---

[!CAUTION]
Windows and macOS will show a security warning the first time you run ShellPilot.
This is expected, and it is not a virus.

The app is not notarized, and on Windows not signed at all — a code-signing
certificate costs $200–$400 a year for Windows and $99 a year for Apple, which a free
MIT-licensed project has no income to cover. The warning means your operating system
cannot confirm who published the app. It says nothing about whether the file is safe.

Every release is scanned by 70+ antivirus engines and publishes a SHA-256 for
each file, so you can verify the download yourself.
→ How to get past the warning, and the scan results

ShellPilot is a free and open-source alternative to MobaXterm, PuTTY, Termius, SecureCRT and MobaXterm Personal Edition, built for engineers who spend the day moving between bastions, production boxes and databases — and increasingly, for the AI coding agents helping them do it. It combines an SSH terminal, SFTP file browser, server monitoring, SSH tunnels, a multi-engine database client, an encrypted password vault and a secure MCP bridge for Claude Code, Claude Desktop, Codex and other AI agents in a single window — with no account, no telemetry and no subscription.

What makes it different isn't any one of those — MobaXterm, Termius and the rest each do some of this. It's that they're all in the same place, sharing the same credential store, and that credential store is now also what stands between an AI agent and your infrastructure, not something an agent ever has to be handed directly.

Why ShellPilot

Most terminal tools do one thing. A typical DevOps task needs four: open a shell through a jump host, tail a file, poke a database that is only reachable from inside the network, and look up a credential. ShellPilot puts those in one place, keeps them organised per project, and stores every secret in your operating system's keychain rather than a plaintext config file.

• No lock-in — connections import from your existing ~/.ssh/config
• No account — nothing is uploaded, nothing phones home
• No cost — MIT licensed, free forever, contributions welcome
• No exposed credentials, even to AI — Claude Code, Claude Desktop and Codex can run commands and read files through it, but never see a password, private key, IP or username — see AI Agent Access

ShellPilot vs MobaXterm, PuTTY, Termius and SecureCRT

If you are looking for a free MobaXterm alternative, a modern PuTTY replacement, or an
open-source Termius alternative that does not put your saved servers behind a subscription,
this is the short version:

	ShellPilot	MobaXterm	PuTTY	Termius	SecureCRT
Price	Free, MIT	Free tier, paid Pro	Free	Free tier, paid Pro	Paid licence
Open source	Yes	No	Yes	No	No
Windows / macOS / Linux	All three	Windows only	All three	All three	All three
Account required	No	No	No	Yes for sync	No
Telemetry	None	Some	None	Yes	Some
Saved sessions limit	Unlimited	12 on free tier	Unlimited	Limited on free tier	Unlimited
Chained jump hosts	Unlimited	Yes	Manual	Yes	Yes
SFTP browser	Built in	Built in	Separate app	Built in	Built in
SSH tunnels + SOCKS5	Yes	Yes	Yes	Yes	Yes
Database client	PostgreSQL, MySQL, SQL Server, MongoDB, Redis	No	No	No	No
Encrypted secrets vault	Yes, AES-256-GCM	Password store	No	Cloud vault	No
Live server monitoring	Yes	Basic	No	No	No
Rebindable shortcuts	Every one	Partial	Partial	Partial	Yes
AI agent integration (MCP)	Yes, access-group scoped	No	No	No	No

The point of difference is the database client and the vault. Every other tool in that table
sends you to a second application the moment you need to query a table or look up an API key.

Features

SSH terminal	Full xterm terminal with GPU rendering, search, split panes, copy-on-select and configurable zoom
Jump hosts / bastions	Unlimited chained hops per server, each with its own credentials
Two-factor auth	Answers keyboard-interactive challenges; connections are shared so you enter a code once, not per session
SFTP browser	Browse, edit, upload, rename and delete files over the same connection
Server monitoring	Live CPU, memory, disk and network docked under the terminal, with resource alerts
SSH tunnels	Local forwards, remote forwards and a SOCKS5 proxy
WireGuard	Userspace WireGuard with no administrator rights — the tunnel appears as a local SOCKS5 proxy and forwards, and your routing table is never touched
OpenVPN	Bundled on macOS and Linux, driven over its management interface, with one-time codes and split tunnelling
frp	Publish a local port through an frp server, with a per-proxy confirmation naming exactly what becomes reachable
SSH & databases over VPN	Point a server or a database at a VPN profile and it is brought up, waited for, and torn down with the session
Databases	PostgreSQL, MySQL, SQL Server, MongoDB and Redis — with an interactive shell per engine
Databases over SSH	Reach a database that is only routable from a bastion
Vault	AES-256-GCM encrypted store for URLs, logins, API keys and free-form key/value pairs
Workspaces	Isolated, optionally password-protected spaces per client or environment
Encrypted backup	One passphrase-protected file containing everything, portable across machines
Host key verification	Trust-on-first-use, with a hard stop when a key changes
Rebindable shortcuts	Every shortcut is remappable per context, with conflict detection and export/import
AI & MCP	Let Claude Code, Claude Desktop, Codex and other MCP clients operate your servers — scoped by access group, with human approval on sensitive actions

AI Agent Access

Claude Code, Claude Desktop, Codex, Gemini CLI and anything else that speaks
MCP can list your servers, run commands, browse/edit files and
check metrics through ShellPilot. The agent asks for a server by its friendly name; ShellPilot
resolves the real connection, enforces per-capability policy, and can stop and ask you before
anything sensitive runs.

An AI agent connected through ShellPilot never receives:

• SSH passwords
• SSH private keys or passphrases
• Database passwords or connection-string credentials
• Vault secrets — there is no MCP tool that can read the Vault at all
• Sudo or root access — unrestricted shells (sudo -i, su, ...) are refused outright, for every access group, with no setting that turns it back on

It only ever gets a friendly server name, whatever a capability's ALLOW/ASK/DENY setting permits,
and redacted text output. See AI-SECURITY.md for the full threat model —
including what this design does not claim.

The never receives list above is enforced by an access group — a per-capability
ALLOW/ASK/DENY policy, not a single yes/no switch. Four built-in groups ship with ShellPilot
(Read Only, Read & Write, Sudo Access, Full Access); create as many custom ones as you want, and
override individual file paths on top of the blanket read/write setting:

A worked example

You ask Claude Code: "Check my production Nginx server."

1. Claude Code calls ShellPilot's list_servers tool. It gets back friendly names for whatever
   the session's workspace(s) and access group can see — say, Nginx Server Prod — never a host,
   IP or username.
2. It calls get_server_metrics (or execute_command with something like systemctl status nginx) naming that server. ShellPilot resolves "Nginx Server Prod" to the real server record,
   checks the access group governing it, and — if that capability is ALLOW — looks up the actual
   SSH credential from your OS keychain and connects. If it's ASK, the request sits in
   Approvals until you decide.
3. The command runs over a normal SSH connection, the same one an interactive terminal session
   would use. Output is scanned for known secrets and secret-shaped patterns and redacted before
   it's returned.
4. Claude Code sees the result — CPU, memory, systemctl output, whatever was asked for — and
   reports back to you. It never saw the server's IP, its username, or the key that authenticated
   the connection. The whole exchange is in the Audit Log, alongside anything else ShellPilot
   allowed, asked about, denied or failed:

Connecting an agent

The quickest route is AI & MCP → Overview → Connect an agent. One click turns on the bridge,
gives any unassigned workspace an access group, creates a session, and hands it to the client:

Button	What it does
Connect Claude Code	Copies a ready claude mcp add command, token already in it — paste it in a terminal
Connect Claude Desktop	Writes the bridge entry into claude_desktop_config.json, merging with whatever is already there
Connect Codex	Writes a managed [mcp_servers.shellpilot] block into ~/.codex/config.toml

Existing config files are backed up first, other MCP servers in them are left alone, and running a
button again replaces its own entry rather than adding a second one. A workspace you have already
assigned to an access group — including No AI Access — is never reassigned.

There is also a CLI, if you would rather not click:

Command	What it does
shellpilot claude	Registers ShellPilot with Claude Code (claude mcp add) and launches it — a one-time pairing code appears in ShellPilot instead of copying a token by hand
shellpilot codex	Same, for Codex — writes a managed block into ~/.codex/config.toml
shellpilot run -- <command>	Same pairing flow for any other MCP-aware CLI, via SHELLPILOT_MCP_COMMAND/SHELLPILOT_MCP_ARGS

On macOS the shellpilot command is not added to your PATH by the installer — only the Windows
installer does that. Use the Connect buttons, or call the launcher inside the app bundle directly.

Every other client connects over Streamable HTTP with a URL and a bearer token that
ShellPilot's own Security tab generates for you:

Claude Desktop is the exception — it cannot use that URL. See
Connecting Claude Desktop below.

Adding a token manually

Not every client has a one-command launcher yet:

1. AI & MCP → AI Agents → New AI agent session — pick a workspace and an access-group
   ceiling, then Create session.
2. The token is shown once, next to a ready-made JSON block — click Copy JSON config, or
   copy the raw token if you'd rather write the entry yourself.
3. Paste it into the client's own MCP config file, under mcpServers.
4. Restart the client.

{
  "mcpServers": {
    "shellpilot": {
      "type": "http",
      "url": "http://127.0.0.1:<port>/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Claude Code needs no file editing at all — one command registers the same thing:

claude mcp add -s user --transport http shellpilot http://127.0.0.1:<port>/mcp --header "Authorization: Bearer <token>"

Connecting Claude Desktop

Claude Desktop does not read url or headers from claude_desktop_config.json. Entries in
that file are launched as stdio subprocesses; Desktop's remote-server support is a separate
account-level Connectors feature with nowhere to put a bearer token for a 127.0.0.1 address.

ShellPilot ships a stdio bridge for exactly this case — a pure protocol relay that forwards
messages to the same authenticated HTTP endpoint, so a stdio-only client gets the identical
policy, approval and audit path (src/cli/bridge.ts). Point Desktop at it:

{
  "mcpServers": {
    "shellpilot": {
      "command": "/Applications/ShellPilot.app/Contents/MacOS/ShellPilot",
      "args": [
        "/Applications/ShellPilot.app/Contents/Resources/app.asar.unpacked/out/cli/index.js",
        "bridge", "--token", "<token>", "--port", "<port>"
      ],
      "env": { "ELECTRON_RUN_AS_NODE": "1" }
    }
  }
}

On Windows, the two paths become %LOCALAPPDATA%\Programs\ShellPilot\ShellPilot.exe and
%LOCALAPPDATA%\Programs\ShellPilot\resources\app.asar.unpacked\out\cli\index.js.

The config file lives at ~/Library/Application Support/Claude/claude_desktop_config.json on
macOS and %APPDATA%\Claude\claude_desktop_config.json on Windows. Restart Desktop afterwards.

ELECTRON_RUN_AS_NODE makes ShellPilot's own bundled Electron binary run the bridge as plain
Node, so nothing has to be installed separately and none of this depends on what is on your
PATH — which Claude Desktop does not inherit from your shell.

Give the Desktop session no expiry. Set Expires to Never when creating it. The
default is 60 minutes, after which Desktop silently stops being able to reach ShellPilot until
you issue a new token.

The token is shown only once and stored only as a hash — if you lose it, revoke that session
under Active Sessions and create a new one rather than hunting for it:

Full technical guide (architecture, sessions, Access Groups, pairing, troubleshooting):
docs/AI-MCP.md. Threat model: docs/AI-SECURITY.md.

Real-world use cases

• Production troubleshooting — ask an agent to check a service's status, tail a log, or sample
  CPU/memory on a server named in plain English, without ever handing it that server's key.
• Bastion / jump-host operations — the same friendly-name resolution works through chained
  hops; an agent scoped to a workspace behind a bastion never needs the bastion's credential
  either.
• Database investigation — an agent with databaseAccess allowed can query a database that is
  only reachable through an SSH tunnel, the same way a human session would reach it.
• Log investigation — a Read Only or purpose-built "Logs Only" access group lets an agent
  search and summarise logs across a fleet without any path to modify anything.
• Controlled production changes — set the capability that matters to ASK; a config edit or a
  restart waits for your explicit approval instead of running unattended.
• AI-assisted DevOps generally — the same terminal, SFTP, database and monitoring tools you use
  by hand are available to an agent, scoped by workspace and access group exactly like a second,
  more limited pair of hands.

Install

Download the latest build from the Releases page.

Platform	File	Notes
Windows 10/11	ShellPilot-x.y.z-setup.exe	Installer, desktop + Start-menu shortcut. Pick this one if unsure.
Windows (portable)	ShellPilot-x.y.z-portable.exe	Single file, no install, keeps its data beside the .exe — runs from a USB stick
macOS (Apple Silicon)	ShellPilot-x.y.z-arm64.dmg	M1 and later
macOS (Intel)	ShellPilot-x.y.z-x64.dmg	Intel Macs
Linux	ShellPilot-x.y.z-x86_64.AppImage	chmod +x ShellPilot-*.AppImage and run — works on any distribution
Linux (Debian / Ubuntu)	ShellPilot-x.y.z-amd64.deb	sudo apt install ./ShellPilot-*-amd64.deb

What are the other files on the release page?

Six of the assets on a release are the downloads above. The rest are build
metadata or source archives, and you can ignore them.

Asset	What it is	Do you need it?
*.blockmap	A map of the installer's content blocks, used to work out which parts of a file changed between two versions so an update can download only the difference.	No — it is only read by an updater, never by you.
Source code (zip / tar.gz)	A snapshot of the repository at the tagged commit, generated by GitHub. Not a build — it contains no application, just the source.	No, unless you intend to build from source.

First run: why your computer shows a warning

ShellPilot is not notarized, so the first time you run it you will see a security
warning. Nothing is wrong with the download; the warning is about a missing certificate,
not about the app.

Windows and macOS both expect an application to be signed with a code-signing
certificate — an identity certificate bought from a certificate authority, currently
around $200–$400 a year for Windows (or roughly $99/year for an Apple Developer
account on macOS). ShellPilot is free and MIT licensed with no income behind it, so that
certificate does not exist yet. Every unsigned app gets the same treatment, whoever wrote
it.

The macOS builds are ad-hoc signed — a signature that seals the bundle's contents but
carries no identity, so macOS can still tell you the app has not been tampered with since
it was built. What it cannot do is tell you who built it, which is what notarization is
for. The Windows builds carry no signature at all.

The warning does not mean the file is unsafe. It means the operating system cannot
confirm who published it. You can confirm that yourself — see
Verifying a download below, and the entire source is public.

Windows — "Windows protected your PC"

SmartScreen shows a blue dialog saying "Windows protected your PC" and the Run
button is hidden.

1. Click More info
2. Click Run anyway

You may also see a "publisher unknown" prompt from User Account Control — that is the
same missing-certificate cause. This happens on the first run only.

macOS — "Apple could not verify ShellPilot is free of malware"

Gatekeeper refuses to open the app, because the build has not been notarized — Apple has
not been asked to scan it, which requires the paid developer account above. The wording
varies a little between macOS versions; older ones say "cannot be opened because the
developer cannot be verified".

• macOS 15 Sequoia and later — open System Settings → Privacy & Security, scroll
  down to the message naming ShellPilot, and click Open Anyway. Sequoia removed the
  older right-click shortcut, so this is the only way through in the interface.
• macOS 14 and earlier — right-click (or Control-click) the app → Open →
  Open in the dialog.

Either way this is the first launch only; afterwards the app opens normally.

If you would rather do it from the Terminal, this clears the quarantine flag macOS attaches
to anything downloaded through a browser:

/usr/bin/xattr -cr /Applications/ShellPilot.app

The /usr/bin/ prefix is deliberate. If you have installed xattr through Homebrew or
pip, that copy comes earlier on your PATH and does not accept -r — it prints a usage
message and clears nothing, which looks exactly like the command having failed to help.

macOS — "ShellPilot is damaged and can't be opened" (releases 0.2.2 and earlier)

The download is not damaged, and this is fixed in releases after 0.2.2. Builds up to and
including 0.2.2 left the macOS app unsigned, which meant the bundle still carried the
signature Electron itself ships with — a signature covering none of ShellPilot's own files.
Gatekeeper reads that mismatch as a corrupted download and words it this way instead of the
ordinary "could not verify" message above. Unhelpfully, this particular dialog offers no
Open Anyway button, so there is nothing to click through.

If you want to satisfy yourself the file arrived intact before doing anything else, check the
release's SHA-256 against your download — see Verifying a download.

Do not move it to the Trash. Run this once instead:

/usr/bin/xattr -cr /Applications/ShellPilot.app

Then open the app normally. If it still refuses:

• Check the path is right — drag the app into the Terminal window after typing
  /usr/bin/xattr -cr rather than typing it out.
• Make sure you are pointing at the copy in /Applications, not the one still sitting in
  ~/Downloads.
• Keep the /usr/bin/ prefix. A Homebrew or pip xattr earlier on your PATH does not
  support -r and will quietly do nothing but print its usage text.

Newer releases are ad-hoc signed, which puts them back into the ordinary "could not verify"
category above — still a warning, but one with a button.

Linux — no warning

Linux does not gatekeep unsigned binaries, so there is nothing to bypass. Just make the
AppImage executable:

chmod +x ShellPilot-*.AppImage

Will this be fixed? Yes — signing and notarization are planned once the project can
cover the annual certificate cost. Until then the macOS builds are ad-hoc signed so the
warning is at least the ordinary, clickable kind, and the SHA-256 checksums on each
release are the way to verify what you downloaded is what was built.

Antivirus scan

Because the builds are unsigned, every release is scanned automatically as part of the
build, by three independent scanners, before anything is published:

Scanner	What it is	Runs on
Microsoft Defender	The engine that ships with Windows — the same one that will scan the installer on your own machine	The Windows build runner, on the .exe files it just produced
ClamAV	The open-source engine, with signatures refreshed at build time	The Linux release job, across every artifact
VirusTotal	Aggregates 70+ commercial engines in one report	The release job, with a per-file report linked in the notes

A detection from Defender or ClamAV fails the build, so a release that exists at all
has passed both. The results — and the VirusTotal links for each file — are printed in
every release's notes.

If you would rather check for yourself rather than trust a link in a README, you can:

• Look the file up by its hash. Every release lists a SHA-256 per asset. Paste it
  into virustotal.com — searching by hash proves the report
  belongs to the exact bytes you downloaded, which a link alone does not.
• Upload the file to VirusTotal yourself.
• Build from source. The entire application is in this repository; see
  Build from source.

A note on false positives. Unsigned Electron applications are flagged by one or two
minor engines fairly often — an installer that unpacks an executable and opens network
connections is, structurally, what a lot of malware also does. A handful of detections
from engines you have never heard of, against a clean result from the major ones, is the
normal picture for an unsigned open-source desktop app. Code signing is what removes it,
and that is a cost problem rather than a technical one.

Verifying a download

Every asset on the release page lists its SHA-256. Compare it against the file
you downloaded — the builds are unsigned, so this is the strongest integrity
check available:

sha256sum ShellPilot-x.y.z-x86_64.AppImage    # Linux
shasum -a 256 ShellPilot-x.y.z-arm64.dmg      # macOS

Get-FileHash ShellPilot-x.y.z-setup.exe -Algorithm SHA256    # Windows

Build from source

git clone https://github.com/ghauri01/ShellPilot.git
cd ShellPilot
npm install

npm run dev          # run in development
npm run typecheck    # type check main, preload and renderer
npm run build        # bundle without packaging

npm run dist:win     # Windows installer + portable exe
npm run dist:linux   # AppImage + deb
npm run dist:mac     # dmg (must be run on macOS)

Requires Node.js 20+. Build each platform's installer on that platform.

Quick start

1. Add a server

Click + in the Connections sidebar, or press Ctrl+N.

Fill in the host, port and username, then pick how to authenticate:

• Password — stored in your OS keychain
• Private key — browse to the key file; the path and optional passphrase are stored in the keychain, never in plaintext
• SSH Agent — uses SSH_AUTH_SOCK, or Pageant on Windows
• Certificate — for certificate-based setups

Key files without an extension (id_ed25519, or any bare filename) are fully supported — the file picker shows all files by default.

2. Add jump hosts, in the same dialog

Servers inside a private network are reached through a bastion. Click Add jump host and the hops appear right there — no second dialog, no separate step.

Each hop can either:

• Use a saved server — the hop borrows that server's stored credentials, so a key is defined once and reused, or
• Be a custom host — set its own host, port, user and private key

Hops connect in order, top to bottom: you → Hop 1 → Hop 2 → target. Use the arrows to reorder.

3. Open a session

Click a server to open it. Double-click to open an additional session in a new tab — useful when you want one shell tailing logs and another running commands.

Sessions keep running when you switch workspaces, change views or open a database. Nothing is torn down until you close the tab.

Workspaces

A workspace is an isolated space with its own servers, folders, databases, tunnels and colour. Use one per client, per environment, or per project — whatever keeps unrelated infrastructure apart.

Open the switcher in the title bar, or Manage Workspaces (Ctrl+Shift+N).

What a workspace gives you

• Isolation — the sidebar, tabs and databases only ever show the active workspace
• Colour coding — pick a colour so production never looks like staging
• Fast switching — Ctrl+1 … Ctrl+9 jump straight to a workspace
• Hiding — clutter you rarely touch can be hidden from the switcher
• Password protection — lock a workspace behind a password
• Live sessions survive — switching workspaces never disconnects a running session

Password-protected workspaces

Toggle Password protect when creating a workspace, or use the padlock on an existing one. Anything that tries to open it — the switcher, the shortcut, the manager — asks for the password first. Unlocks last for the session only; everything re-locks when the app restarts. The password is stored as a scrypt verifier, never as recoverable text.

Scope of this feature: a workspace password gates access inside the app. It does not encrypt the workspace's servers on disk. For data that must be protected at rest, use the Vault or an encrypted backup.

Organising servers with folders

Folders keep a long server list navigable, and they nest as deep as you like.

Create a folder

The Connections toolbar has three actions — from left to right:

Icon	Action
📁+	New folder — creates a folder and drops straight into rename
⬇	Import from ~/.ssh/config — bulk-import your existing hosts
➕	Add server

There is also a small New folder button on the CONNECTIONS section header itself.

Create a subfolder

Right-click any folder → New subfolder. The same menu has Rename and Delete.

Deleting a folder never deletes its contents — servers and subfolders move back to the top level.

Move servers into folders

Drag and drop. Drag a server onto a folder to move it in; drag it onto the CONNECTIONS header to move it back to the root. Folders show a running count of everything inside them, including subfolders.

Databases have their own, separate folder tree with the same behaviour, so a "Staging" folder for servers does not clutter the database sidebar.

Import from ~/.ssh/config

Click the import icon to read your existing SSH config. ShellPilot parses Host, HostName, User, Port, IdentityFile and ProxyJump, applies Host * wildcard defaults the way OpenSSH does, and shows a preview so you choose what to import. ProxyJump entries become jump hosts automatically, carrying the referenced host's key.

Terminal

Action	Shortcut
Search the scrollback	Ctrl+F
Zoom in / out / reset	Ctrl++ / Ctrl+- / Ctrl+0, or Ctrl+scroll
Copy selection	Select (copy-on-select), or Ctrl+Shift+C
Paste	Right-click, or Ctrl+Shift+V
New session for this server	Double-click the server
Next / previous tab	Ctrl+Tab / Ctrl+Shift+Tab
Close tab	Ctrl+W
Command palette	Ctrl+K

Open files in your own editor. In the Files view, right-click a remote file
and choose Open in code to edit it in VS Code (or whatever you configure in
Settings → Editor). Saving uploads it back to the server automatically — no
download/re-upload dance. The inline editor is still there for quick edits.

Multi-line pastes ask first. Pasting more than one line into a remote shell
shows a preview and a confirmation, because every line runs the moment it
lands. Single-line pastes go straight through.

Control keys such as Ctrl+C, Ctrl+A and Ctrl+W pass through to the remote shell, so vim, nano and bash line editing behave normally.

Monitoring is docked under the terminal rather than hidden in a separate tab. Expand it for live CPU, memory, disk and network. It samples only for the tab you are looking at, and shares the terminal's SSH connection.

Resource alerts

When a host's CPU or memory reaches 80% (configurable) you get a native OS
notification, repeated once a minute while it lasts and cleared automatically on
recovery. A count also appears in the status bar.

Turning alerts on or off. Go to Settings → Monitoring and use the
Resource alerts toggle. They are on by default; switching them off stops
any further CPU or memory notification being raised for any server. The setting
is global — it applies to all hosts, not one at a time — and it persists across
restarts.

Under it, Alert threshold sets how hard a host has to be working before it
counts as high: 70%, 80% (default), 90% or 95%. The same
threshold applies to both CPU and RAM. Raise it if busy-but-healthy servers are
noisy, lower it if you want earlier warning. The threshold buttons are greyed
out while alerts are switched off.

The third toggle, Show monitor under the terminal, is independent: it
controls the live CPU/memory/disk/network strip docked below the session, not
whether you get alerted.

They are designed not to interrupt you:

• Notifications are handled by the operating system, so they render outside
  the window and never cover the terminal
• The status-bar chip sits in the layout, not floating over your output
• Nothing steals focus, and nothing must be dismissed before you carry on
• Alerts are evaluated from metrics already being sampled, so switching them
  on adds no extra SSH load

Fleet Monitor

Press Ctrl+M for a live wall of every server in the workspace —
CPU, memory, disk and network for each, with the estate totalled across the top.

Cards are grouped, so databases, application servers and bastions stay visually
separate rather than becoming one long list. Drag a card between groups, or create a
group from the button in the top right; anything unplaced collects in Ungrouped, and
groups collapse when you want them out of the way.

The header totals what you actually have: servers reporting, vCPU across the fleet, and
RAM and disk as used-against-capacity. Every figure comes from the metrics already being
sampled for open sessions, so opening this view adds no extra SSH load.

Command palette

Press Ctrl+K anywhere — including with focus inside a
terminal — to search everything and jump straight to it, without reaching for
the mouse.

Start typing to filter across every category at once, then Enter
to run the highlighted entry.

Group	What it does
Actions	Add Server, New Workspace, Import from ~/.ssh/config, Open Fleet Monitor, Open Connections
Settings	Jump straight into Settings
Workspaces	Switch to any visible workspace by name
Servers	Open a terminal on any server in the current workspace — matches on name and on user@host
Tunnels	Jump to a tunnel, shown with its listen → target

Key	Action
Ctrl+K	Open the palette (also Ctrl+Shift+P)
↑ / ↓	Move through results
Enter	Run the highlighted entry
Esc	Close

Because the search also matches the subtitle, typing part of a hostname or a
username finds the server even when you cannot remember what you named it —
[email protected] will find it just as well as Production API.

The palette works while you are in a session: hit Ctrl+K
mid-command, switch workspace or open another server, and the shell you left
keeps running exactly where it was.

Keyboard shortcuts

On macOS use Cmd in place of Ctrl.

Every shortcut below is rebindable in Settings → Keyboard Shortcuts, and
each one is listed there with the context it applies to:

Context	Meaning
Everywhere	Works with focus anywhere, terminals included
Outside terminals	Skipped while a terminal has focus, so the key reaches the remote shell
In terminals	Only fires with focus inside a terminal

That split is why the palette and the sidebar each have two bindings. A shell
owns Ctrl+K (kill-line) and Ctrl+B
(backward-char, and the tmux prefix), so those stay out of terminals and a
Shift-qualified twin covers you there instead. The command box in the title bar
follows your focus: it shows Ctrl+K normally and
Ctrl+Shift+P once you click into a terminal —
and it shows whatever you have rebound them to.

General

Shortcut	Action	Context
Ctrl+K	Command palette — search servers, workspaces, tunnels and actions	Outside terminals
Ctrl+Shift+P	Command palette	Everywhere
Ctrl+B	Show / hide the sidebar	Outside terminals
Ctrl+Shift+B	Show / hide the sidebar	Everywhere
Ctrl+,	Open Settings	Outside terminals

Tabs and sessions

Shortcut	Action	Context
Ctrl+N	Add server	Outside terminals
Ctrl+T	New terminal on the current server	Outside terminals
Ctrl+Shift+D	Duplicate the current tab	Outside terminals
Ctrl+W	Close the current tab	Outside terminals
Ctrl+Tab / Ctrl+Shift+Tab	Next / previous tab	Everywhere
Ctrl+</kbd>	Split right	Outside terminals
Ctrl+Shift+</kbd>	Split down	Outside terminals
Double-click a server	Open an additional session in a new tab

Workspaces

Shortcut	Action	Context
Ctrl+1 … 9	Switch to the Nth workspace	Everywhere
Ctrl+Shift+N	Manage workspaces	Everywhere
Ctrl+L	Lock the current workspace (password-protected ones only)	Outside terminals

Ctrl+1…9 is the one binding that cannot be
reassigned — the digit is the workspace number, not a key to map. Whether it
counts hidden workspaces is a setting.

Views

Shortcut	Action	Context
Ctrl+Shift+E	Open the Files view for the current tab	Everywhere
Ctrl+M	Open the Fleet Monitor	Outside terminals
Ctrl+= / Ctrl+- / Ctrl+0	Terminal font bigger / smaller / reset	Everywhere
Ctrl+scroll	Zoom in / out	In terminals
F12	Developer tools

Terminal

Shortcut	Action	Context
Ctrl+Shift+C or Ctrl+Insert	Copy selection	In terminals
Ctrl+Shift+V or Shift+Insert	Paste	In terminals
Ctrl+Shift+F or Ctrl+F	Search the scrollback	In terminals
Enter / Shift+Enter	Next / previous match while searching
Right-click	Paste (PuTTY / MobaXterm style)	In terminals
Select text	Copies automatically	In terminals

Text selection copies on release, and pasting more than one line asks for
confirmation first.

Customising shortcuts

Settings → Keyboard Shortcuts.

• Rebind — click a shortcut and press the keys you want. The combo is
  recorded exactly as pressed.
• Clear — press Backspace while recording to leave a command with
  no key at all. Esc cancels without changing anything.
• Restore one — a ↺ button appears next to any shortcut you have changed.
• Reset all — the Reset button puts every shortcut back to its default.
• Conflicts — two commands sharing a combo are flagged, but only when their
  contexts actually overlap. A terminal binding and an outside-terminal binding
  can safely share keys, because they never see the same key press.
• Export / Import — writes a small shellpilot-shortcuts.json holding only
  the shortcuts you changed, so it stays valid across upgrades. Importing
  replaces your current overrides.

Changes take effect immediately and are saved with the rest of your settings, so
they survive a restart.

Deliberately not bound

Key	Why
Ctrl+R	Reserved for the shell's reverse history search. ShellPilot never reloads on it — a reload would destroy every open session.
Ctrl+C, Ctrl+A, Ctrl+E, Ctrl+O	Passed to the remote shell so vim, nano and bash line editing behave normally.
F5	Blocked — it would reload the window and close every terminal.

Nothing stops you binding one of these yourself, but scoping it to
Everywhere will take it away from the remote shell.

Databases

ShellPilot speaks PostgreSQL, MySQL, SQL Server, MongoDB and Redis. Add a connection with discrete fields or a full connection string, browse tables and collections in the sidebar, and open each database in its own tab.

Every engine gets an interactive shell alongside the query editor:

• MongoDB — show dbs, use x, db.users.find({...}).sort({...}).limit(n), aggregation pipelines, ObjectId() / ISODate() helpers
• PostgreSQL / MySQL / SQL Server — SQL plus psql-style meta commands: \l, \dt, \d <table>, \du, \c <database>
• Redis — commands passed straight through

Databases over SSH: pick a bastion in the SSH tunnel field and ShellPilot opens a forward automatically, so you can reach a database that is only routable from inside the network.

Databases over a VPN: pick a WireGuard or OpenVPN profile in the Network field and the tunnel is brought up before the connection is attempted. A bastion and a VPN can both be set — the VPN is the outer transport, and the bastion is reached through it.

SSH tunnels

Create local forwards, remote forwards or a SOCKS5 proxy over any saved server. Live connection counts are shown per tunnel, and a dropped SSH connection tears the listener down rather than leaving it accepting traffic that goes nowhere.

VPN and reverse-proxy tunnels

ShellPilot speaks WireGuard, OpenVPN and frp. Full guide: docs/VPN.md.

The default is the unusual part: WireGuard runs entirely in userspace and needs no administrator rights. There is no network interface, your routing table and DNS are untouched, and if ShellPilot is killed there is nothing to clean up. The tunnel appears instead as local listeners — a SOCKS5 proxy on 127.0.0.1, and any forwards you define — and you point individual connections at it.

That trade is deliberate. Reaching one bastion, one database or one internal service does not need your whole machine on the far network. When it genuinely does, system mode is one toggle away on Linux and Windows and asks for elevation each time you connect — with two stated limits: a full tunnel (0.0.0.0/0) is refused, and macOS is blocked for want of an Apple Developer ID. docs/VPN.md explains both. Neither affects the default.

• Handshake age, not just a green dot. A WireGuard tunnel whose process is up but whose handshake has gone stale is shown as degraded in amber, not connected in green. Up-but-not-passing-traffic and down are different problems, and almost no client distinguishes them.
• SSH and databases over a VPN. Pick a profile on a server or a database and it is started, waited for, and torn down with the session. If it cannot come up you see the VPN's error, not a connect timeout twenty seconds later.
• Imported configs are treated as hostile. A .ovpn file can run programs — up, plugin, script-security and friends execute before the server is ever contacted. ShellPilot never hands your file to OpenVPN: it parses it, rejects anything that runs a program (quoting the line back to you), and generates a fresh config from what is left. PostUp/PostDown in a WireGuard .conf are refused the same way.
• Split tunnelling by default. redirect-gateway is off unless you turn it on, even when the profile asks for it. Downloading a profile should not silently reroute your machine.
• frp states what it exposes, in words. Each proxy carries a confirmation reading "Make 127.0.0.1:5432 reachable from frp.example.com." and the profile will not start until every one is ticked.
• An AI agent can never start an frp profile, and starting any VPN always asks for approval — even for an access group that allows it.

Every tunnel engine is bundled, and one of them is not open source. WireGuard (via the MIT wireguard-go), frp (Apache-2.0) and OpenVPN (GPL-2.0, macOS and Linux) are all built from pinned upstream source at release time — nothing to install, and each binary hash-verified before it runs. OpenVPN needs an adapter driver on Windows that cannot be shipped as a file, so a Windows OpenVPN profile still uses an OpenVPN you installed. Windows also ships wintun.dll, which is proprietary — the single component in ShellPilot that is not open source, needed only by WireGuard system mode. Bundling GPL software obliges this project to publish the matching source, and every release carries OpenVPN's as an asset. All of it is set out in THIRD-PARTY-NOTICES.md.

There is no kill switch. ShellPilot tears down what it started when a tunnel drops, and says so — it does not install firewall rules, and does not claim to.

Vault

An encrypted store for the credentials that do not belong to a single server — cloud logins, API keys, database URLs, licence keys.

• AES-256-GCM, with the key derived from your master password using scrypt
• The master password is never stored; a wrong one fails the authentication tag
• Entries hold a URL, username, password, notes, tags and any number of custom key/value fields, each markable secret
• Search matches every field, so you can find an entry by hostname or username, not just its title
• Plaintext exists only in memory while unlocked, and is wiped on lock and on quit

There is no recovery if the master password is lost. That is the point.

Backup & restore

Settings → Backup & Restore exports everything — workspaces, servers, databases, tunnels, stored credentials, the vault, workspace passwords and trusted host keys — into a single passphrase-encrypted file.

Credentials on disk are sealed with your OS keychain, which is tied to that machine and user, so a copied config folder is useless elsewhere. The backup unseals them and re-encrypts everything under your passphrase, which makes it portable to any machine.

A red Backup out of date indicator appears whenever your connections change, so you know when the last export no longer reflects reality.

Settings

Section	What it covers
General	Workspace-level preferences
Appearance	Theme (dark / light / system) and density
Terminal	Font family, font size (also Ctrl++/-), cursor blink, scroll behaviour
Connections	Defaults for new connections
SSH	How long an authenticated connection is kept after its last session closes, and a live list of shared connections with a Disconnect button
Security	Credential storage, workspace locking, and the list of trusted SSH host keys with a Forget button
SFTP	File transfer preferences
Monitoring	Resource alerts (on by default), the CPU/memory threshold, and the monitor strip
Editor	Built-in file editor
Keyboard Shortcuts	Rebind any shortcut, clear it, reset to defaults, export/import, and whether Ctrl+1…9 includes hidden workspaces
Backup & Restore	Encrypted export and import
Notifications	Alerts and toasts
Advanced	Diagnostics and resets

The SSH → Keep authenticated connection setting is the one to know if your servers use two-factor auth: while a connection is alive, new sessions, file browsing and monitoring all reuse it, so you are asked for a code once rather than every time.

Security

• Credentials are stored with Electron safeStorage, backed by DPAPI on Windows, Keychain on macOS and libsecret on Linux — never in plaintext
• The vault and backups use AES-256-GCM with scrypt key derivation
• Workspace passwords are stored as scrypt verifiers compared in constant time
• Host keys are verified: unknown hosts prompt with a SHA-256 fingerprint, and a changed key is refused outright
• Shell input is parsed, never evaluated — no eval on anything you type
• The renderer runs with contextIsolation on and nodeIntegration off, behind a strict Content-Security-Policy

Found a vulnerability? Please read SECURITY.md — do not open a public issue.

FAQ

What is ShellPilot?

ShellPilot is a free, open-source, cross-platform desktop application that combines an SSH
terminal, an SFTP file browser, an SSH tunnel manager, a multi-engine database client, an
encrypted secrets vault and a secure MCP bridge for AI coding agents (Claude Code, Claude
Desktop, Codex and others) in a single window. It runs on Windows, macOS and Linux, is released
under the MIT licence, and needs no account.

Which file should I download?

On Windows, ShellPilot-x.y.z-setup.exe unless you specifically want the
portable single-file build. On macOS, -arm64.dmg for an M1 or later and
-x64.dmg for an Intel Mac. On Linux, the .AppImage works on any
distribution, and the .deb is there if you would rather install through
apt on Debian or Ubuntu. The .blockmap and latest*.yml files on the
release page are build metadata — you never need to download them.

Is ShellPilot really free?

Yes. It is MIT licensed, free for personal and commercial use, with no paid tier, no
session limit and no subscription. Nobody should be charging you for it.

Is ShellPilot a good MobaXterm alternative?

It is the closest free alternative for most workflows, and unlike MobaXterm it runs on macOS
and Linux as well as Windows. There is no 12-session cap, no Professional Edition, and the
built-in database client and vault cover work MobaXterm sends you elsewhere for. MobaXterm's
X11 server and its bundled Cygwin toolchain have no equivalent here.

Can it replace PuTTY?

For day-to-day SSH, yes — with saved sessions, folders, tabs, a searchable scrollback and
right-click paste in the PuTTY style. It also imports the servers you already have in
~/.ssh/config, so there is no re-typing. Serial-port connections are not supported.

Is it an open-source Termius alternative?

Yes. The functional difference is sync: Termius syncs your servers through its cloud on a
paid plan, while ShellPilot keeps everything local and moves it between machines with a
passphrase-encrypted backup file. Nothing is uploaded and nothing phones home.

Does ShellPilot support jump hosts and bastions?

Yes — unlimited chained hops per server, configured in the same dialog as the server itself.
Each hop can either reuse a saved server's credentials or define its own host, port, user and
key. ProxyJump entries in ~/.ssh/config are imported as jump hosts automatically.

Which databases does it support?

PostgreSQL, MySQL, SQL Server, MongoDB and Redis — each with a table/collection browser, a
query editor and an interactive shell. Any of them can be reached through an SSH tunnel, so a
database that is only routable from inside the network still works.

How are my passwords and SSH keys stored?

In your operating system's own credential store through Electron safeStorage — DPAPI on
Windows, Keychain on macOS, libsecret on Linux. Nothing is written in plaintext. The vault
and encrypted backups add AES-256-GCM with scrypt key derivation on top of that.

Does ShellPilot send any data anywhere?

No. There is no account, no telemetry, no analytics and no update ping. Every connection it
makes is one you configured.

Does it work offline?

Yes, entirely. The app has no online dependency beyond the servers you connect to.

Does it support two-factor authentication?

Yes. It answers keyboard-interactive challenges, and connections are shared between sessions,
file browsing and monitoring — so you enter a code once rather than once per tab.

Why does Windows SmartScreen or macOS Gatekeeper warn about it?

Because ShellPilot is not notarized, and on Windows not signed at all. Both systems expect
an application to carry a code-signing certificate, which costs roughly $200–$400 a year for
Windows and $99 a year for an Apple Developer account — money a free, MIT-licensed project
with no income does not have. The warning means the operating system cannot confirm who
published the app, not that the file is unsafe. On Windows choose More info → Run anyway;
on macOS use System Settings → Privacy & Security → Open Anyway (or right-click →
Open on macOS 14 and earlier). Releases up to 0.2.2 can show "ShellPilot is damaged and
can't be opened" instead, which has no button to click through — run
/usr/bin/xattr -cr /Applications/ShellPilot.app for those, not the Trash the dialog
suggests. Full instructions are under
First run: why your computer shows a warning,
and every release publishes SHA-256 checksums so you can verify the download yourself.

What are the system requirements?

Windows 10 or later, macOS 11 or later (Apple Silicon and Intel), or a modern 64-bit Linux
distribution. Building from source needs Node.js 20 or later.

Can I connect Claude Code, Claude Desktop or another AI agent to ShellPilot?

Yes — see AI Agent Access. ShellPilot runs a local
MCP server that Claude Code, Claude Desktop, Codex, Gemini CLI
and other MCP-compatible clients can connect to, each session scoped to the workspace(s) and
access group chosen for it. The agent never sees a password, private key, database credential or
Vault secret — it only ever gets a friendly server name and whatever that session's access group
allows.

Is it safe to let an AI agent run commands on my servers?

It's as safe as the access group you assign it, and that's a real limitation, not a slogan — see
docs/AI-SECURITY.md for what this design does and does not protect against.
What ShellPilot does provide: the bridge only listens on 127.0.0.1, every capability (run
commands, read/write files, SFTP, tunnels, database access, sudo, metrics) is independently
ALLOW/ASK/DENY, sudo/unrestricted shells are hard-blocked regardless of group, and anything marked
ASK stops and waits for you to approve or deny it in ShellPilot — an agent can never approve its
own request. Every action is logged in the Audit Log with secrets redacted.

How do I move my setup to another machine?

Settings → Backup & Restore writes a single passphrase-encrypted file containing workspaces,
servers, databases, tunnels, credentials, the vault and trusted host keys. Restore it on the
new machine with the same passphrase.

How can I help?

Star the repository, report bugs, or open a pull request — see Contributing.

Contributing

Contributions are very welcome, whether that is code, documentation, a bug report or a translation. Start with CONTRIBUTING.md for the architecture overview and development workflow, and please follow our Code of Conduct.

Good first issues are labelled good first issue.

Licence

ShellPilot is released under the MIT Licence — free to use, copy, modify and share, for personal and commercial work alike, with no fee and no subscription.

This tool is not sold. It is given to the community. If someone is charging you for ShellPilot itself, you are being overcharged — download it here for free. The MIT licence does permit others to redistribute or build commercial products on top of it; that is a deliberate part of being genuinely open source, and it is what lets companies adopt it without a legal review.

Please do keep the copyright notice, and do not imply the maintainers endorse a fork.

---