Give Cursor SSH access — without handing it your keys.

01  /  set up in 3 steps

Point Cursor at your servers in three steps.

Termalin ships a real MCP server — a bundled termalin-mcp binary that gives an agent SSH and SFTP access to the hosts you choose, authenticated through the app's key agent.

• 1Pick the hosts. Install Termalin and choose what to expose in Settings → MCP — each host is written with agent-only auth, so no passwords land on disk. While you're there, set each host's agent policy: full, an allowlist of commands, or blocked.
• 2Register the server in Cursor's MCP config — .cursor/mcp.json in a project's root for that project only, or ~/.cursor/mcp.json to make it available everywhere (the sensible choice — server access isn't a per-repo concern):

{
  "mcpServers": {
    "termalin": {
      "command": "<path>/termalin-mcp",
      "args": []
    }
  }
}

Restart Cursor (or reload the MCP list in Cursor Settings → MCP), confirm the server shows as running, and the tools appear to the agent.

• 3Ask for something real. The agent lists your hosts and gets to work — tail a log, restart a service, check disk, edit a config, deploy. Cursor asks before each tool call by default; leave that on for the first sessions and extend auto-approval one tool at a time. Want the long version? Read the hands-on walkthrough.

02  /  its own sessions — or yours

The agent opens its own sessions, or steps into yours.

Most MCP servers wrap an API. Termalin's wraps your servers — the agent works them the way you do, with real sessions, files and tunnels:

• ▸Its own sessions — the agent opens a session and runs there in the background, a glowing tab you can watch. Included in the Free tier.
• ▸Or step into yours — on Pro, the agent joins a session you already have open and runs alongside you, the border glowing while it acts. Consent-gated, its own toggle.
• ▸The whole workflow — one-off commands, persistent SSH sessions it can reuse, SFTP reads and writes, and port forwards: a local tunnel to a service behind the server, or a SOCKS proxy.

03  /  key custody & consent

Keys stay with you. Nothing runs without consent.

Here's the uncomfortable part about Cursor's agent: it runs terminal commands on your machine, so if your keys sit unlocked in ~/.ssh or a running ssh-agent, ssh prod already works — you've granted full server access by default, without deciding to. Termalin's key custodian replaces that arrangement: the agent asks, the custodian authenticates. You unlock once, Termalin signs on the agent's behalf, and there is no key file for the agent to read — so the hosts worth protecting no longer need a loose key on your disk at all. Agent access is off by default; letting an agent type into your live sessions is a separate toggle again; and only the hosts you export in Settings → MCP are reachable at all — each with its own access level, full, an allowlist of commands, or blocked.

04  /  oversight

Watch every move — live, recorded, and on the log.

The watch grid mirrors every open session side by side as a live tile, and sessions an agent is driving glow — so you see it work in real time, across a fleet if need be.

• ▸Marked in the recording — each agent command gets its own green marker on the replay timeline, so "what did the agent do?" has a scrubbable answer. More on recording →
• ▸Written to the audit log — every sign-in, host connection, file operation and agent command, with where (IP · country) and which device.

05  /  no app running

A hosted MCP endpoint for agents that live in the cloud.

Agent running somewhere your desktop isn't? Create an API key in the web cabinet and point Cursor's mcp.json at the remote server by URL — https://termal.in/api/v1/mcp with Authorization: Bearer tk_live_…. (If your Cursor build doesn't support auth headers on remote servers yet, stay with the local stdio server — it's the better default anyway.) The hosted endpoint runs commands and reads or writes files on your tunnelled servers — the ones running the one-line install agent — even when nothing is open on your machine, authenticating with a short-lived certificate so no key is handed out. Keys can be scoped to specific servers, set to a command policy (full, an allowlist, or read-only), given an expiry (30 / 90 / 365 days) and revoked any time; hosted runs are rate-limited and time-boxed. New to the idea? Start with SSH for AI agents, or go straight to the full MCP reference.