Give Claude Code SSH access — without handing it your keys.

00  /  which "claude code ssh"?

Run Claude Code on the server, or reach the server from Claude Code?

"Claude Code SSH" comes up two ways, and they're different jobs:

• ▸Run Claude Code on the remote — Claude Desktop now has SSH remote sessions: it connects to an SSH host with your OpenSSH client, puts the Claude Code engine in ~/.claude/remote/ on that box, and runs it there, so every file read, edit, shell command and git operation happens on the server while the session interface stays on your machine. Good for working on code that lives on a dev or build box without copying it down. An admin turns it on with the sshHostAllowlist setting — it's off by default, because enabling it sends your inference credential to the host. (You can also just SSH in and run the Claude Code CLI on the box yourself.)
• ▸Reach your servers from Claude Code through MCP — Claude Code stays where it is and calls out to many servers through an MCP server, running commands and reading or writing files on a scoped, audited, keyless channel. That's what this page sets up.

Run it on the remote when the whole coding session should live on one server. Use the MCP route when you want Claude Code to operate servers — a fleet, production, a private box behind a Connector with no open port — without handing it a key or a standing shell, each host under its own command policy (full, an allowlist, or read-only), and every command recorded.

01  /  set up in 3 steps

Point Claude Code at your servers in three steps.

Termalin ships a real MCP server — a bundled termalin-mcp binary that gives an agent SSH and SFTP access to the hosts you choose, authenticated through the app's key agent. See the full list of MCP tools.

• 1Pick the hosts. Install Termalin and choose what to expose in Settings → MCP — each host is written with agent-only auth, so no passwords land on disk.
• 2Register the server with Claude Code — one command:

claude mcp add termalin -- <path>/termalin-mcp

Using Cursor or another MCP client? Point its MCP config at the same binary:

{
  "mcpServers": {
    "termalin": { "command": "<path>/termalin-mcp" }
  }
}

• 3Ask for something real. The agent lists your hosts and gets to work — tail a log, restart a service, check disk, edit a config, deploy.

Want it spelled out? Follow the step-by-step Claude Code walkthrough.

02  /  its own sessions — or yours

The agent opens its own sessions, or steps into yours.

Most MCP servers wrap an API. Termalin's wraps your servers — the agent works them the way you do, with real sessions, files and tunnels:

• ▸Its own sessions — the agent opens a session and runs there in the background, a glowing tab you can watch. Included in the Free tier.
• ▸Or step into yours — the agent joins a session you already have open and runs alongside you, the border glowing while it acts. Consent-gated, its own toggle.
• ▸The whole workflow — one-off commands, persistent SSH sessions it can reuse, SFTP reads and writes, and port forwards: a local tunnel to a service behind the server, or a SOCKS proxy.

03  /  key custody & consent

Keys stay with you. Nothing runs without consent.

The agent never sees a credential. Termalin's key custodian signs on its behalf — unlock once and sessions authenticate with no ssh-add, no key file for the agent to read, and no private key handed to the model. Agent access is off by default; letting an agent type into your live sessions is a separate toggle again; and only the hosts you export in Settings → MCP are reachable at all — each with its own access level, full, an allowlist of commands, or blocked.

04  /  oversight

Watch every move — live, recorded, and on the log.

The watch grid mirrors every open session side by side as a live tile, and sessions an agent is driving glow — so you see it work in real time, across a fleet if need be.

• ▸Marked in the recording — each agent command gets its own green marker on the replay timeline, so "what did the agent do?" has a scrubbable answer. More on recording →
• ▸Written to the audit log — every sign-in, host connection, file operation and agent command, with where (IP · country) and which device.

05  /  no app running

No desktop app? Connect Claude Code to the hosted connector.

The hosted connector reaches servers you've enrolled with a Connector — a one-line agent that dials out from the box. A host that only exists in the desktop app is not enrolled, so the hosted connector won't see it until the Connector runs on it. The hosted side needs an account on Pro or the 14-day trial.

• 1Enroll a server. Sign in at termal.in/account, click Add Connector, and copy the one-line install command it gives you. Run that command on a box you manage — pick something low-stakes for the first run. From then on it's reachable keylessly, with no inbound port.
• 2Add Termalin to Claude Code as a remote MCP server:

claude mcp add --transport http termalin https://termal.in/mcp

• 3Sign in once. In Claude Code run /mcp, pick termalin and choose to authenticate — Termalin's sign-in page opens in your browser and you approve once. If a request answers "no enrolled servers", step 1 hasn't happened yet. The connection then shows under AI apps in your account, where you can limit it to an allowlist of commands or read-only, or disconnect it.

Using claude.ai or the Claude app instead? Termalin is in the Claude connectors directory — open the listing and click Connect (claude.ai guide).

For scripts and CI, where nobody is there to sign in, create an API key in the web cabinet and point it at https://termal.in/mcp with Authorization: Bearer tk_live_…. It runs commands and reads or writes files on your tunnelled servers — the ones running the one-line install agent (enroll via termal.in/account → Add Connector; desktop-app hosts don't count) — even when nothing is open on your machine, authenticating with a short-lived certificate so no key is handed out. Keys can be scoped to specific servers, set to a command policy (full, an allowlist, or read-only), given an expiry (30 / 90 / 365 days) and revoked any time; hosted runs are rate-limited and time-boxed. The two paths reach different hosts — the local server works the inventory you export from the app, the hosted endpoint your enrolled tunnel servers. New to the idea? Start with SSH for AI agents, or go straight to the full MCP reference.