Give Codex SSH access — without handing it your keys.

01  /  set up in 3 steps

Point Codex at your servers in three steps.

Termalin ships a real MCP server — a bundled termalin-mcp binary that gives an agent SSH and SFTP access to the hosts you choose, authenticated through the app's key agent.

• 1Pick the hosts. Install Termalin and choose what to expose in Settings → MCP — each host is written with agent-only auth, so no passwords land on disk. While you're there, set each host's agent policy: full, an allowlist of commands, or blocked.
• 2Register the server. Codex reads MCP servers from the mcp_servers section of ~/.codex/config.toml — point an entry at the binary:

[mcp_servers.termalin]
command = "<path>/termalin-mcp"

Recent Codex builds can also register it from the command line — codex mcp add termalin -- <path>/termalin-mcp — and the same config drives Codex in the IDE.

• 3Ask for something real. The agent lists your hosts and gets to work — tail a log, restart a service, check disk, edit a config, deploy.

02  /  its own sessions — or yours

The agent opens its own sessions, or steps into yours.

Most MCP servers wrap an API. Termalin's wraps your servers — the agent works them the way you do, with real sessions, files and tunnels:

• ▸Its own sessions — the agent opens a session and runs there in the background, a glowing tab you can watch. Included in the Free tier.
• ▸Or step into yours — on Pro, the agent joins a session you already have open and runs alongside you, the border glowing while it acts. Consent-gated, its own toggle.
• ▸The whole workflow — one-off commands, persistent SSH sessions it can reuse, SFTP reads and writes, and port forwards: a local tunnel to a service behind the server, or a SOCKS proxy.

03  /  key custody & consent

Keys stay with you. Nothing runs without consent.

Codex runs terminal commands on your machine — so if your keys sit unlocked in ~/.ssh or a running ssh-agent, ssh prod already works, and you've granted full server access without deciding to. Termalin's key custodian replaces that arrangement: the agent asks, the custodian authenticates. You unlock once, Termalin signs on the agent's behalf, and there is no key file for the agent to read — nothing to leak, and no loose key needed on your disk for the hosts worth protecting. Agent access is off by default; letting an agent type into your live sessions is a separate toggle again; and only the hosts you export in Settings → MCP are reachable at all — each with its own access level, full, an allowlist of commands, or blocked.

04  /  oversight

Watch every move — live, recorded, and on the log.

The watch grid mirrors every open session side by side as a live tile, and sessions an agent is driving glow — so you see it work in real time, across a fleet if need be.

• ▸Marked in the recording — each agent command gets its own green marker on the replay timeline, so "what did the agent do?" has a scrubbable answer. More on recording →
• ▸Written to the audit log — every sign-in, host connection, file operation and agent command, with where (IP · country) and which device.

05  /  no app running

A hosted MCP endpoint for agents that live in the cloud.

Agent running somewhere your desktop isn't? Create an API key in the web cabinet and point it at https://termal.in/api/v1/mcp with Authorization: Bearer tk_live_…. It runs commands and reads or writes files on your tunnelled servers — the ones running the one-line install agent — even when nothing is open on your machine, authenticating with a short-lived certificate so no key is handed out. Keys can be scoped to specific servers, set to a command policy (full, an allowlist, or read-only), given an expiry (30 / 90 / 365 days) and revoked any time; hosted runs are rate-limited and time-boxed. The two paths reach different hosts — the local server works the inventory you export from the app, the hosted endpoint your enrolled tunnel servers. New to the idea? Start with SSH for AI agents, or go straight to the full MCP reference.