v1.0.0: the first stable release — macOS, Linux and Windows

The SSH client for servers you can’t SSH into.

Every machine you look after, in one window — plain SSH, your ~/.ssh/config, and EC2 instances behind AWS Session Manager with no open port and no public IP.

Download for macOSDownload for LinuxDownload for WindowsView on GitHub

Free · v1.0.0 · macOS universal, Linux x86_64 and ARM64, Windows x64 (preview).

Watch the 2-minute tour
api-gateway — SSH over SSM
mssh connected to an EC2 instance over SSH through AWS Session Manager, showing a terminal with systemctl status and an access log, and a sidebar of workspaces

The tour

See mssh in two minutes

From a new workspace to a shell on an instance in a private subnet — the whole path, start to finish.

A tour of mssh

Plays from YouTube once you press play — or watch it there.

Four ways in

From a VPS you rent by the month to an instance in a private subnet

Each connection records exactly how to reach its machine, so you never assemble the command again.

System SSH

One alias from your ~/.ssh/config.

OpenSSH does the rest — user, key, ProxyCommand, jump hosts — exactly as on the command line.

Direct SSH

Host, user and credentials.

The SSH client is compiled in. Agent, key file or a saved password; host keys always checked.

AWS SSM

An instance id, a profile, a region.

Session Manager reaches instances with no open port and no public IP. You land as ssm-user.

SSH over SSM

Session Manager, then real SSH inside it.

The private-subnet tunnel, your own user, and file transfer — all through the same connection.

Setting up

Add a machine in under a minute

Describe the machine once — mssh remembers how to reach it. Paste an ssh command and it fills the form in for you.

1

Make a workspace

A name, a colour, and the AWS profile and region its SSM machines inherit. Use the AWS CLI's own configuration, or keep a key pair here.

mssh
The New workspace dialog: name Data Platform, violet colour, AWS CLI configuration, profile data-prod in eu-west-1
2

Add a connection

Pick how to reach it, then fill in only what that way needs. Here: SSH over SSM, by instance id, as ec2-user with a key file — profile and region inherited.

mssh
The New connection dialog with SSH over SSM selected, an instance id, user ec2-user and a key file

Workspaces

One workspace per account, environment or customer

Group machines with a colour and their own AWS profile and region. The home page picks up where you left off, and the sidebar shows which machines have a session open.

mssh
The mssh home page: recently used machines and three colour-coded workspaces

Files · ⌘E

Move files over the connection you already have

Browse, download and upload over SFTP on the terminal’s own SSH connection — no second login, no second tunnel, and it works through Session Manager too. Every transfer writes to a hidden file and takes its real name only when complete, so a cancelled upload never leaves half a file behind.

mssh
The Files drawer listing a remote home directory, with a download in progress and finished transfers

History

Who connected to which machine, when, and for how long

Every session is recorded with its machine, workspace, AWS profile and how it ended. Filter by workspace, machine and time, and export CSV or JSON. The record stays when a machine is renamed or deleted — and it stays on your computer.

mssh
The History page: a table of sessions with their duration, machine, workspace, AWS profile and how they ended

⌘P

Jump to any machine by name, host or workspace

A command palette for your whole fleet. Type a few letters, press return, and you are on the machine — with its last session still there if it is open.

mssh
The command palette filtering machines by the text stag

Appearance

A terminal that looks like yours

GitHub, iTerm2, VS Code, Dracula, Nord, Solarized, Gruvbox and Tokyo Night — or Auto, which follows macOS between light and dark. Font, size, line height and cursor apply to live sessions, without reconnecting.

Appearance
The Appearance page: light, dark or system app theme, and ten terminal colour presets shown as live previews, with Dracula selected
Dracula
The same session in the Dracula terminal theme
Dracula, in the dark app
GitHub Light
The same session in the GitHub Light theme, with the app in light mode
Auto: GitHub Light when macOS is light

The details

Built by debugging the hard parts

Tabs that survive

Several terminals per machine. Switch pages and come back to the same scrollback, the same directory, the same running top.

A real terminal

A full pty with xterm-256color: vim, htop and colours work, and the remote shell follows the window as you resize it.

Search the scrollback

⌘F (Ctrl+Shift+F on Linux and Windows) finds text anywhere in a session, every match highlighted, with a running count.

Host keys, checked

The first time, mssh shows the fingerprint and asks — even through an SSM tunnel. A key that changed is refused, never offered.

Busy servers, handled

When sshd’s MaxStartups turns a login away before it authenticates, mssh tries again on its own — over SSM too.

AWS your way

Use the AWS CLI’s own profiles and SSO, or keep a key pair on a workspace — imported from your shell in one click.

Nothing leaves your computer

mssh has no servers of its own. It talks to your machines and to AWS, and to nothing else.

  • Connections, passwords and any AWS keys live in a local SQLite file — 0600 in a 0700 directory. No account, no sync, no telemetry.
  • Stored AWS keys reach the AWS CLI through its environment, never its command line, where any user could read them with ps.
  • Host keys are verified against ~/.ssh/known_hosts. There is no “connect anyway”.
  • The session history never contains a password or a key — only where the credentials came from.
  • Only PATH is taken from your login shell, so mssh can find aws and ssh when opened from Finder.

Download · v1.0.0

macOS, Linux and Windows, free

Pick the file for your system. Every build, including earlier ones, is on the GitHub releases page.

macOS

Linux

Windows · preview

All releases on GitHub

Install on macOS

  1. 1

    Drag mssh into Applications

    Open the disk image and drop the app on the Applications folder.
  2. 2

    Open it — macOS will block it the first time

    mssh is not signed with an Apple Developer ID yet, so the first time you open it macOS says it “cannot be opened” or “cannot verify” the app. Choose Done (not Move to Bin).
  3. 3

    Allow it in Privacy & Security

    Open System Settings → Privacy & Security and scroll down to Security. Next to “mssh was blocked to protect your Mac”, click Open Anyway, then confirm with your password or Touch ID. You only do this once; after that mssh opens like any other app.

    Or clear the quarantine flag from a terminal instead:

    xattr -dr com.apple.quarantine /Applications/mssh.app
  4. 4

    For Session Manager only

    Install the AWS CLI and the Session Manager plugin. mssh checks for both before it connects and tells you which one is missing.
    brew install awscli
brew install --cask session-manager-plugin

Install on Linux

  1. 1

    Install with your package manager

    It brings in GTK and WebKitGTK, and mssh appears in your applications menu.
    sudo apt install ./mssh_1.0.0_amd64.deb
sudo dnf install ./mssh-1.0.0-1.x86_64.rpm
sudo zypper install --allow-unsigned-rpm ./mssh-1.0.0-1.x86_64.rpm
  2. 2

    Or run the AppImage

    For Arch, Manjaro and anything else: it carries GTK and WebKitGTK inside, so there is nothing to install.
    chmod +x mssh-1.0.0-x86_64.AppImage
./mssh-1.0.0-x86_64.AppImage
  3. 3

    For Session Manager only

    Install AWS’s own AWS CLI v2 — not the version 1 in Ubuntu’s apt — and the Session Manager plugin. Shortcuts on Linux take Shift as well — Ctrl+Shift+T, Ctrl+Shift+P — leaving Ctrl+letter to the shell.

Install on Windows · preview

  1. 1

    Run the installer

    It asks for administrator rights once, installs into C:\Program Files\HaNo\mssh, adds mssh to the Start menu and the desktop, and installs Microsoft’s WebView2 runtime if the machine does not have it yet (Windows 11 does).

    Or unzip the portable mssh.exe anywhere and run it — nothing installed, but WebView2 must already be present.

  2. 2

    SmartScreen will warn you the first time

    Neither file is signed with a code signing certificate yet, so Windows says “Windows protected your PC”. Choose More info, then Run anyway — once. Your browser may ask whether to keep the download first, for the same reason.
  3. 3

    For Session Manager only

    Install the AWS CLI and the Session Manager plugin, then start mssh again — a running program keeps the PATH it started with.
    winget install Amazon.AWSCLI
  4. 4

    Uninstall from Settings → Apps

    Your connections stay in %AppData%\mssh\mssh.db, so installing again picks up where you left off. Shortcuts take Shift, as on Linux — Ctrl+Shift+T, Ctrl+Shift+P.

FAQ

Questions

Is mssh free?+

Yes. There is no account, no subscription and no telemetry. Download the app from the GitHub releases page.

How does mssh reach an EC2 instance with no open port and no public IP?+

Through AWS Systems Manager Session Manager, the same way `aws ssm start-session` does. The instance needs the SSM Agent and an IAM role with AmazonSSMManagedInstanceCore; your computer needs the AWS CLI and the Session Manager plugin. With SSH over SSM, mssh then runs a real SSH handshake through that tunnel, so you log in as your own user and can transfer files.

Where are my connections and passwords stored?+

In a local SQLite database on your computer, readable by you alone (0600 in a 0700 directory). Nothing is synced or sent anywhere. AWS credentials stay with the AWS CLI unless you choose to keep a key pair on a workspace, and even then they are handed to the AWS CLI through its environment, never its command line.

Why does macOS warn me the first time I open it?+

The app is not yet signed with an Apple Developer ID, so Gatekeeper cannot vouch for it and blocks it the first time. Close the warning with Done, then open System Settings → Privacy & Security, scroll to Security and click Open Anyway next to mssh, and confirm with your password. You only have to do this once. Alternatively, run `xattr -dr com.apple.quarantine /Applications/mssh.app` in a terminal.

Does mssh work on Linux or Windows?+

Linux, yes — since version 0.9.0. There is a .deb for Ubuntu, Debian and Mint, an .rpm for Fedora and openSUSE, both for x86_64 and ARM64, and an x86_64 AppImage for any other distribution. It needs glibc 2.34 or newer (Ubuntu 22.04, Debian 12 and later). Windows arrived in 0.10.0 as a preview: an x64 installer and a portable zip. Every connection kind is tested by CI on Windows, but it has not been used much by hand yet, and the Files drawer is not available on System SSH connections there. It needs Windows 10 version 1809 or newer, or Windows 11, on x64.

How do I upgrade to a new version?+

Download the new release and install it over the previous one. Connections, passwords, settings and session history stay where they were, and the database is upgraded in place from any earlier release. There are no automatic updates yet — watch the GitHub releases to hear about new versions.

Why does Windows warn me the first time I run it?+

Neither the installer nor the portable mssh.exe is signed with a code signing certificate, so SmartScreen shows “Windows protected your PC”. Choose More info, then Run anyway — you only have to do this once. Your browser may also ask whether to keep the download, for the same reason.

Can I keep using my ~/.ssh/config?+

Yes. The System SSH kind takes a Host alias and nothing else: OpenSSH supplies the user, the key, ProxyCommand, jump hosts and host-key checking, exactly as on the command line.

Stop assembling the command

Free, local, and built for the machines that are hardest to reach.

Download mssh 1.0.0