The documented Rebind remote.luau server, packaged for installation. Connect
your programs through JSON over WebSocket to send keyboard and mouse input,
read supported host state, and subscribe to events. It uses the existing
protocol and works with the
client libraries
and MCP server.
Set up
Requires Rebind Engine 3.5.0 or newer. Rebind Link is optional. Software mode uses host input APIs; hardware mode sends output through Link. Core scripting runs on Windows, macOS, and Linux, but screen, window, clipboard, and other OS integrations differ. Check platform support for the commands you intend to use.
- Open the installed package's
main.luauin Rebind and select Options. - Set a strong, unique Auth token before starting the script. The default is blank, which leaves remote commands open to any peer that can reach it.
- Leave WS port at 19561, or choose an unused port. Start the script from the editor toolbar. Restart it after changing the port.
- Connect to
ws://127.0.0.1:19561from this computer, or use the computer's address from another trusted machine. Use your chosen port if you changed it.
The listener binds all network interfaces, not just localhost. There is no localhost-only setting. Restrict access with the host firewall and use a trusted network or encrypted tunnel: the script serves plain WebSocket, not TLS. Stop the script when remote control is not needed. To revoke existing sessions after changing the token, stop and restart the script.
Connect
On a new WebSocket connection, authenticate with the token you configured:
{"t":"auth","id":1,"token":"YOUR_AUTH_TOKEN"}
Then request the available command names or the current time:
{"t":"commands","id":2}
{"t":"system.time","id":3}
These are requests, not recorded responses. The protocol reference owns the
full command list and response formats. For the MCP client, set REBIND_URL
to your server address and REBIND_TOKEN to the same token.
Optional command gates
The reference server keeps ALLOW_EXEC, ALLOW_FILE, ALLOW_REGISTRY, and
ALLOW_LUA_EXEC off by default. Change these constants in your installed
main.luau only when your client needs those commands, then restart the script.
They are not remotely editable settings. Some MCP tools require ALLOW_LUA_EXEC;
see the MCP documentation linked above before enabling it.
The manifest declares net for WebSocket and outbound HTTP commands, and
exec to retain the reference server's optional process-execution capability.
Declaring exec does not turn on ALLOW_EXEC. These gates do not make an open
server read-only: input, clipboard, window, and other control commands remain
available after authentication, or without it when the token is blank.
Stop and maintain
Stop from the editor toolbar. Left Ctrl + Left Alt + K stops all scripts and releases held input. Stopping this server also closes its listener and cancels its timers and audio playback.
In this repository, edit packages/lua-sdk/examples/remote.luau and run
just sync-remote-luau. The package entry is generated from that source with
only the standalone modeline removed; rebind.toml owns package metadata.
The parity test prevents an independently maintained protocol fork.
Listing artwork is an original illustration, not a runtime screenshot. Package preparation does not establish every command's behavior on every platform.

