Your servers,
one calm window.
HostDock is an SSH client and server manager for your desktop. Terminal, files, monitoring, Docker and port forwarding share one connection per server, and an AI assistant helps out, but only runs what you allow.
This is the Apple silicon build. On an Intel Mac, pick the universal build under Other versions.
Other versions
- Apple siliconM1 and later · 20 MB
- UniversalIntel and Apple silicon · 38 MB
Not sure which chip? Apple menu → About This Mac: a chip named Apple M… is Apple silicon. Whichever you install, later updates arrive inside the app for that same build.
No agent on your servers · No account required · macOS 12 Monterey or later
What is HostDock?
HostDock is a desktop application for working with Linux servers over SSH. It puts the tools you would otherwise juggle (a terminal, an SFTP client, a monitoring dashboard, Docker commands and SSH tunnels) into one window, organized by server.
The core is written in Rust with its own SSH implementation, so it never shells out to the system ssh. Nothing is installed on your servers: monitoring and Docker management run ordinary commands over the same SSH connection your terminal uses.
It also has an AI assistant that can investigate and fix problems on your servers, and a local MCP server so tools like Claude Code can do the same. Both work under one set of rules: you choose which commands run on their own and which ask you first.
Everything you open a server for
One SSH connection per server, shared by every tool. Open a terminal, browse files and watch the CPU without logging in three times.
SSH terminal
Tabs, jump hosts, proxies, 2FA
SFTP file manager
Browse, transfer, edit files in place
Server monitoring
Agentless CPU, memory, disk and network
Docker management
Containers, live logs, shells
Port forwarding
Local, remote and SOCKS5/HTTP tunnels
AI assistant
Your model, your rules on what it may run
MCP server
Let Claude Code and Codex reach your servers
Sync & cloud space
Encrypted vault, notes, scripts and files
An assistant that asks before it acts
Describe the problem in plain words. The assistant reads logs, checks disk and services, and proposes a fix. Read-only commands run on their own; anything that changes the server waits for your OK.
- Sign in to use the AI service HostDock provides, or any OpenAI-compatible API: OpenAI, DeepSeek, OpenRouter, Ollama and more
- Three execution modes, with a safe read-only allowlist as the default
- Server addresses and credentials are never sent to the model
- Every command it runs is written to a command log
Let Claude Code work on your servers, not with your keys
Turn on HostDock's local MCP server and give each AI tool its own token. The tool can run commands and move files on the servers you allow, while your keys stay inside HostDock.
# Copy this from HostDock → Settings → MCP server
$ claude mcp add --transport http hostdock \
http://127.0.0.1:47321/mcp \
--header "Authorization: Bearer <token>"A token per tool
Limit each token to some servers, choose how much it may run on its own, and let it expire after 7 or 30 days.
Approvals in HostDock
When a command needs approval, HostDock shows it in a dialog. You can edit it, run it or reject it.
Local only by default
The server listens on 127.0.0.1. There is no cloud relay, so nothing passes through our backend.
Clear about what's encrypted
Sync is optional and runs on two separate channels. Here is exactly what each one protects.
| Vault | Cloud Space | |
|---|---|---|
| What's in it | Servers, passwords, private keys, saved credentials, port-forwarding rules | Notes, scripts, File Station files, appearance settings |
| End-to-end encrypted | Yes: XChaCha20-Poly1305, key derived with Argon2id | No. Stored as-is so it can sync without a password |
| Needs a sync password | Yes, and the server never receives it | No, syncs as soon as you sign in |
| What our server can see | Ciphertext, plus how many records of each kind you have | The content itself |
Nothing to install on servers
Monitoring reads /proc, df and ps over SSH every 3 seconds, costing about 0.15% of one CPU core. Docker uses the server's own docker CLI.
Rust core, no OpenSSL
SSH, SFTP and TLS are pure Rust (russh, rustls). The app never calls the system ssh or scp binaries.
Secrets stay in the Keychain
Passwords and keys are encrypted in the local database; the key lives only in the macOS Keychain. The app runs in the macOS sandbox.
Screen-share friendly
One switch hides every server address in the interface, so you can record or share your screen safely.
Frequently asked questions
What is HostDock?
HostDock is a desktop app for managing Linux servers over SSH: terminal, SFTP file manager, live monitoring, Docker, port forwarding and an AI assistant that asks before it runs anything, in one window.
Does HostDock need anything installed on my servers?
No. HostDock connects over plain SSH and runs standard commands (reading /proc, df, ps, the docker CLI). There is no agent, daemon or open port to add on the server.
Which platforms does HostDock run on?
Today HostDock runs on macOS 12 Monterey or later. Windows and Linux builds are planned but not available yet. There is no mobile app.
Do I need an account?
No. Everything works locally without signing in. An account is only needed to sync between your computers, and signing in uses a one-time code sent to your email, so there is no account password.
Can the HostDock server read my passwords and keys?
No. Servers, credentials and port-forwarding rules are encrypted on your device with a sync password the server never receives (Argon2id + XChaCha20-Poly1305). Notes, scripts and files in Cloud Space are a separate channel and are not end-to-end encrypted. The security page explains exactly what the server can and cannot see.
Bring your servers into one window
Free download for macOS 12 Monterey or later.