Vör Commander
Public beta · local mode · open source · Windows

Your AI assistant works on your PC. You decide what it may touch.

Vör Commander is a remote agent with an MCP gateway, written in Rust for Windows. It gives your AI assistant controlled access to files, git, processes, and a bounded terminal on your machine, with signed approvals, tamper-evident audit, and without opening inbound ports.

It is open source (MPL-2.0) and anyone can install and use it in local mode on their Windows PC. Hosted remote access is not yet open to the public: it goes through a waitlist.

Download Remote access waitlist

The first ZIP release is coming soon. Today you can already build it from source.

  • Claude (remote connector, with waitlist)
  • ChatGPT (read-only connector, validated)
  • Cursor (in the pilot)
  • VS Code (in the pilot)
The problem

Giving an AI hands on your machine should not be an act of faith

Assistants already write code, run commands, and read your repository. The hard part is doing so without handing over control of the machine.

Who approved that?

A write or a command that no one reviewed is a write or a command no one can explain afterwards. You need an approval tied to the exact action, not a generic "yes".

What really happened?

If the log of what happened can be edited, it is useless as evidence. You need a chained audit that exposes any tampering.

How does it get in?

Opening a port on your PC so that an AI in the cloud can reach it widens the attack surface. The agent should reach out, not wait for connections.

How it works

From the assistant to your PC, no shortcuts

Every request passes through the MCP gateway and travels over a private tunnel to the agent on your PC, which re-evaluates the policy before acting.

  1. AI assistant

    Claude or ChatGPT as a remote connector with OAuth and PKCE; Cursor and VS Code locally with the pilot.

  2. MCP gateway

    Authenticates, applies the session scope, and exposes only controlled tools.

  3. Private tunnel

    Private mTLS transport. The agent connects outbound: no inbound port on your PC.

  4. Agent on your PC

    Re-evaluates local policy, confines paths, and executes only inside your allowed folders.

Approvals

Writes and terminal commands wait for your signed approval (Ed25519), tied to the exact request and single-use.

Audit

Every authorization, approval, and execution is recorded in a hash-chained log (SQLite + JSONL).

Flow: assistant → MCP gateway → private tunnel → agent on your PC, with approvals and audit at each step.
Features

What your assistant can do

We mark clearly what works today and what arrives with the pilot.

Files Today

  • Read files inside your allowed folders.
  • Write in two steps: prepare and confirm with signed approval.
  • Up to 1 MiB per write, with SHA-256 check before and after and atomic replace with backup.

Git and processes Today

  • git status and git diff of the repository.
  • List and inspect processes.
  • Read-only: there is no public tool to kill processes.

Bounded terminal Today

  • Structured arguments, never an opaque shell string.
  • Confined working directory, maximum 120 s and 1 MiB of output.
  • Asynchronous sessions: poll and cancel only your own.

Explore the project In the pilot

  • list_directory, search_files, and search_content with limits.
  • file_info for metadata.
  • read_file by ranges.

Policy-based approval Coming soon

Low-risk operations inside allowed folders run directly and are audited; destructive ones still request signed approval.

Security

Security you can prove, not just promise

Every guarantee on this list has an associated test in the product repository.

Signed approvals

Writes and terminal commands require an Ed25519 approval tied to the request identifier, its canonical digest, the policy, the required capability, the expiration, and a nonce. There is no approved=true shortcut.

No replays

Each approval is consumed once and that consumption is persisted. Replaying the same approval is rejected as approval_replayed.

Tamper-evident audit

SQLite log with a hash-chained JSONL mirror: authorizations, verified and consumed approvals, failures, and executions.

No inbound ports

The agent connects outbound via gRPC with private mTLS, with WSS as fallback. It never opens a public port to re-establish the connection.

Root folders and escapes

Work only happens inside the folders you authorize. .. and Windows reparse points (junctions and symbolic links) in the path are rejected.

Isolation between teams In development

Each device, session, approval, and audit event belongs to an organization, and the organization is derived from the authenticated identity, not from the request. Tested locally; not yet deployed.

Application policy is a barrier, not an operating-system sandbox. We do not claim OS-level containment.

Comparison

Vör Commander vs. Desktop Commander

Desktop Commander is a good tool and the reference in this space. This is an honest comparison, with only what we can back up.

Feature comparison. "—" means we make no claims on that point.
Feature Vör Commander Desktop Commander
Local MCP Yes, all code under MPL-2.0 Yes, open source (MIT)
Remote MCP Yes Yes
Signed approval for writes and commands Yes, Ed25519 and single-use —
Audit log Yes, hash-chained and tamper-evident Yes, local call history and audit logs
Allowed folders and symlink blocking Yes, also Windows junctions Yes, symlink prevention
Container isolation No; application guardrails, not an OS sandbox Optional, with Docker
Operating systems Windows Windows, macOS, and Linux
No inbound ports on your PC Yes, outbound private mTLS tunnel —
Included prompts 42, in Spanish More than 60
Free plan Free public beta (local mode) Free: 10,000 tool calls per month
Paid plan Remote access: waitlist Pro: USD 20 per month

Desktop Commander data per its public site (desktopcommander.app). Check there for its current terms.

Installation Beta

Local installation of the beta

A per-user ZIP package, no Windows service, no administrator rights, and no firewall changes. The local gateway listens only on loopback.

Available now: v0.1.0-beta.2 on GitHub Releases. The binaries are not yet signed with Authenticode: check the published SHA-256 before running them, or build it yourself from source following the README. It is a beta: the steps may change.

  1. Verify the package

    Compare the ZIP against its .sha256 file:

    Get-FileHash -Algorithm SHA256 .\vor-pilot.zip

  2. Extract and install with your folders

    Specify the folders it will have access to. A full drive is rejected; if you specify none, your Documents folder is used.

    .\scripts\installer\install-vor-pilot.ps1 -AllowedRoot 'D:\Projects\MyProject'

  3. The installer prepares your identity

    Creates the local CA, certificates, and credentials protected with DPAPI without you copying keys. Starts the gateway and the agent, checks their health, and calls commander_status.

  4. Start at login

    Registers a per-user scheduled task with limited privileges. Use -SkipStartupTask if you only want it for this session.

  5. Connect your assistant

    Add the vor-commander entry to Cursor and VS Code, with a backup of the previous JSON. Claude Desktop requires the local stdio adapter Coming soon.

  6. Uninstall without leftovers

    Stops only this installation's processes, removes the task and the client entries, and keeps the audit log unless you pass -RemoveData.

    .\scripts\installer\uninstall-vor-pilot.ps1

With the package's default policy, reads inside your folders are automatic and writes and terminal commands request approval. Destructive or elevated operations, the browser, desktop control, public ports, purchases, and secret extraction are denied.

Public beta

Public beta — local mode, open source

Anyone can install Vör Commander and use it on their Windows PC, free of charge and with all the code in the open. Hosted remote access is separate, with a waitlist.

Local mode Open

  • Agent and gateway on your own PC, no account and no cost.
  • Open source under MPL-2.0 on GitHub.
  • The first ZIP release is coming soon; today you can build it from source.
Download Build from source

Hosted remote access Waitlist

The managed gateway, to use Vör Commander from Claude or ChatGPT in the cloud, is not yet open to the public: cross-organization isolation is tested locally but not yet deployed, and we will not open the service before it is.

Join the waitlist

Questions, ideas, or bugs? Reach us on GitHub Discussions, or, if you prefer email, at [email protected].

Remote access

Remote access waitlist

Leave us your email and we will let you know when we can give you access to the hosted gateway.

Maximum 1000 characters

Privacy. We store your email, the name and intended use if you provide them, the date, your browser (user agent, truncated), and a fingerprint (hash) of your IP — never the IP in cleartext — used only to deter abusive submissions. We use this data solely to write to you about remote access. The anti-bot verification is provided by Cloudflare Turnstile. You can request deletion at [email protected].

Frequently asked questions

FAQ

Which operating systems does it run on?

The agent is written in Rust and the beta is for Windows. Interactive owner approval is currently only available on Windows.

Can the AI write or run commands without me knowing?

Not today: every write and every terminal command goes through a prepare step and a confirm step with your signed approval. Policy-based approval, which will let low-risk operations inside your folders pass through and be audited, arrives with the pilot; destructive operations will keep requiring your signature.

Do I have to open ports or touch the firewall?

No. The agent connects outbound over a private tunnel with mTLS, and the local installer does not change the Windows firewall or open public ports.

Where are my keys stored?

In your Windows profile, protected with DPAPI. The key you use to sign approvals is held by neither the gateway nor the agent: the agent only knows your public key.

Can it escape the folders I authorize?

Paths are confined to your root folders. .. and junctions or symbolic links in the path are rejected, and the terminal's working directory must remain inside an allowed folder.

Which assistants can I use?

Today, Claude as a remote connector (OAuth) with all the tools: read, git, processes, approved write, and terminal. ChatGPT: read-only connector (validated). Both remote connectors go through the hosted gateway, which for now is on the waitlist. The local installer wires up Cursor and VS Code automatically; a stdio adapter will bring local support for Claude Desktop Coming soon.

Is it open source?

All the code is open under MPL-2.0 and lives on GitHub. The hosted service is operated by Brier Studios; the "Vör Commander" brand is not covered by the code license.

How much does it cost?

The public beta in local mode is free. Hosted remote access does not yet have a public price: join the waitlist and we will write to you.

Why is remote access on a waitlist?

Because the hosted gateway's cross-organization isolation is tested locally but not yet deployed. Until it is, we are not opening the remote service to the public. Local mode does not depend on it and is open as of today.

Where do I ask questions or give feedback?

On GitHub Discussions. Security bugs, via the private channel described in SECURITY.md. You can also write to [email protected].