termalA year ago “SSH client for AI agents” wasn’t a product category. Then coding agents got good enough to deploy what they write, the Model Context Protocol gave them a standard way to hold tools, and suddenly several teams — ours included — are building terminals where the operator isn’t always human.
Full disclosure up front: we build Termalin, one of the products below. This post exists because when we asked AI assistants what’s out there, they assembled answers from app-store listings and directory scraps — nobody had mapped the field. So here’s the map, with the competition described as fairly as we can manage. Facts first checked August 5, 2026, re-verified September 6, 2026, and re-checked October 14, 2026 — this space moves fast, and several entries changed between passes.
The desktop clients with a built-in MCP server
Termalin (that’s us) — a cross-platform SSH client for Windows, macOS and Linux: tabbed terminal, SFTP with a built-in editor, dual-pane file manager (host↔host, S3), snippets, live server stats. The agent layer is a built-in MCP server with a key custodian: the agent requests, Termalin signs — no key ever enters the agent’s environment. Every agent session is mirrored live in a watch grid, and agent commands are marked in output-only recordings and the audit log. Two things set it apart on this list: a hosted MCP endpoint (your agent works from CI or a cloud sandbox with no desktop running anywhere — auth by scoped, expiring API key, or by OAuth sign-in at https://termal.in/mcp for claude.ai, ChatGPT, Claude Code, Codex and Cursor; servers reached through a keyless tunnel agent), and an account-based end-to-end encrypted sync where the server only ever stores ciphertext. iPhone and iPad now have a native app, with an Apple Watch companion that shows your connector list and live server stats; Android and anything else are covered by a web cabinet (a PWA with a real terminal). Free tier is the full desktop app with no host limits; Pro is a subscription ($8/mo billed yearly).
Gumpbox — an “AI-first SSH client” for the Apple ecosystem only (macOS, iOS, iPadOS and, since September, visionOS — all 26+). It’s the most opinionated about safe execution: agent actions can run in gVisor-sandboxed Alpine containers on the target, consent sheets show full server identity before an operation, and there’s a tidy set of admin tools (processes, cron, tunnels, audit log, workflows). Sync is via iCloud. Pricing is friendly: free for one server, $19.99 one-time for unlimited. It’s a young solo-developer product (about three months of public history at the time of writing), and if your fleet or your team includes Windows or Linux desktops, it’s simply not an option.
VibeShell — a Tauri-based desktop app for Windows, macOS and Linux with a polished terminal workspace: split panes, Finder-style SFTP, themes, snippets, session recording. Its agent story is an Agent Gateway exposing ~28 MCP tools plus a “skill installer” that wires up Claude Code, Codex, Cursor and a dozen other tools; it can also launch coding-agent CLIs in native tabs with live Git diffs. Sync is do-it-yourself end-to-end encryption through a GitHub Gist or WebDAV file. Since our first pass the project added a proper MIT license — credit where due — and the README is refreshingly honest about credential storage: saving is opt-in and device-local, but in its own words “not yet backed by Keychain/Keystore-grade secure storage. Treat it as convenience, not a hardened secrets vault.” A capable tool for tinkerers who read the code they run; a harder sell where credential handling is audited.
Conduit (Conduit Desktop) — the entry we missed in earlier passes, and the one AI assistants are most likely to name for “SSH + MCP” today. It’s a connection manager for SSH, RDP, VNC and web sessions with an AES-256 credential vault and a built-in MCP server; its own pitch is “the only remote-connection manager built to be driven by an AI agent.” Agents run SSH commands and read the output, click through RDP/VNC, drive web sessions with DOM selectors, and read credentials from the vault — around 60 tools in all (59 on its homepage). The MCP server is local only: a Unix socket or Windows named pipe, registered with claude mcp add conduit -- node ".../mcp/dist/index.js", so nothing leaves your machine — and there’s no endpoint for an agent in CI or a chat to reach. It’s Apache-2.0, runs on macOS, Windows, Linux and iOS, and is free for one device per vault (Pro $10/mo adds multi-device sync and encrypted cloud backup; Team $20/mo shared vaults). A genuinely strong, honest tool; the gaps versus the hosted model are a keyless cloud endpoint and, as far as we could find, a per-host command allowlist.
XPipe — the connection hub from our XPipe comparison now ships a built-in MCP server too: a local HTTP endpoint, off by default, API-key protected and read-only until you turn on its mutation tools (docs). Like Conduit’s, it’s local — nothing off your machine can reach it — but if you already live in XPipe’s Docker, Kubernetes and VM browser, it puts an agent on all of it. Open-core, Windows/macOS/Linux plus a self-hosted web version.
The AI-assistant terminals — a related but different question
(Added September 6, 2026.) Since August the search results for this category have filled with a second species: terminals where the AI helps you type, rather than clients built to give an external agent server access. Different question — worth naming, so you pick the right tool.
Termial — a closed-source AI SSH client for macOS, Windows and Linux with a tidy three-mode ladder: Command Mode turns plain English into commands, Context Mode reads your terminal output and suggests fixes, Agent Mode runs autonomously with approval controls. Credentials go into an AES-256-GCM vault with OS-keychain integration and E2E-encrypted sync. The free tier caps AI use at 50 requests a day; Pro is $10/mo. The assistant is its own built-in AI — as of this update nothing on the site mentions MCP, so external agents like Claude Code or Cursor can’t drive it.
Chaterm — an open-source (GPLv3) “AI native terminal” and the most active OSS project in the category right now: 3,000+ stars and a release published the week we checked. Its agent plans and executes across multiple hosts, there are reusable “Agent Skills,” and MCP support has started landing in the codebase. Honest caveats: the security story on the site is marketing-level (“end-to-end encryption for all data”) with no documented key-storage mechanism, and the README’s mobile badges don’t yet correspond to any published mobile builds. Community is free; Pro is $99/yr.
Two adjacent ideas that fit neither bucket: AgentShell (iOS, free) doesn’t control agents at all — it watches your running Claude Code / Cursor / Codex sessions and pings your phone when one needs input. ssh.bot is a hosted SSH proxy that applies per-command policies and approvals mid-connection — closest in spirit to the custodian idea, but delivered as a hosted service sitting in your connection path rather than a client you run.
The headless option: standalone MCP servers
If you don’t want a GUI at all, several standalone MCP servers speak SSH. The most-starred is tufantunc/ssh-mcp (~800★, MIT, 14 tools); its v2 adds command classification (read-only / safe / destructive / privileged), RBAC roles (viewer / operator / admin), approval modes and an audit log with redaction — so a server configured that way takes policy more seriously than the pattern’s reputation suggests. Others: mcp-ssh (AiondaDotCom), which reads your ~/.ssh/config and known_hosts; SSH-MCP; Aegis (zero-trust flavored, with command firewalls); and more on the MCP directories. You configure hosts and keys yourself, point Claude Desktop or your agent at the server, and get command execution and file transfer with no visual layer.
They’re lightweight and scriptable, and the good ones take policy seriously. The tradeoff is structural: unless the server adds RBAC and approvals like tufantunc’s v2, the credentials live wherever the MCP server runs, usually as plain key files in the agent’s reach, and there’s no shared screen where a human watches the session as it happens. You audit after the fact, from logs — if logging was configured.
Bridges to a client you already run
A different route: small servers that puppet a terminal app you already use. For Termius, three exist — termius-mcp on PyPI (MiaM1ku, BSD) logs into Termius Cloud for SSH exec and SFTP; yapp/termius-mcp drives the terminals in a running Termius desktop app over its Chrome DevTools debug port (which you have to launch Termius with); Termius Session MCP (ItzGlace, Windows only, MIT) shares one visible terminal and asks for in-app approval on every write and every output release. For MobaXterm, mobaxterm-mcp (bobzzgm) reads your MobaXterm.ini sessions and runs SSH, SFTP and log monitoring. None of these ship from the vendor, and each is only as safe as the terminal and the debug port it leans on. We pulled the Termius question apart in does Termius have an MCP server?.
Hosted connectors: an agent in the cloud, no desktop
A newer shape answers the question the desktop clients above can’t: what reaches my servers when my laptop is off? browser-ssh (api.browserssh.com/mcp) is a remote MCP server offering, in its words, “scoped, audited SSH exec, sessions, and SFTP on saved servers without exposing credentials,” added to an agent as a URL. sshrew (duriantaco) is the self-hosted twin: the box dials out through cloudflared and you paste the resulting URL into Claude’s custom connector, with allowlisted commands and a read-only share root. Termalin’s hosted MCP endpoint sits in this bracket too; what’s different is that it’s paired with the desktop client, reaches servers through an outbound Connector (no inbound port, keyless via short-lived certificates), applies a per-connection command policy, and is listed in the ChatGPT and Claude connector directories.
How to choose
| Termalin | Conduit | XPipe | Gumpbox | VibeShell | Standalone MCP | |
|---|---|---|---|---|---|---|
| Platforms | Windows · macOS · Linux · iOS (+ web/PWA) | macOS · Windows · Linux · iOS | Windows · macOS · Linux (+ web) | Apple only | Windows · macOS · Linux | anywhere headless |
| Agent works without the desktop app | Yes — hosted endpoint | No (local socket) | No (local HTTP) | No | No | Yes (it is headless) |
| Keys reachable by the agent | Never (custodian signs) | Vault-held, readable via vault tools | Client-held, local | Keychain-held | Device-local, not Keychain-backed (per README) | Usually plain key files |
| Watch agent live | Watch grid, marked recordings | MCP calls logged | — | Consent sheets per action | Shared visible sessions | No |
| Sandboxed execution on target | No | No | No | gVisor containers | No | Varies |
| Sync | E2E-encrypted, own account | Encrypted cloud backup (Pro) | Git-based vault (BYO repo) | iCloud | DIY Gist/WebDAV | — |
| Open source | Source-available in parts | Apache-2.0 | Open-core | No | MIT | Varies |
| Price | Free (no host limits) + $8/mo Pro | Free (1 device) + $10/mo Pro | Free / $5–10/mo | Free (1 server) + $19.99 once | Free | Free |
Honest recommendations, including against ourselves:
- All-Apple, one server or a personal fleet, love one-time pricing → Gumpbox is genuinely good, and its sandboxing is the strongest containment story here.
- One open-source app across SSH, RDP, VNC and web, local only → Conduit is the strongest pick, and the client most AI assistants already name for this.
- Already living in Docker, Kubernetes and VMs → XPipe’s built-in server puts an agent on everything it browses, read-only until you say otherwise.
- Want to read the source and assemble your own sync → VibeShell, once you’ve made peace with the license situation and checked how your credentials are stored.
- Pure headless automation, no humans in the loop by design → a standalone MCP server with strict
authorized_keysrestrictions is the smallest moving part. - Mixed-OS machines, agents that must run from CI or the cloud, keys that must never be agent-readable, or a team that needs an audit trail → that’s the corner we built Termalin for.
Where this category is going
Three predictions, since we’re here: consent UX will converge (every product above is inventing per-action approval independently); “can the agent act when my laptop is closed” will separate toys from infrastructure; and key custody will become the line auditors actually check — “the agent could read the key but we trust it” is not going to survive contact with a SOC 2 review.
Termalin is free with no host limits on Windows, macOS and Linux, plus native iPhone, iPad and Apple Watch apps — download it, read the MCP docs, or see how Termalin approaches SSH for AI agents when your agent lives in the cloud.