ShelKit ⌘KGet ShelKit
local-only · no cloud round-trips

The terminal your InfoSec actually approves.

A native desktop terminal and connection manager for network and test engineers — every session in one window, one tab bar.

  • SSH
  • Telnet
  • Serial
  • RDP
  • VNC
  • SFTP
  • Local
Download ShelKit detecting your platform… See what's inside
  • latest
  • SBOM on every release
  • Hash-chained audit log
  • No telemetry
The ShelKit home screen: a command palette, recent terminals, and a new-connection picker for SSH, Telnet, RDP, SFTP, VNC, Serial, and Local.

one app · seven protocols

Every connection a network engineer reaches for.

Native, in-process, side by side in the same tab bar. No popping out to PuTTY, mstsc, or TigerVNC. No browser tabs. No SaaS.

  • SSH

    russh-backed PTY with blocking host-key verification — halts on a changed key, audits every connect.

  • Telnet

    Raw TCP for lab gear and legacy routers. No negotiation gotchas, no surprise drops.

  • Serial

    COM and /dev/tty enumeration, baud picker, console-recovery friendly for first-boot.

  • SFTP

    russh-sftp two-pane browser with a transfer queue and retry-on-disconnect.

  • RDP

    IronRDP embed, in a tab beside your terminals — not a separate mstsc window to lose.

  • VNC

    In-canvas viewer for KVM-over-IP and test-equipment GUIs. No third-party client.

  • Local

    PowerShell, cmd, bash, zsh — a local PTY in the same tab bar as your remote sessions.

An SSH session connected to a Debian host, with the session sidebar showing other saved sessions.

the AI assistant

Not a chatbot. An assistant that asks permission.

ShelKit's AI panel can read your terminal output, run a command on a specific tab, diff two config snapshots, and parse a show interface blob into a structured table — and every side-effecting action surfaces a Run / Edit / Reject card first.

  • 105+ tools — terminal ops, fleet ops, SFTP, packet analysis, monitor watches, investigations.
  • Bring your own model: OpenAI, Anthropic, Google, Azure, or local Ollama.
  • PII auto-scrubbed before any outbound request. Cite-from-docs grounding via your own indexed manuals.
  • Three autonomy modes per session — manual, read-only auto, full auto. Audit-logged either way.
ShelKit AI panel proposing a run_command tool call against a target host, with a Run / Edit / Reject consent card.
AI panel showing a tool result returned to the model and a structured chart rendered inline.

slash commands

Templated workflows out of the box.

/analyze-show interface on a Cisco IOS tab runs the command, parses the output, and highlights anomalies. /gen-config bgp peer emits a Junos set block ready to push. /summarize-log turns 500 lines of syslog into a four-line root-cause checklist. /diff-snapshots picks the two most recent config captures and summarizes the change.

playbooks & investigate

Turn ad-hoc troubleshooting into something you can share.

Record what you typed. Tag what was healthy. Re-run the same flow on the next box — or the whole fleet. Every step lands in a hash-chained record compliance can verify months later.

The Investigate panel running a health-check playbook against an SSH host. Two steps show green HEALTHY chips; captured output and an AI summary are below.
Playbook editor: a six-step Linux server-health-check with command, why-it-matters, and healthy-hint fields.

Author once. Run forever.

Scoped to a device type. Variables substituted at run time. Steps reorderable. Export and share with the team.

Playbook importer parsing commands out of a vendor PDF via an LLM, each detected command a checklist row.

Import from vendor PDFs.

Paste a runbook, drag in a vendor manual. The importer pulls commands out via LLM-backed structuring, you confirm, it’s a playbook.

Playbook running in flow mode with step-by-step execution status.

Sequential, flow, or fleet.

Step through one box at a time, or fan the same playbook across 50 hosts and see the drift in a single result table.

monitor

Five probe types. One watch list.

SSH stat collectors, HTTP probes, TCP reachability, ICMP pings, and running-config drift snapshots — all polymorphic under the same UI. Pause, edit, fan out by tag, alert to Slack / Teams / PagerDuty / webhook.

The Monitor view: an ICMP google.com probe, an SSH host-stat watch on localbox with CPU / memory / disk bars, and an SSH host-stat watch on overthewirelab.

tools

The utility belt you wish PuTTY had.

Ping, traceroute, port scanner, IP scanner, DNS lookup, WHOIS, TLS cert inspect, TCP probe, HTTP HEAD, MAC vendor, route table. All native, all auditable — none of them shelling out to nslookup on a laptop where InfoSec already stripped it.

Tools view with the Ping sub-tool: a host input, a count picker, and a chart of RTT readings over time.
Tools view with a TLS certificate inspector showing issuer, subject, SANs, expiry, and fingerprint.

more inside

The rest of the workbench.

Not every feature needs a hero shot. Here are the ones that quietly carry the day-to-day.

  • Packet analyzer: IO-over-capture chart, source-time heatmap, network topology graph, DNS top-names panel.

    Packet analyzer

    Open a .pcap or .pcapng and get IO charts, top talkers, protocol mix, TCP-stream follow, and DNS analytics in one view. No Wireshark side-trip.

  • API console with a configured HTTP request, headers, body, and response status.

    API console

    Postman-style request runner with collections, history, env-var substitution, and one-click curl export. Routable through your SSH tunnels.

  • SFTP two-pane file browser showing local and remote directories with a transfer in progress.

    Two-pane SFTP

    A real two-pane file manager — drag, drop, retry, queue. Edit a remote file locally and the change syncs back on save.

  • Credential manager listing saved credentials with type and target.

    Credential vault

    Passwords, SSH keys, agent forwarding — AES-256-GCM encrypted at rest with a local machine key. OS-keystore-bound keys shipping next.

  • An RDP session live in a tab beside the SSH session list.

    RDP in a tab

    IronRDP-backed embed with bitmap + AVC streaming. Sits in the tab bar with your SSH boxes. Clipboard syncs. No external mstsc window to lose.

  • Multi-Exec panel broadcasting one command to several tabs, with per-tab output and exit codes.

    Multi-protocol multi-exec

    Type once, send to every selected tab. Parallel or sequential. Capped at 50 to keep you from accidentally rebooting a region.

built to be approved

InfoSec will look. Here's what they'll find.

  • SBOM + signed updates

    A CycloneDX 1.5 SBOM ships with every release, and the auto-update manifest is Ed25519-signed. Authenticode (Windows) and Developer ID + notarization (macOS) code-signing are in progress.

  • Hash-chained audit log

    Every connect, command, credential access, AI tool call, config change. Tamper-evident SHA-256 chain. Exportable.

  • Encrypted credential vault

    Credentials are AES-256-GCM encrypted at rest with a local machine key (0600). No plaintext credentials on disk. OS-keystore-bound keys are on the roadmap.

  • Managed policy / MDM

    Drop a policy.json via Intune / Jamf / GPO to lock settings, restrict protocols, force SSO, gate the auto-updater.

  • SIEM forwarding

    Real-time audit fan-out to Splunk HEC, Microsoft Sentinel, syslog (UDP / TCP / TLS), or ArcSight CEF — retry & backoff included.

  • Signed auto-updates

    Ed25519 signature on the manifest and the bundle. User-controlled. IT can force or disable via policy.

vs. the incumbents

Where ShelKit fits.

The tools network engineers use today, lined up against the checks an enterprise InfoSec or procurement team makes.

ShelKitMobaXtermSecureCRTTermiusPuTTY + scripts
Local-only (no SaaS by default) ✓✓✓cloud-first✓
Multi-protocol in one window SSH · Telnet · Serial · SFTP · RDP · VNC · LocalmostSSH · Telnet · SerialSSH-centricSSH only
Vendor-aware AI with consent cards ✓ read · run · parse · fleet——chat only—
Hash-chained audit log ✓ tamper-evidentlog filelog filecloud-side—
Managed policy / MDM hooks Intune · Jamf · GPOlimited✓limited—
Approved by enterprise InfoSec designed for itoften blockedcommonly approvedegress blockedcase-by-case
Price (per seat) free during early accessPro $69 / yr$149 + maint.$12 / mofree

FAQ

The questions we keep getting.

Does ShelKit phone home?
No. There is no telemetry endpoint, no license server, no crash reporter. The only outbound calls are the ones you initiate (SSH / Telnet / etc.) plus a signed-manifest update check. The full egress inventory ships in the docs.
Is the source open?
Not yet — closed-source through the first paying customers. Binaries are free during early access under a per-engineer EULA. The release pipeline ships SBOMs and structured-license metadata so InfoSec can still review transitive dependencies. An OSS transition is a planned post-launch milestone.
What runtime does it use?
Tauri 2 — a Rust backend (SSH via russh, SFTP via russh-sftp, serial via the serialport crate, RDP via IronRDP, VNC via vnc-rs) with a React + TypeScript frontend. Small binary, no Electron, no bundled Chromium-as-app.
Does the AI panel send my terminal output to a cloud LLM?
Only when you ask it to, and only after PII auto-scrubbing. The panel is bring-your-own-key (OpenAI, Anthropic, Google, Azure) or local Ollama. With Ollama, no terminal content leaves your laptop. Every proposed tool call surfaces a Run / Edit / Reject card first.
How do auto-updates work?
The app polls a signed manifest. Both the manifest and the bundle are Ed25519-verified against a public key baked into the running app — a signature failure means no install. You always see a Notify banner with Apply / View Notes / Skip. Admins can disable updates via managed policy.
How do I get it?
Download it above for your platform, or grab any release from GitHub. Enterprise teams can reach out for a managed-policy walkthrough and a direct line to the maintainer.

download

Get ShelKit for Windows.

A Windows .msi installer, or a self-contained portable build for controlled and offline environments. Every release ships a CycloneDX SBOM and an Ed25519-signed update manifest, and honors managed policy either way. Authenticode code-signing is in progress. macOS is next.

Prefer to verify first? Browse all releases, checksums, and SBOMs on GitHub. Code-signing is in progress, so Windows may show a SmartScreen “unknown publisher” prompt for now — the portable build avoids it. ShelKit is closed-source; free during early access.

contact

Questions, bugs, or a pilot?

Found a bug, want a feature, or evaluating ShelKit for your team? Reach out — replies within a business day.

Email the maintainer prasanth.andena@gmail.com Raise an issue Bugs & feature requests on GitHub Report a vulnerability Responsible disclosure — security policy