Terminal
Tabs, GPU-accelerated rendering, TOFU host-key verification, keyboard-interactive 2FA and flow control.
SSH client for teams
SSH for your team — and your AI. Every command on the record.
ssh-terminal is a desktop SSH client with team workspaces, a client-side encrypted vault and MCP access for Claude. The server only ever sees ciphertext; every agent action is confirmed and audited.
See it work
A scripted run through the platform, drawn pixel-for-pixel from the real app: connect to a host, move files, approve an agent command, read the team audit.
01Hosts
Все#prod#stagingБез тегов
#prod· 2
prod-web-01MCP · read
deploy@10.0.4.12:22
prod-db-01
postgres@10.0.4.20:22
#staging· 1
staging-apiMCP · shell
ci@10.1.0.5:22
SFTPprod-db-01 : /var/backups
..
daily/—
pg_wal_archive/—
backup-2026-08-14.sql.gz412 MB
backup-2026-08-15.sql.gz · 0%1.1 GB
02Keys
deploy-ed25519SHA256:tQ9fJ…LmA
ci-ed25519SHA256:8kXw2…p2f
03Forwards
local 5433 → prod-db-01:5432on
remote 8443 → localhost:3000off
04Snippets
restart nginx
disk usage
processes
05Monitorgrafana · live
prod-web-01cpumemup 41d
prod-db-01cpumemup 87d
staging-apicpumemup 5d
06Agent
per-host allow-level · every action is confirmed and audited
prod-web-01read
prod-db-01off
staging-apishell
08Account
karen@verstka.agencylogged in
account key · X25519acc_9d41…e07
master passwordargon2id · MK → MUK
09Teams
workspace · verstkawk_7f3a1c
karenowner
mariamember
07Audit
workspace · verstka
21:14prod-web-01claudesystemctl restart nginx
21:02prod-web-01karentail -f /var/log/nginx/access.log
20:58prod-db-01karensftp put backup-2026-08-15.sql.gz
20:41staging-apiclaudedocker compose ps
19:56prod-db-01mariapsql -c "select count(*) from users"
Agent request · Claude
Хост prod-web-01
run_command: $ systemctl restart nginx
Vault locked
Everything a terminal should carry
One window for the shell, the files, the keys and the secrets — synced across your team without the server ever reading them.
xterm.js · WebGL
ed25519 · PEM
Managers
Hosts, SSH key generation and import, snippets, local and remote port forwards.
SFTP
File browser
Browse remote filesystems, upload and download with live transfer progress.
XChaCha20-Poly1305
Encrypted vault
Secrets are encrypted on-device; the vault key is guarded by the macOS Keychain. The server stores ciphertext only.
X25519 sealed box
Team workspaces
Share hosts, keys and snippets. The workspace key is sealed to each member's public key — end to end.
key rotation
Revocation that works
Removing a member reissues the workspace key and re-encrypts every secret. The old key becomes useless.
Claude at the terminal — under supervision
The built-in MCP server lets Claude run commands over SSH on hosts you allow. Nothing happens silently.
01
Allow level
Every host carries its own permission level for agent access — from read-only to full shell.
02
Confirmation
Actions are confirmed before they touch the wire. You see the exact command Claude wants to run.
03
Mandatory audit
Every command is logged locally and on the server. The team audit view decrypts command bodies client-side with the workspace key.
The crypto scheme, briefly
Argon2id, XChaCha20-Poly1305 and X25519 sealed boxes. libsodium underneath, nothing exotic on top.
master password ──argon2id──▸ MK
├─ authKey ──▸ server (hashed again server-side)
└─ MUK ──▸ wraps the account private key
VaultKey (random) ──safeStorage / Keychain──▸ vault.key
account X25519 keypair; workspace keys (random) are wrapped:
• onto VaultKey — local offline cache
• onto each member's accPub (sealed box) — for sharing
item secrets encrypted with their workspace key (AAD = itemId|kind)
Verified end-to-end: a second device recovers workspace keys from the master password alone and decrypts shared secrets; Postgres holds only ciphertext; every MCP action leaves an audit record.
Up and running in two commands
Grab the DMG from GitHub Releases, or build from source and plug the agent into Claude Code.
Build and run
$ pnpm install
$ pnpm devRegister the MCP server in Claude Code
$ claude mcp add v-term -- npx -y @v-term/mcpPackage for macOS
$ pnpm --filter @v-term/desktop package # → release/*.dmg