OpsMaxx

A free, open-source SSH client, SFTP browser, database manager, secrets vault and secure AI-agent gateway — in one desktop app.

Your DevOps workstation, everywhere. Windows · macOS · Linux.

opsmaxx.dev

Website · Install · Features · AI agents · Workspaces · Terminal · Databases · Tunnels · Vault · Security · FAQ

---

[!IMPORTANT] Windows shows a security warning the first time you run OpsMaxx. The build is unsigned — a certificate costs $200–$400 a year — so Windows cannot confirm who published it. That says nothing about whether the file is safe.

Every release is scanned before publishing and ships a SHA-256 for every file. → Getting past the warning · Antivirus scan results

OpsMaxx is a free and open-source alternative to MobaXterm, PuTTY, Termius, SecureCRT and MobaXterm Personal Edition, built for engineers who spend the day moving between bastions, production boxes and databases — and increasingly, for the AI coding agents helping them do it. It combines an SSH terminal, SFTP file browser, server monitoring, SSH tunnels, a multi-engine database client, an encrypted password vault and a secure MCP bridge for Claude Code, Claude Desktop, Codex and other AI agents in a single window — with no account, no telemetry and no subscription.

What makes it different isn't any one of those — MobaXterm, Termius and the rest each do some of this. It's that they're all in the same place, sharing the same credential store, and that credential store is now also what stands between an AI agent and your infrastructure, not something an agent ever has to be handed directly.

Why OpsMaxx

Most terminal tools do one thing. A typical DevOps task needs four: open a shell through a jump host, tail a file, poke a database that is only reachable from inside the network, and look up a credential. OpsMaxx puts those in one place, keeps them organised per project, and seals your credentials and your server list with your operating system's keychain rather than leaving them in a plaintext config file.

• No lock-in — connections import from your existing ~/.ssh/config
• No account — nothing about you or your estate is uploaded; the one connection OpsMaxx makes on its own is the update check, on by default and switchable off
• No cost — MIT licensed, free forever, contributions welcome
• No exposed credentials, even to AI — Claude Code, Claude Desktop and Codex can run commands and read files through it, but never see a password, private key, IP or username — see AI Agent Access

What's in it

SSH terminal	xterm with GPU rendering, split panes, search, and unlimited chained jump hosts per server
Local terminal	Your own zsh, bash, PowerShell, Git Bash, MSYS2 or WSL in a tab beside the SSH ones — and reachable by no AI agent
SFTP browser	Browse, edit, upload and delete over the same connection
Cloud servers	Google Cloud, AWS and Azure machines through the gcloud, aws or az already on your machine — no cloud credential is stored, and the result is a real SSH session, so files and monitoring work against it too
Remote desktop	RDP to a Windows host, through a bastion when it needs one — with its own account, and no SSH required
Monitoring	Live CPU, memory, disk and network per server, a fleet wall, background checking and webhook alerts
Service checks	HTTP checks against anything you can reach, running whether or not the window is open, with ping and traceroute beside them
Tunnels & VPN	Local, remote and SOCKS5 forwards; userspace WireGuard with no administrator rights; OpenVPN, frp, and Tailscale and ngrok embedded — no client to install
HTTP client	REST, WebSocket and GraphQL requests sent from this machine, through a server's SSH connection or over a VPN — so localhost can mean that server, with a private CA trusted per collection
Databases	PostgreSQL, MySQL, SQL Server, MongoDB and Redis, direct or through a bastion
Containers	Docker and Kubernetes on a server or on this machine — containers, images, logs and a shell inside one
CI/CD	Jenkins, GitLab and GitHub Actions read beside the server a run changed — pipelines, run history, and the log of the step that failed. Reading only, and off until you turn it on: enabling it polls somebody else's API on a timer with a token you supply
Vault	AES-256-GCM secrets store, with credentials in your OS keychain rather than a config file
Sync & devices	Servers, workspaces, tunnels, VPN profiles and the vault carried between your own machines through , a relay you run — sealed on your machine before it leaves, so the relay stores what it cannot read

→ The full feature list, what it replaces, and the work it was built for

Install

brew install --cask opsmaxx/tap/opsmaxx     # macOS

The tap is third-party, so Homebrew asks you to brew tap opsmaxx/tap and trust it first.

Windows is a direct download.

Download an installer from the latest release — .exe for Windows, .dmg for macOS, .AppImage or .deb for Linux.

→ Every install route, checksums, and the first-run warning

Quick start

1. Add a server — click + in the Connections sidebar, or press Ctrl+N. Authenticate with a password, a private key, an SSH agent or a certificate.
2. Add jump hosts in the same dialog — click Add jump host; hops connect in order, and each can borrow a saved server's credentials.
3. Open a session — click a server. Double-click for a second session in its own tab.

Already keep hosts in ~/.ssh/config? Import them instead of retyping — ProxyJump comes across too.

→ The longer walkthrough, with screenshots

Documentation

Features	The full list, the comparison with MobaXterm, PuTTY, Termius and SecureCRT, and real-world use cases
Install	Every route for Windows, macOS and Linux, plus the first-run security warning
AI agent access	How MCP clients reach your infrastructure without seeing a credential
Workspaces	Keeping clients, environments and projects apart, and locking them
Terminal	The terminal, the local shell, the command palette and every shortcut
Cloud servers	Google Cloud, AWS and Azure through the CLI you already have — and why it brokers rather than wraps
Monitoring	Watching a fleet, and running one change across all of it
Databases	Five engines, direct or through a bastion
Tunnels and VPN	Forwards, SOCKS5, WireGuard, OpenVPN and frp
Vault and settings

Security

• Credentials and your server list are sealed with Electron safeStorage, backed by DPAPI on Windows, Keychain on macOS and libsecret on Linux. Not everything the app writes is sealed — the MCP bridge config holds a live token in plaintext so the agent can read it, and captured request bodies and files opened in an external editor are plaintext by nature. SECURITY.md lists every file and says which is which
• The vault and backups use AES-256-GCM with scrypt key derivation, N=32768 r=8 p=3; a file records the parameters it was written with and is re-sealed at the current ones when next opened
• Workspace passwords are stored as scrypt verifiers compared in constant time. They gate the UI — they do not encrypt that workspace's servers separately
• Host keys are verified: unknown servers prompt with a SHA-256 fingerprint, and a changed key is refused outright
• Remote desktop certificates are pinned the same way — RDP servers are self-signed by default, so a first sighting asks and a change is refused
• Sync is end-to-end encrypted: every object is sealed on the device before it reaches the addy relay, and the vault travels still encrypted under your master password. The relay sees how many devices an account has, when they sync, and the name and size of each sealed collection — never what is inside. Credentials kept only in the OS keychain never leave the machine
• Shell input is parsed, never evaluated — no eval on anything you type
• The renderer runs with contextIsolation on and nodeIntegration off, behind a strict Content-Security-Policy

Found a vulnerability? Please read SECURITY.md — do not open a public issue.

Contributing

Contributions are very welcome, whether that is code, documentation, a bug report or a translation. Start with CONTRIBUTING.md for the architecture overview and development workflow, and please follow our Code of Conduct.

Good first issues are labelled good first issue.

Licence

OpsMaxx is released under the MIT Licence — free to use, copy, modify and share, for personal and commercial work alike, with no fee and no subscription.

This tool is not sold. It is given to the community. If someone is charging you for OpsMaxx itself, you are being overcharged — download it here for free. The MIT licence does permit others to redistribute or build commercial products on top of it; that is a deliberate part of being genuinely open source, and it is what lets companies adopt it without a legal review.

Please do keep the copyright notice, and do not imply the maintainers endorse a fork.

---

Built for the DevOps community. If OpsMaxx saves you time, a ⭐ helps others find it.

⬇ Download OpsMaxx · 🐞 Report a bug · 📧 Contact

Keywords: open source SSH client, free SSH client for Windows, free MobaXterm alternative, PuTTY alternative, Termius alternative, SecureCRT alternative, Xshell alternative, MobaXterm for Mac, SSH client for macOS, SSH client for Linux, SSH terminal manager, SSH connection manager, SFTP client, SCP file transfer, SSH tunnel manager, port forwarding tool, SOCKS5 proxy client, bastion host client, jump host SSH client, ProxyJump GUI, ssh config importer, server monitoring tool, database GUI client, PostgreSQL client, MySQL client, MongoDB client, Redis client, SQL Server client, database over SSH tunnel, password manager for developers, encrypted secrets vault, AES-256-GCM vault, DevOps tools, sysadmin tools, self-hosted, no telemetry, no subscription, Electron SSH client, cross-platform terminal, Windows macOS Linux, MCP server, Model Context Protocol, AI agent SSH access, Claude Code MCP integration, Claude Desktop MCP server, Codex MCP server, Gemini CLI MCP, AI DevOps tool, secure AI infrastructure access, AI agent access control, credential-free AI automation, human-in-the-loop AI approvals, AI audit log.