run the daemon on your targets, you connect from your laptop. That works, but it has a gap. If you're behind CGNAT — which most home ISPs do now — you can't host the relay at home either. You need a VPS for the relay. And now you're paying €4-6/month just to forward traffic.
As of today there's a free hosted relay. Three servers, no credit card, no VPS required.
The three plans
-
Free (hosted) — 3 servers on
rcmd.intrane.fr, no credit card. New. - Pro (€5/mo) — unlimited servers, plus cron scheduling, port forwarding, team access, webhooks.
- Self-hosted (free, OSS) — run your own relay, unlimited everything, MIT licensed.
The free tier is the one that matters if you're homelabbing. Three servers covers most home setups — a NAS, a Home Assistant, a build box.
Set it up in 60 seconds
On your home server (the one behind CGNAT):
curl -sSL https://rcmd.intrane.fr/install.sh | sh
rcmd signup --free --email you@example.com
rcmd set-relay --url wss://rcmd.intrane.fr --name homeserver
rcmd daemon start -daemon
On your laptop, anywhere in the world:
rcmd login <your-token>
rcmd exec --target homeserver --cmd "uptime"
That's it. Your home server is reachable from anywhere. The daemon connected out; your laptop connected to the same relay; the relay routed the command.
What you actually get
This isn't just "run a command remotely." The relay model gives you a few things SSH doesn't:
Fast file transfer
rcmd cp --target homeserver --src ./config.yaml --dst /etc/app/config.yaml
Files stream through the relay in 2 MiB chunks with adaptive gzip and parallel streams. I benchmarked it faster than scp over high-RTT links — the relay's async write queue forwards chunk N to the target while the client sends chunk N+1, so the pipeline stays full. Directories are auto-tarred. No base64, no buffering the whole file in memory.
Port forwarding (tunnels)
rcmd tunnel --target db --local 5432 --remote 127.0.0.1:5432
Replaces ssh -L. Forward a local port to a remote address through the relay. Reach that database behind NAT without a VPN or a bastion.
Multi-target fan-out
rcmd exec --targets nas,homeassistant,buildbox --cmd "df -h" --format json
One command across every server. Results back as JSON — one per target, with stdout, stderr, exit code, and duration. No parsing SSH output, no parallel-SSH wrapper.
AI-agent native
Every command returns structured JSON. Deterministic timeouts. No parsing, no guessing, no wasted tokens. If you're building agents with Claude Code, Cursor, or Devin, you give the agent a token instead of an SSH key. I wrote about the security argument separately — but the short version is: an SSH key is a permanent credential with no scoping. A token is a revocable credential with per-target permissions.
Why not just self-host?
You can. The self-hosted relay is free and MIT licensed, with unlimited targets and all features unlocked. But self-hosting means you need a machine with a public IP to run it on — which, if you're behind CGNAT, is exactly the problem you're solving. You'd need a VPS for the relay, and now you're back to paying for a VPS.
The free hosted tier breaks that loop. I run the relay. You use it for free. Your home servers connect out to it. You reach them from anywhere. No VPS for you, no CGNAT problem, no credit card.
If you outgrow 3 servers — you add a fourth machine, or you want cron scheduling for backups, or you want to share access with a teammate — Pro is €5/month and removes the limit.
What the relay can and can't see
Fair question: if all my traffic goes through a relay, what can the operator see?
Commands and output pass through the relay, but they're not stored — the relay routes frames in memory and drops them when delivered. The relay authenticates both sides with tokens; it doesn't have your SSH keys because there are no SSH keys. If that's still too much trust, self-host the relay and keep everything on your own infrastructure.
Who this is for
- Homelabbers behind CGNAT who want to reach their machines without a VPN mesh or a VPS tunnel.
- People with 2-3 VPSes tired of maintaining SSH config, key rotation, and bastion setup.
- AI agent builders who need their agent to run commands on remote machines without SSH keys.
Try it
curl -sSL https://rcmd.intrane.fr/install.sh | sh
rcmd signup --free --email you@example.com
Three servers, no credit card, no VPS, no CGNAT workaround. Landing page: rcmd.intrane.fr. Source: github.com/javimosch/remotecmd-cli.
Previously: Stop Giving AI Agents Your SSH Keys — the security argument for the relay model. remotecmd parallel streams, faster than scp — the file transfer benchmark.
Top comments (0)