# rc.center / AI hub

> rc.center is a hub for AI-assisted development. Its first product, AI hub (https://ai-hub.rc.center), does two things: it lets you start and supervise AI coding CLI sessions (Claude Code, Codex CLI) on your own machines from your phone or browser, and it keeps an end-to-end encrypted secrets vault that AI coding agents request secrets from through MCP, with a human approving every request on the phone or in the web panel.

Pricing: free for a vault with up to 25 items (machines, approvals and grants included); rc.center Pro removes the limit for US$ 9/month, or R$ 49/month in Brazil (promotional price, also includes OTPBox), at https://rc.center/account/plan. AI hub is provided by ZODO SOLUCOES EM TECNOLOGIA LTDA ("Zodo Studio"). Contact: contact@zodo.dev.

## Key concepts

- Vault and items: secrets live in an end-to-end encrypted vault. The key is derived on your device from a master password that never leaves it; the hub stores ciphertext plus readable metadata (secret names such as `production/deploy/DB_URL`, who asked for what and when). Names are paths: the first segment is the vault, and asking for `production/deploy/*` asks for a whole folder.
- Requests and approval: an AI session asks for a secret by name with a reason. Nothing is released until a person approves it on a signed-in device (Android app or web panel). The approver decides what is released and for how long.
- Grants: an approval is a grant with a lifetime of 15 minutes, 1 hour, 8 hours or 1 day, capped at 24 hours and at the account's own limit (a longer request is trimmed, never refused). Grants can be one-time, extended or revoked, and each grant shows its read count.
- End-to-end only: every delivery is sealed to a key generated on the session's machine, so the hub stores and forwards ciphertext it cannot read. A remote MCP client must send its own age public key (`age-keygen`, or `rc-agent keygen`), and a remote request without one is refused; the local agent's MCP server generates a per-session key and keeps its private half in memory. The private key never leaves the machine.
- TOTP: two-factor secrets are never handed out as the seed. An approval yields a grid of one-time codes covering the next 5 minutes, and each read returns the one code valid at that moment. TOTP grants last 5 minutes and cannot be extended.
- AI proposals: an agent that creates a credential (password, API key, TOTP seed) seals it to the account inbox key (`secret_inbox_key`) and proposes it with `secret_propose`. The private half of that key lives inside the vault, so only the owner can open it; the owner accepts all, some or none of the items on the phone.
- Audit: every request, approval, denial, delivery, extension and revocation is recorded by secret, client and session.
- Biometric unlock: the Android app can unlock the vault with fingerprint or face through the Android Keystore. Biometric data never reaches the hub.
- Machines: paired computers running the local agent `rc-agent` show their AI sessions and live metrics (CPU, memory, disk); sessions are started and stopped from the phone or the panel.

## Connect

- [Remote MCP endpoint](https://ai-hub.rc.center/mcp): streamable HTTP MCP server with OAuth 2.1 (dynamic client registration, human consent in the panel). Add it as a remote MCP server in Claude Code, claude.ai, Cursor, VS Code or any MCP client that supports OAuth. Nothing to install.
- [Local agent (rc-agent)](https://ai-hub.rc.center/local-agent): desktop binary for Linux, macOS and Windows. It pairs the machine with your account, runs your CLI sessions and serves a per-session MCP server that can deliver secrets straight to a file, outside the model's context.

## MCP tools

- `secret_request`: ask the account owner for a secret or a folder of secrets; opens a request a human approves, returns a request_id. `public_key` (an age recipient generated on the session's machine) is required.
- `secret_ls`: list the secret names an approved request covers (names only, never values).
- `secret_get`: fetch the answer to a request once approved: an age-sealed payload or, on the local agent, a file path.
- `secret_inbox_key`: return the account's inbox public key, used to seal values before proposing them.
- `secret_propose`: propose secrets you created for the owner's vault; the owner reviews and accepts on the phone.
- `secret_proposal_status`: report the owner's decision on a proposal (pending, accepted, rejected, expired).
- `system_status` (local agent only): CPU, memory, swap, load, disks and temperature of the machine the session runs on.

## Apps and pages

- [Product page](https://ai-hub.rc.center/): what AI hub does, how it works, security, pricing and FAQ (English; Brazilian Portuguese at https://ai-hub.rc.center/?lang=pt-BR).
- [Web panel](https://ai-hub.rc.center/login): sign in or create an account, approve requests, manage the vault, grants, proposals, audit, devices and machines.
- [Android app on Google Play](https://play.google.com/store/apps/details?id=center.rc.aihub): the companion app "AI hub", published by Zodo Studio.
- [Privacy policy](https://ai-hub.rc.center/privacy)
- [Terms of service](https://ai-hub.rc.center/terms)
- [Delete your account](https://ai-hub.rc.center/delete-account)
- [rc.center](https://rc.center/): the hub's home page.

## Optional

- [Full description](https://ai-hub.rc.center/llms-full.txt): security model, honest limits and an MCP usage example.