Transit Community Edition

A cross-platform GUI SSH client for network engineers with an embedded, read-only AI agent that investigates your gear — on your own Anthropic or OpenAI API key, on your ChatGPT plan, or on models running on your own hardware. No account of ours, no subscription of ours, no telemetry.

Forked from the proprietary Transit desktop client at 6.5.9 and released under the Apache License 2.0 (see License below). Builds are published as GitHub Releases.

What it does

• SSH terminal built on russh and xterm.js: tabs, split panes, jump hosts (up to four hops), per-device colours, session logging, a programmable button bar, broadcast input to many sessions, and bulk "launch all" from the inventory.
• USB-to-serial console cables, a local OS shell, an SFTP Files pane, a REST API surface for controllers (UniFi, Meraki, NetBox, …), and a packet-capture explorer that the agent can read as a digest.
• The agent. A chat panel whose model can list your open sessions, read their scrollback (through a redaction filter), propose a command, ask you a question, propose a read-only API GET, or query an open capture. That is the whole tool surface — exactly six tools.
• Every proposed command passes a per-vendor policy gate (Junos, IOS, IOS-XE, IOS-XR, NX-OS, EOS, PAN-OS, plus your own YAML policies) and an approval modal. Both, always. Nothing runs unattended.

How the AI runs — and what it never touches

Path	Where the model runs	What leaves your machine
Your API key (Settings → AI providers)	Anthropic's or OpenAI's API	Redacted prompts + your key, to that provider's own host only, over TLS verified against your OS trust store. No redirects, no ambient proxy.
Your ChatGPT plan (Settings → AI providers → Sign in with ChatGPT, preview)	OpenAI's API, billed to your personal Plus/Pro plan	A one-time browser sign-in at auth.openai.com; then redacted prompts + a short-lived token to OpenAI's API. The refresh token stays in your OS keychain and is revoked at OpenAI when you sign out.
Your hardware (Settings → Local models)	Ollama on this machine, or a self-hosted OpenAI-compatible endpoint (vLLM, LM Studio, llama.cpp, LiteLLM)	Prompts to the endpoint you configured. Nothing else.

The binary makes no other network connection. There is no update check, no crash reporter, no usage ping. This is enforced, not promised: scripts/no-phone-home-scan.sh runs on every release binary and fails the build if any hosted-infrastructure hostname or client symbol is present. Run it yourself:

cargo build --release --manifest-path src-tauri/Cargo.toml --bin transit_app
./scripts/no-phone-home-scan.sh src-tauri/target/release/transit_app

Your provider key (or ChatGPT refresh token) is stored in the OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service), written through a one-way IPC command, and never returned to the UI. Device credentials never enter the inventory file and never reach the agent — the crate that holds the agent's tools is forbidden by cargo deny from depending on the crate that holds secrets.

Install

Use the one-line installer, or download the artifact for your platform from the latest release and verify it against SHA256SUMS.txt (below). Builds are unsigned.

• One-line install. Each script prints its plan and asks before installing (-y / -Yes skips the prompt, --dry-run / -DryRun only downloads and verifies the checksum). macOS and Linux share one script; it picks the dmg, deb, rpm, or a pacman package built from the deb, and falls back to the AppImage on distributions without one of those. Windows installs for the current user with no administrator prompt and needs PowerShell 7 (winget install Microsoft.PowerShell); the built-in Windows PowerShell 5.1 is not supported.

  curl -fsSL https://raw.githubusercontent.com/transit-community/transit/main/install.sh | sh
  

  irm https://raw.githubusercontent.com/transit-community/transit/main/install.ps1 | iex
  

• Verify a download. Save the file and that release's SHA256SUMS.txt in one folder and run the check there. Your file's line must end in OK; --ignore-missing skips the files you did not download. A match proves the download is intact, not who built it.

  sha256sum -c --ignore-missing SHA256SUMS.txt       # Linux
  shasum -a 256 -c --ignore-missing SHA256SUMS.txt   # macOS
  

  On Windows, compare Get-FileHash <file> in PowerShell with your file's line. Up to 6.5.10, SHA256SUMS.txt spells each name with spaces where the downloaded file has dots; check those releases with this (on macOS, shasum -a 256 -c --ignore-missing in place of sha256sum -c --ignore-missing):

  sed -E 's/ /./g; s/^([0-9a-f]{64})\.\./\1  /' SHA256SUMS.txt | sha256sum -c --ignore-missing
  

• macOS (.dmg, Apple Silicon and Intel): after copying the app, clear the quarantine bit once: xattr -d com.apple.quarantine "/Applications/Transit Community Edition.app".

• Windows (-setup.exe or .msi): SmartScreen will warn about an unrecognised publisher; choose More info → Run anyway. The one-line installer requires PowerShell 7; the installers themselves do not.

• Linux, x86_64 and aarch64 for every format: .deb for Ubuntu 24.04+ / Debian 13+, .rpm for Fedora 41+ and EL10 with EPEL, and an .AppImage for everything else (Arch and derivatives such as Omarchy, openSUSE, NixOS with appimage-run). Make the AppImage executable and run it; it needs FUSE 2 ( on Arch), or run it with . RHEL/EL9 has no WebKitGTK 4.1 package and is not supported by any format.

This is the beginning of the README. Read the rest at the original. Read the full README ↗