termalAgent-native SSH client
A fast SSH client — for you and your agents.
The terminal you keep open all day — tabs, SFTP with a built-in editor, one-unlock keys. And the part that sets it apart: a hosted MCP endpoint your agents sign in to — Claude Code, ChatGPT, Claude, Codex, Cursor — reaching your servers keyless, every command in the audit log; in the desktop app you can watch them work and step in live. They never hold your keys.
Free tier on Windows, macOS, Linux & iOS · 14-day Pro trial · the browser terminal is part of Pro and Team — try the live demo or see all downloads.
00 / in one minute
The whole tour in 60 seconds.
The terminal, the toolkit, the MCP server for your agents, private servers with no open port, and end-to-end encrypted sync. It plays muted; turn the sound on in the player for the voiceover.
01 / what's inside
A complete SSH client — the one you keep open all day.
Everything you expect from a modern terminal, done properly and kept fast.
Tabbed terminal
Real xterm-256color sessions with browser-style tabs you can drag to reorder, a hosts sidebar, snippets, and session restore with scrollback.
SFTP + file editor
Browse remote files, upload and download, and edit in place with a built-in editor — no round-trip to a local copy.
Dual-pane files + S3
Two panes, drag between them — host to host, or straight to and from an S3 bucket, a first-class host beside SFTP and FTP. One drag replaces the download-then-re-upload round-trip.
Database client
Browse and query 13 engines — PostgreSQL, MySQL, MongoDB, Redis, ClickHouse, Elasticsearch, Cassandra and more — with a schema tree, a SQL editor and a structure view. Connect straight to a public database, or reach a private one through a Connector — no exposed port.
Port forwarding
Reach a service behind a server, expose a local one on it, or route traffic through it — in plain words, not -L/-R/-D. Saves per host, starts on launch, reconnects. Jump hosts (ProxyJump) included.
Keys & agent
Generate, import and manage SSH keys. Unlock once and Termalin's own agent signs for you — passphrases cached on your terms.
Command history
Every command, kept per host — and on Pro, synced across your devices, end-to-end encrypted so only you can read it. Search it, and turn any line into a snippet.
Command suggestions
Start typing and the rest of the command appears in-line — from your history on that host, the server’s own shell history and your snippets. → accepts; several matches open a picker. In the app and the browser alike.
Local terminal
Open a shell on your own machine as a tab — right beside your servers. Type claude, gemini or codex and it runs there, dropping you back at a prompt when it's done. New tabs reopen in your last directory.
Terminal themes
Colour your terminals to taste — 36 themes, from Dracula, Nord, Gruvbox, Monokai, One Dark, Material and Solarized to Termalin's own palette. Set one per host, a default for a folder, or one for the whole app — desktop and browser alike.
Live system stats
A status bar with CPU, memory, disk, network, load and uptime for the box you're on — at a glance, always current.
Monitoring & alerts
Every server with a Connector gets charts for CPU, memory, disk and network — in the web cabinet and the desktop app, for Linux, Windows and macOS servers — and alerts by email, push, webhook or Telegram in one click. Nothing extra to install, no rules to write; mute a whole server or one alert type when you need to. On Pro and Team. Server monitoring →
Remote desktops
Open a Windows desktop over RDP or any VNC desktop in a tab, right beside your SSH sessions — clipboard both ways, Ctrl+Alt+Del, ⌘ as the Windows key on a Mac. Direct connections are free; reach one behind a firewall through a Connector, or in the browser, on paid plans. RDP & VNC client →
Server backups
Scheduled, encrypted backups of your Linux servers — nothing installed on the box, and only you hold the key. Store the archives in Termalin's cloud, your own S3 bucket, or another of your servers. On Pro and Team. Server backups →
Rules for every AI connection
Each API key and signed-in AI app gets a scope — which servers — and a policy: full, an allowlist of commands, or read-only. Every command lands in the audit log. API keys come with ready-to-paste setup for Claude Code, Cursor and more.
Light on RAM
A Rust core and tab hibernation instead of leaking memory. It stays quick even with a wall of hosts open for weeks.
Cross-platform
One client for Windows, macOS, Linux and iOS — with native iPhone, iPad and Apple Watch apps and a browser cabinet for everything else. With Pro's end-to-end encrypted sync, your hosts and keys follow you to every device, not just the one you set them up on.
02 / where your agents connect
And it's the first one built for your agents.
You barely open a terminal by hand anymore — your agent does the work. Termalin is the layer it connects through: an MCP server over the hosts you choose, with a key custodian in the middle. The full model — scope, policy, watch, audit — is on SSH for AI agents.
- ▸Agent-native. A real MCP server — your agent lists the hosts you expose and runs commands through Termalin, per-host, on your terms.
- ▸Key custodian. Unlock once; Termalin signs on the agent's behalf. No
ssh-add, no OS agent service, no key ever handed to the agent. - ▸You stay in the loop. With the desktop app's local MCP, every agent session mirrors to your screen — watch what it runs, or step in and take the keyboard. Over the hosted connection, every command lands in the audit log, with recordings in the cabinet.
- ▸No running app required. Point an agent at Termalin's hosted MCP endpoint — sign in once, or use an API key — and it runs commands on your tunnelled servers even when nothing's open on your machine. Or drive them from ChatGPT and claude.ai, where Termalin is listed in the connector directories.
- ▸Rules, not trust. Each key and signed-in AI app gets a scope — which servers — and a policy: full, an allowlist, or read-only. Every command it runs is in the audit log.
- ▸An assistant in the terminal. Summaries of recorded sessions, "explain this" on selected output, a server described for its note, and the command for what you ask — in the desktop app, on iOS and in the web cabinet, built in or on any plan with your own key or a local model.
03 / see it in action
Every session, live — and side by side.
A few of the things you'll do every day — captured from the app.
Watch grid
Open as many hosts as you like — the watch grid mirrors them all at once, so you drive a change across a fleet and see each one respond.
- Every open session as a live tile.
- Sessions an agent is driving glow, so you always know what's running where.
SFTP browser & editor
Browse remote files, then open them right here — no round-trip to a local copy.
- A real editor: syntax highlighting, search & replace, word wrap.
- Open images, PDFs, Markdown, CSV and archives in place — not just code.
Session replay
Record any session and play it back later — commands, output and agent actions, on a scrubbable timeline with markers.
Server monitoring & alerts
A server with a Connector is monitored from the web cabinet and the desktop app: once a minute Termalin reads its health figures over the connection that is already there — Linux, Windows and macOS servers alike. No monitoring agent to install.
- Dashboards for CPU, load, memory, disk, network, containers and TLS certificates.
- Alerts with default thresholds — a disk about to fill, a failed service, a server offline — by email, push, Telegram or webhook.
- How server monitoring works →
04 / anywhere, even behind a firewall
Open a terminal in the browser — even to servers with no open port.
Sign in at termal.in/account for a web SSH client — a real terminal on your hosts, no app required — plus SFTP, FTP and S3 file browsers, a database client, snippets and recordings, all adapting to a phone. The browser cabinet comes with Pro and Team; the free tier is the desktop and iOS apps. For a server behind a firewall, run one line to install a tiny agent — no inbound port to open, and no SSH key to hand out. Then connect from the browser, keyless — including to a database on that private network, or a Windows or VNC desktop over RDP.
- ▸No open port. The agent dials out to Termalin — nothing listens on the server, so a closed firewall stays closed.
- ▸No SSH key to manage. Logins use a short-lived certificate (minutes) from Termalin's CA, which the host is set to trust — the same model as Cloudflare and Teleport.
- ▸The agent stays blind. It only shuttles encrypted SSH bytes to your own
sshd— never your keystrokes, output or credentials. - ▸Featherweight. One static binary — about 3 MB on disk and under 1 MB of RAM idle. Installs as a service and reconnects on its own.
05 / from the blog
Field notes on SSH — and the agents that use it.
- ▸Does MobaXterm have an MCP server? (2026) — MobaXterm has no official MCP server. A community bridge reads your MobaXterm.ini sessions; clients like Termalin give an agent keyless, per-host access.
- ▸Reach Home Assistant or Grafana Remotely Without Port Forwarding — Five ways to open a Home Assistant or Grafana dashboard from outside your LAN: Nabu Casa, Cloudflare Tunnel, Tailscale, reverse proxy and a Termalin link.
- ▸Windows Server Backup with Volume Shadow Copy — Encrypted, Nothing to Install — Back up a Windows Server with Termalin: open files caught by a Volume Shadow Copy, encrypted, sent to S3 or your own server. Only the Connector installed.
◆ / try it on one server
The terminal you'll keep — and hand to your agent, safely.
Termalin ships new features every week — with a free tier and a 14-day Pro trial, for Windows, macOS, Linux and iOS. Not ready to install? Try the live demo in your browser.
Free · Windows, macOS, Linux, iOS & web · signed auto-updates.
