sshelf

A fast terminal UI for managing and connecting to SSH hosts. Save each node once, then fuzzy-search and connect in two keystrokes.

sshelf keeps its own host database and generates the correct ssh command for you — it never reads or edits ~/.ssh/config (except an explicit, read-only import). No account, no cloud, no telemetry: your hosts live in a human-readable TOML file on your disk, secrets live in your OS keyring, and the only network activity is the ssh it hands your terminal to.

Get started

brew install max-rh/tap/sshelf     # macOS or Linux
sshelf                             # launch the TUI

• Install — Homebrew, shell installer, .deb, .rpm, Gentoo, or cargo.
• Quickstart — the first five minutes: add or import hosts, connect.
• FAQ & troubleshooting — common questions, quick answers.

What’s in the box

• An atuin-style fuzzy launcher with frecency ordering — Searching & connecting
• A dual-pane SFTP file browser (Ctrl-t) — Transferring files
• Background port forwards that survive quitting (Ctrl-f / F4) — Port forwarding
• Sites with a shared bastion + defaults, plus free-form tags (F3) — Sites & tags
• Stored passwords/passphrases auto-supplied at connect, and 2FA code prompts — Passwords, keys & 2FA
• SSH-config export — one Include line and plain ssh/scp, rsync, and VS Code Remote see your hosts — Exporting to SSH config
• Import from ~/.ssh/config or your whole Tailscale tailnet (--tailscale) — Importing hosts
• A scriptable CLI (sshelf add, list --json, print-command, …) — CLI reference

Platforms: macOS + Linux, x86_64 and arm64. Runtime: OpenSSH 8.4+ for password auto-supply.

How it’s built

Deciding whether to trust it — or just curious how the pieces fit?

• Security & threat model — exactly what stored secrets are protected against, and what they are not.
• How the ssh command is built — argv generation and the SSH_ASKPASS mechanism that supplies passwords without sshpass.

Contributing

Start with CONTRIBUTING.md, then the Development section in the sidebar: architecture, module map, data model, and the decision log. Docs follow the docs-in-sync rule — every behavior change updates the relevant page here in the same change, with a dated entry in the progress log.