Give ChatGPT SSH access to your servers — no key pasted anywhere.

01  /  set up in 3 steps

Connect ChatGPT to your servers in three steps.

The connector is Termalin's hosted MCP endpoint — it reaches servers you've enrolled with a Connector, a one-line agent that dials out from the box. You need a Termalin account and at least one enrolled server.

• 1Enroll a server. Run the one-line Connector install on a box you manage — pick something low-stakes for the first run. From then on it's reachable keylessly, with no inbound port.
• 2Add the connector. In ChatGPT, open Settings → Connectors (developer mode) and add the URL:

https://termal.in/mcp

The chat discovers the server, opens Termalin's sign-in page, and you approve once. The same URL works in claude.ai (Settings → Connectors → Add custom connector).

• 3Ask for something real. "Can you check if my servers are reachable?" — the chat lists them, hops on, checks disk and uptime, and notices the things a dashboard never tells you, like a pending kernel update waiting on a restart. Read the launch walkthrough for a real exchange.

02  /  oauth, not keys

Why this isn't "pasting a key into a chatbot".

The connector never touches SSH credentials, because there are none to touch:

• ▸OAuth, not keys. The chat gets a scoped token from Termalin's sign-in page — no API key to paste, no private key in anyone's context window. Under the hood it's the standard MCP authorization flow.
• ▸Keyless reach. Servers are reached through Termalin Connectors, and each run authenticates with a short-lived certificate. No inbound port, no stored key, nothing to leak.
• ▸Only your servers. A token is bound to your account and reaches your enrolled servers — not "whatever it can route to".

03  /  audited & revocable

Everything on the record. Revoked in one click.

Every approval and every command the chat runs lands in your account's activity trail — so "what did it do on prod?" has an answer you can read, not reconstruct. And access is never a standing grant: your account page lists connected AI apps in the "AI apps" card, and Disconnect kills that app's tokens instantly. No key rotation, no fleet-wide cleanup — because there was never a key out there to begin with.

04  /  where the edges are

Honest limits, so you know what you're getting.

• ▸Non-interactive commands. Each command runs in its own session — cd doesn't persist between calls, and TUI programs (vim, htop) won't fly. Agents handle this fine; they chain commands instead.
• ▸Time-boxed and capped. Commands are time-boxed (up to 300 s) and file writes are text-only, capped at 512 KB. For big or binary transfers, use the app.
• ▸Enrolled servers only. The chat connector reaches servers enrolled with a Connector. For hosts you only have in the desktop app, the local MCP server covers that side.

05  /  one door among several

The chat is one door. The desktop is the rest of the house.

The same MCP server also speaks to Claude Code, Cursor and any other MCP client — locally via the bundled termalin-mcp binary, or hosted via API keys that can be scoped to specific servers, set to a command policy, given an expiry and revoked any time. On the desktop you get the full picture: the watch grid mirroring every session live, agent commands marked in session recordings, per-host agent policy. The custody model behind all of it — who holds the keys, what the agent can touch, what gets recorded — is laid out on SSH for AI agents; the full MCP reference has the details.