# Termalin

Last updated: 2026-10-22

> Termalin is a cross-platform SSH/terminal client for developers and their AI agents. It pairs a tabbed terminal, SFTP/FTP/S3 file browsers, a database client for 13 engines (PostgreSQL, MySQL, MongoDB, Redis, ClickHouse and more), SSH key and agent management, saved port-forward tunnels, one-click import from PuTTY, MobaXterm, ~/.ssh/config and CSV, end-to-end encrypted cloud sync, and session recording with a built-in MCP server — so an AI agent can reach the same hosts and databases, with keys that never touch disk. Desktop apps run on Windows, macOS and Linux; native apps run on iPhone, iPad and Apple Watch; a full browser cabinet runs at termal.in/account (Android and anything else). Servers and databases behind a firewall are reachable keylessly through the Termalin Connector — a one-line agent for Linux, macOS and Windows (x64 and ARM64) with no inbound port to open. The same Connector also opens RDP and VNC remote desktops (in the browser or the desktop app) and takes encrypted, scheduled backups of Linux servers. Every server with a Connector also gets monitoring and alerts (Pro and Team) for Linux, Windows and macOS: charts in the web cabinet and the desktop app, alerts by email, push, Telegram or webhook, with nothing extra to install.

Termalin is agent-native and exposes MCP three ways. (1) A local stdio server (`termalin-mcp`) bundled with the desktop app: register it with `claude mcp add termalin -- <path>/termalin-mcp` and the agent gets hosts_list, ssh_exec, persistent sessions, SFTP, database query and live-terminal tools for the hosts you export from the app — Termalin's key custodian signs on the agent's behalf, so no key ever enters the agent's environment. The local server exposes 22 tools; the hosted surfaces expose 21 (hosts_list, ssh_exec, ssh_exec_many, job_start, job_status, job_stop, job_list, server_metrics, alerts_list, backup_create, backup_list, web_link_create, web_link_list, web_link_delete, sftp_list, sftp_read, sftp_write, data_query, data_tables, data_schema, generate_password), listed at https://termal.in/docs/mcp-tools/. (2) A one-URL remote connector at https://termal.in/mcp for ChatGPT, claude.ai, Claude Code, Codex, Cursor and any OAuth-capable MCP client (Termalin is listed in the ChatGPT and Claude connector directories): sign in, approve once, and the chat can run commands (also on several servers at once or as background jobs), read and write files, query databases and read server metrics and alerts on your enrolled servers — no desktop app running, revocable any time in the cabinet. (3) The same hosted endpoint with API-key auth (Bearer tk_live_…) at https://termal.in/api/v1/mcp for CI and headless agents; listed in the official MCP Registry as `in.termal/termalin-web`. All remote access reaches only servers enrolled with the keyless tunnel Connector via short-lived SSH certificates. Each connected app and each API key carries a command policy set per connection — full access, an allowlist of commands, or read-only — plus a scope of which servers it may reach (the same per-host policy of full/allowlist/blocked applies to the local server). Every agent action is marked in the session recording and the audit log. The vault (hosts, keys, snippets, recordings) is encrypted on the device with a key derived from the master password before syncing — the server only ever stores ciphertext.

## Docs
- [Documentation](https://termal.in/docs/): install, first connection, keys and agent, master password and locks, sync, recording and replay, watch grid, SFTP, agents/MCP, updates, troubleshooting
- [Documentation (markdown)](https://termal.in/docs.md): the same docs as plain markdown
- [MCP server for SSH](https://termal.in/mcp/): give an AI agent SSH + SFTP + database access to your servers — local stdio server, one-URL connector for claude.ai/ChatGPT, and an API-key endpoint
- [MCP tools reference](https://termal.in/docs/mcp-tools/): all 22 local and 21 hosted tools, with arguments

## Product
- [Features](https://termal.in/features/)
- [SSH for AI agents](https://termal.in/ssh-for-ai-agents/): the custody model — scope, per-host policy, live watch grid, audit
- [Claude Code SSH](https://termal.in/claude-code-ssh/): connect Claude Code to your servers without handing it keys
- [claude.ai SSH connector](https://termal.in/claude-ssh/): connect claude.ai to your servers with a one-URL OAuth connector
- [ChatGPT SSH connector](https://termal.in/chatgpt-ssh/): run commands on your servers from a ChatGPT conversation
- [Cursor SSH](https://termal.in/cursor-ssh/): give Cursor's agent SSH access through one mcp.json entry
- [Codex SSH](https://termal.in/codex-ssh/): connect OpenAI Codex to your servers over SSH
- [Database client](https://termal.in/database-client/): 13 engines, read-only-by-default agent access, works in the browser through a Connector
- [Connector](https://termal.in/connector/): one-line keyless agent for Linux, macOS and Windows (x64 and ARM64) behind NAT or a firewall — no inbound port; carries the web terminal, remote desktops, monitoring, backups and the hosted MCP; on Windows it installs OpenSSH, keeps port 22 closed and gives SSH sessions PowerShell
- [Server monitoring and alerts](https://termal.in/server-monitoring/): charts and alerts for every Linux, Windows or macOS server with a Connector — no monitoring agent to install, default alert thresholds, email/push/Telegram/webhook; Pro and Team; also in the desktop app (Settings → Account → Monitoring)
- [Windows Server monitoring](https://termal.in/windows-server-monitoring/): CPU, memory, page file, drives, network and processes of Windows Server charted every minute, with alerts; through the Connector, no agent
- [SSH session recording](https://termal.in/ssh-session-recording/): output-only recording, replay, agent actions marked
- [Server backups](https://termal.in/server-backups/): encrypted, scheduled backups of Linux servers through a Connector; keys only the owner holds; to Termalin storage (one pool with recordings, 25 GB Pro / 100 GB Team), the owner's own S3 bucket, or another of their servers via a Connector; extra storage +100 GB $2.99/mo or +1 TB $19.99/mo; agents can take one before a risky change (backup_create); managed in the web cabinet or the desktop app (Settings → Account → Backups)
- [Remote desktops](https://termal.in/rdp-client/): RDP (Windows, port 3389) and VNC (5900–5999) desktops open in a browser tab or the desktop app — through a Connector (no inbound port, private addresses) or directly at a public address; Files button on the Connector's own machine; clipboard paste-in in the browser, both ways in the app; 4 open at once on Pro, 10 on Team, 30-min idle timeout; three failed sign-ins pause a desktop (up to a day), direct mode allows 30 sessions / 5 addresses an hour; direct from the desktop app is free, through a Connector or the browser is Pro/Team
- [RDP in the browser](https://termal.in/web-rdp-client/): open a Windows or VNC desktop in a browser tab, through a Connector (no open port) or direct to a public address; nothing to install on your side; Pro and Team
- [Remote desktop without port forwarding](https://termal.in/remote-desktop-without-port-forwarding/): reach a Windows PC or VNC desktop behind NAT or a firewall with port 3389 closed — a Connector dials out, the desktop opens in the browser or the app
- [Windows Server over SSH](https://termal.in/windows-server-ssh/): one PowerShell line installs OpenSSH and the Connector — a PowerShell terminal, files, RDP and monitoring for Windows Server in the browser, with port 22 closed
- [Termalin for Chrome](https://chromewebstore.google.com/detail/lndnklpcljdenmlmgmcobchhdkpaahgi): browser extension (in the Chrome Web Store, unlisted — install by link) — "Run on server" on code blocks in ChatGPT, Claude, GitHub and Stack Overflow, Insert into chat, a side panel with servers, alerts and metrics, nine languages; follows the account's command rules
- [Pricing](https://termal.in/pricing/): Free (full desktop app), Pro ($10/mo, or $8/mo billed yearly; 25 GB cloud storage for recordings and backups), Team ($19 per user/mo, or $15 billed yearly; 100 GB), and a one-time lifetime Pro license for early backers (100 total, priced in steps: $149 for the first 25, then $199, then $249); no plan limits hosts, keys, devices or Connectors; 14-day Pro trial
- [Compare](https://termal.in/compare/): honest comparisons vs Termius, MobaXterm, PuTTY, Warp, Tabby and more
- [Termius alternative](https://termal.in/termius-alternative/): Termalin vs Termius, including "does Termius have an MCP server?"
- [MobaXterm alternative](https://termal.in/mobaxterm-alternative/): cross-platform, with a built-in MCP server; imports MobaXterm sessions
- [XPipe alternative](https://termal.in/xpipe-alternative/): both ship a built-in MCP server — XPipe local, Termalin local + hosted
- [Warp alternative](https://termal.in/warp-alternative/): a dedicated SSH client vs an AI-first terminal
- [Changelog](https://termal.in/changelog/)
- [Download](https://termal.in/download/): Windows, macOS, Linux, iOS (iPhone/iPad/Apple Watch) and the browser — also the Microsoft Store, `winget install Termalin.Termalin`, `brew install --cask termalinapp/termalin/termalin` and the `termalin` Scoop bucket

## Security
- [Security model](https://termal.in/security/): end-to-end encryption, which data stays encrypted, the algorithms used
- [security.txt](https://termal.in/.well-known/security.txt)

## Blog
- [Blog](https://termal.in/blog/) ([RSS](https://termal.in/rss.xml))
- [SSH clients for AI agents in 2026](https://termal.in/blog/ssh-clients-for-ai-agents-2026/): honest landscape roundup — Termalin, Conduit, XPipe, Gumpbox, VibeShell, bridges and hosted connectors
- [Does Termius have an MCP server?](https://termal.in/blog/does-termius-have-an-mcp-server/): the community bridges, Conduit and Termalin, compared
- [Which SSH clients support MCP in 2026](https://termal.in/blog/ssh-clients-with-mcp-support/): dated table — built-in vs bridge, local vs hosted, tools, price, platforms
- [SSH MCP servers compared](https://termal.in/blog/ssh-mcp-servers-compared/): standalone servers (tufantunc/ssh-mcp and more), hosted connectors (browser-ssh, sshrew) and client-bundled, by key custody and policy
- [Best SSH client with a built-in MCP server](https://termal.in/blog/best-ssh-client-with-mcp-server/): the five checks, scored against named options
- [What is an MCP server?](https://termal.in/blog/what-is-an-mcp-server/): host/client/server, transports, and who holds the credential
- [Per-host command allowlists for AI agents](https://termal.in/blog/per-host-command-allowlists-for-ai-agents/): bounding what an agent may run, per host
- [Audit what an AI agent does on your servers](https://termal.in/blog/audit-what-an-ai-agent-does-on-your-servers/): an audit trail made outside the agent
- [9 Termius alternatives](https://termal.in/blog/termius-alternatives/): free and paid clients tested as Termius replacements
- [Let an AI agent deploy without your SSH keys](https://termal.in/blog/let-an-ai-agent-deploy-without-your-ssh-keys/): the custodian-scope-watch pattern for agent server access
- [Connect Claude Code to a server over SSH](https://termal.in/blog/connect-claude-code-to-your-server-over-ssh/): hands-on MCP setup walkthrough
- [Cursor SSH access for agents](https://termal.in/blog/cursor-ssh-access-for-agents/): give Cursor's agent real server reach, safely
- [Manage servers from claude.ai and ChatGPT](https://termal.in/blog/manage-servers-from-claude-chatgpt/): the one-URL connector, OAuth, fully audited
- [10 common SSH errors and how to fix each one](https://termal.in/blog/ssh-errors-decoded/)
- [Leaving PuTTY](https://termal.in/blog/leaving-putty-migration-guide/): migrate sessions, .ppk keys and habits

## Common questions
- Does Termius have an MCP server? No official one as of October 2026. Community bridges exist (termius-mcp on PyPI, yapp/termius-mcp, Termius Session MCP); Conduit and Termalin are separate SSH clients with their own built-in MCP server. https://termal.in/blog/does-termius-have-an-mcp-server/
- Does MobaXterm have an MCP server? No official one; the community mobaxterm-mcp reads MobaXterm.ini sessions. Termalin builds one in and imports MobaXterm sessions in a click.
- Does XPipe have an MCP server? Yes — a built-in local HTTP server, off by default and read-only until you enable its mutation tools. Termalin adds a hosted, keyless endpoint on top of its local one.
- Does Wave Terminal have an MCP server? We found none in its docs as of October 2026.
- Which SSH clients have a built-in MCP server? As of October 2026: Conduit (local, ~60 tools, Apache-2.0), XPipe (local HTTP), VibeShell (~28 tools, MIT), and Termalin (22 local + 21 hosted tools, local + hosted). https://termal.in/blog/ssh-clients-with-mcp-support/
- Can an AI agent run SSH commands without holding my key? Yes, with a custodian-style server: Termalin signs on the agent's behalf (local) or authenticates with a short-lived certificate (hosted), so no private key ever enters the agent's environment.

## Optional
- [Full text](https://termal.in/llms-full.txt): the whole product + docs + MCP reference in one file