termalAgent-native SSH client
A fast SSH client — for you and your agents.
The terminal you keep open all day — tabs, SFTP with a built-in editor, one-unlock keys. And the part that sets it apart: a hosted MCP endpoint your agents sign in to — Claude Code, ChatGPT, Claude, Codex, Cursor — reaching your servers keyless, every command in the audit log; in the desktop app you can watch them work and step in live. They never hold your keys.
Free tier on Windows, macOS, Linux & iOS · 14-day Pro trial · the browser terminal is part of Pro and Team — try the live demo or see all downloads.
00 / in one minute
The whole tour in 60 seconds.
The terminal, the toolkit, the MCP server for your agents, private servers with no open port, and end-to-end encrypted sync. It plays muted; turn the sound on in the player for the voiceover.
01 / what's inside
A complete SSH client — the one you keep open all day.
Everything you expect from a modern terminal, done properly and kept fast.
Tabbed terminal
Real xterm-256color sessions with browser-style tabs you can drag to reorder, a hosts sidebar, snippets, and session restore with scrollback.
SFTP + file editor
Browse remote files, upload and download, and edit in place with a built-in editor — no round-trip to a local copy.
Dual-pane files + S3
Two panes, drag between them — host to host, or straight to and from an S3 bucket, a first-class host beside SFTP and FTP. One drag replaces the download-then-re-upload round-trip.
Database client
Browse and query 13 engines — PostgreSQL, MySQL, MongoDB, Redis, ClickHouse, Elasticsearch, Cassandra and more — with a schema tree, a SQL editor and a structure view. Connect straight to a public database, or reach a private one through a Connector — no exposed port.
Port forwarding
Reach a service behind a server, expose a local one on it, or route traffic through it — in plain words, not -L/-R/-D. Saves per host, starts on launch, reconnects. Jump hosts (ProxyJump) included.
Keys & agent
Generate, import and manage SSH keys. Unlock once and Termalin's own agent signs for you — passphrases cached on your terms.
Command history
Every command, kept per host — and on Pro, synced across your devices, end-to-end encrypted so only you can read it. Search it, and turn any line into a snippet.
Command suggestions
Start typing and the rest of the command appears in-line — from your history on that host, the server’s own shell history and your snippets. → accepts; several matches open a picker. In the app and the browser alike.
Local terminal
Open a shell on your own machine as a tab — right beside your servers. Type claude, gemini or codex and it runs there, dropping you back at a prompt when it's done. New tabs reopen in your last directory.
Terminal themes
Colour your terminals to taste — 36 themes, from Dracula, Nord, Gruvbox, Monokai, One Dark, Material and Solarized to Termalin's own palette. Set one per host, a default for a folder, or one for the whole app — desktop and browser alike.
Live system stats
A status bar with CPU, memory, disk, network, load and uptime for the box you're on — at a glance, always current.
Monitoring & alerts
Every server with a Connector gets charts for CPU, memory, disk and network in the web cabinet, and alerts by email, push, webhook or Telegram in one click — nothing extra to install, no rules to write. No quiet hours to schedule; mute a whole server or one alert type when you need to. On Pro and Team. Server monitoring →
Rules for every AI connection
Each API key and signed-in AI app gets a scope — which servers — and a policy: full, an allowlist of commands, or read-only. Every command lands in the audit log. API keys come with ready-to-paste setup for Claude Code, Cursor and more.
Light on RAM
A Rust core and tab hibernation instead of leaking memory. It stays quick even with a wall of hosts open for weeks.
Cross-platform
One client for Windows, macOS, Linux and iOS — with native iPhone, iPad and Apple Watch apps and a browser cabinet for everything else. With Pro's end-to-end encrypted sync, your hosts and keys follow you to every device, not just the one you set them up on.
02 / where your agents connect
And it's the first one built for your agents.
You barely open a terminal by hand anymore — your agent does the work. Termalin is the layer it connects through: an MCP server over the hosts you choose, with a key custodian in the middle. The full model — scope, policy, watch, audit — is on SSH for AI agents.
- ▸Agent-native. A real MCP server — your agent lists the hosts you expose and runs commands through Termalin, per-host, on your terms.
- ▸Key custodian. Unlock once; Termalin signs on the agent's behalf. No
ssh-add, no OS agent service, no key ever handed to the agent. - ▸You stay in the loop. With the desktop app's local MCP, every agent session mirrors to your screen — watch what it runs, or step in and take the keyboard. Over the hosted connection, every command lands in the audit log, with recordings in the cabinet.
- ▸No running app required. Point an agent at Termalin's hosted MCP endpoint — sign in once, or use an API key — and it runs commands on your tunnelled servers even when nothing's open on your machine. Or drive them from ChatGPT and claude.ai, where Termalin is listed in the connector directories.
- ▸Rules, not trust. Each key and signed-in AI app gets a scope — which servers — and a policy: full, an allowlist, or read-only. Every command it runs is in the audit log.
- ▸An assistant in the terminal. Summaries of recorded sessions, "explain this" on selected output, a server described for its note, and the command for what you ask — in the desktop app, on iOS and in the web cabinet, built in or on any plan with your own key or a local model.
03 / see it in action
Every session, live — and side by side.
A few of the things you'll do every day — captured from the app.
Watch grid
Open as many hosts as you like — the watch grid mirrors them all at once, so you drive a change across a fleet and see each one respond.
- Every open session as a live tile.
- Sessions an agent is driving glow, so you always know what's running where.
SFTP browser & editor
Browse remote files, then open them right here — no round-trip to a local copy.
- A real editor: syntax highlighting, search & replace, word wrap.
- Open images, PDFs, Markdown, CSV and archives in place — not just code.
Session replay
Record any session and play it back later — commands, output and agent actions, on a scrubbable timeline with markers.
Server monitoring & alerts
A server with a Connector is monitored from the web cabinet: once a minute Termalin reads its health figures over the connection that is already there. No monitoring agent to install.
- Dashboards for CPU, load, memory, disk, network, containers and TLS certificates.
- Alerts with default thresholds — a disk about to fill, a failed service, a server offline — by email, push, Telegram or webhook.
- How server monitoring works →
04 / anywhere, even behind a firewall
Open a terminal in the browser — even to servers with no open port.
Sign in at termal.in/account for a web SSH client — a real terminal on your hosts, no app required — plus SFTP, FTP and S3 file browsers, a database client, snippets and recordings, all adapting to a phone. The browser cabinet comes with Pro and Team; the free tier is the desktop and iOS apps. For a server behind a firewall, run one line to install a tiny agent — no inbound port to open, and no SSH key to hand out. Then connect from the browser, keyless — including to a database on that private network.
- ▸No open port. The agent dials out to Termalin — nothing listens on the server, so a closed firewall stays closed.
- ▸No SSH key to manage. Logins use a short-lived certificate (minutes) from Termalin's CA, which the host is set to trust — the same model as Cloudflare and Teleport.
- ▸The agent stays blind. It only shuttles encrypted SSH bytes to your own
sshd— never your keystrokes, output or credentials. - ▸Featherweight. One static binary — about 3 MB on disk and under 1 MB of RAM idle. Installs as a service and reconnects on its own.
05 / from the blog
Field notes on SSH — and the agents that use it.
- ▸Give Hermes Agent SSH access to your servers without handing it a key — Hermes Agent's SSH backend keeps a key on the agent box and reaches one host. Connect Termalin as an MCP server instead: keyless, many hosts, audited.
- ▸Lightweight server monitoring for a VPS: Beszel vs Netdata vs Uptime Kuma vs Nezha (and when you need none) — Lightweight server monitoring for a VPS: Beszel, Netdata, Uptime Kuma, Nezha and Glances compared — what each watches, RAM, ports, alerts, and gaps.
- ▸OpenClaw and SSH: tunnel to the dashboard, and let the agent reach your servers without a key — Open the OpenClaw dashboard through an ssh -L tunnel, then let the agent run commands on your servers through MCP — no SSH key in its hands.
◆ / try it on one server
The terminal you'll keep — and hand to your agent, safely.
Termalin ships new features every week — with a free tier and a 14-day Pro trial, for Windows, macOS, Linux and iOS. Not ready to install? Try the live demo in your browser.
Free · Windows, macOS, Linux, iOS & web · signed auto-updates.