Manage your servers from claude.ai and ChatGPT — no key pasted anywhere

Until now, giving an AI chat access to your servers meant one of two uncomfortable moves: paste an SSH key into something, or stand up your own bridge and babysit it. As of today there’s a third option: add Termalin as a connector and let the chat reach your servers the same way you do — through an audited, revocable, keyless tunnel.

It works in both of the chats people actually live in:

• claude.ai → Settings → Connectors → Add custom connector → https://termal.in/mcp
• ChatGPT → Settings → Connectors (developer mode) → same URL

That’s the entire setup. The chat discovers the server, opens Termalin’s sign-in page, you approve once — and it can list your servers, run commands, and read or write files, right in the conversation.

What a session actually looks like

A real exchange from our testing, verbatim in spirit:

You: can you check if my servers are reachable?

Chat: Yes — two servers, both online: staging (user ubuntu) and prod (user root). Want me to check anything on them?

You: hop on staging — free disk, uptime, and install a package as a test.

Chat: Done. Ubuntu 22.04.5, up 538 days, / is 9% used (89 GB free). Installed tree 2.0.2 — works. One thing you should know: the kernel has a pending update and the box says system restart required, with 49 packages waiting. Want me to review what’s safe to apply?

That last line is the point. You didn’t ask about updates — but an agent that can actually look at the box notices things a dashboard never tells you.

Why this isn’t “pasting a key into a chatbot”

The connector never touches SSH credentials, because there are none to touch:

• OAuth, not keys. The chat gets a scoped token from Termalin’s sign-in page — no API key to paste, no private key in anyone’s context window. Under the hood it’s the standard MCP authorization flow: discovery, dynamic client registration, PKCE.
• Keyless reach. Servers are reached through Termalin Connectors — a one-line agent that dials out from the box. Authentication is a short-lived certificate minted per run. No inbound port, no stored key, nothing to leak.
• Only your servers. A token is bound to your account and reaches your enrolled servers — not “whatever it can route to”.
• Everything is audited. Every approval and every command lands in your account’s activity trail.
• One-click revoke. Your account page lists connected AI apps; Disconnect kills the app’s tokens instantly.

Where the edges are

Honest limits, so you know what you’re getting:

• Each command runs in its own non-interactive session — cd doesn’t persist between calls, and TUI programs (vim, htop) won’t fly. Agents handle this fine; they chain commands instead.
• Commands are time-boxed (up to 300 s) and file writes are text-only, capped at 512 KB. For big or binary transfers, use the app.
• The chat connector reaches servers enrolled with a Connector. For hosts you only have in the desktop app, the local MCP server covers that side.

The bigger picture

We think this is what an SSH client should be in 2026: a tool that works equally well when you hold the keyboard and when your agent does — with you watching, and with the blast radius under your control. The same MCP server also speaks to Claude Code, Cursor and anything else via API keys, so the chat connector is one door among several, not a separate product.

Try it: add the connector, point it at a low-stakes box, and give it a real chore — “find what’s eating the disk on staging and clean up what’s obviously safe.” Then watch your audit log fill in.