# HostDock

> HostDock is a desktop app for managing Linux servers over SSH: terminal, SFTP file manager, live monitoring, Docker, port forwarding and an AI assistant that asks before it runs anything, in one window.

Key facts:

- Platform: macOS 12 Monterey or later. Signed with an Apple Developer ID and notarized by Apple. Windows and Linux are planned, not available yet. No mobile app.
- Status: version 1.0.1, free to download at https://hostdock.dev/download/.
- No agent is installed on servers: monitoring reads /proc, df and ps over SSH; Docker uses the server's docker CLI. Monitoring supports Linux servers.
- SSH is implemented in Rust (russh, rustls); the app never calls the system ssh. Supports passwords, private keys, keyboard-interactive 2FA, up to 3 chained jump hosts, per-server SOCKS5/HTTP proxies. Not supported yet: ssh-agent, SSH certificates, split panes, local shell.
- AI assistant: the AI service HostDock provides (sign in, no API key, a monthly token allowance) or any OpenAI-compatible API with tool calling. Three execution modes (ask every time / safe read-only allowlist, the default / run everything); commands that read secrets always ask. The model never receives server addresses, usernames or credentials. All commands are audit-logged.
- MCP server: local Streamable HTTP endpoint at http://127.0.0.1:47321/mcp, off by default. One bearer token per AI tool, with server scope, execution mode (read-only / ask / safe allowlist / run everything), expiry and pause. Ready-made configs for Claude Code, ChatGPT/Codex, Cursor and WorkBuddy. SSH keys never leave HostDock.
- Sync is optional (email-code sign-in, no account password). The vault (servers, credentials, port-forwarding rules) is end-to-end encrypted: Argon2id-derived key wraps a random data key; records use XChaCha20-Poly1305; the server never receives the sync password. The server can see record counts per kind, sizes and timestamps. Cloud Space (notes, scripts, File Station files, appearance) is NOT end-to-end encrypted.

## Features

- [SSH terminal](https://hostdock.dev/features/ssh-terminal/): Tabs, jump hosts, proxies, 2FA
- [SFTP file manager](https://hostdock.dev/features/sftp-file-manager/): Browse, transfer, edit files in place
- [Server monitoring](https://hostdock.dev/features/server-monitoring/): Agentless CPU, memory, disk and network
- [Docker management](https://hostdock.dev/features/docker-management/): Containers, live logs, shells
- [Port forwarding](https://hostdock.dev/features/port-forwarding/): Local, remote and SOCKS5/HTTP tunnels
- [AI assistant](https://hostdock.dev/features/ai-assistant/): Your model, your rules on what it may run
- [MCP server](https://hostdock.dev/features/mcp-server/): Let Claude Code and Codex reach your servers
- [Sync & cloud space](https://hostdock.dev/features/sync/): Encrypted vault, notes, scripts and files

## Details

- [Security](https://hostdock.dev/security/): what is encrypted, what the server can see, known weaknesses
- [FAQ](https://hostdock.dev/faq/): pricing, platforms, requirements, AI, MCP, sync
- [Download](https://hostdock.dev/download/): system requirements and download
- [Privacy](https://hostdock.dev/privacy/): data collected by the sync service
- [Chinese (简体中文) version](https://hostdock.dev/zh/): every page is also available under /zh/

## Comparisons

- [SSH clients for Mac compared](https://hostdock.dev/compare/): HostDock, Termius, Tabby, Royal TSX, WindTerm, MobaXterm, Warp
- [HostDock vs Termius](https://hostdock.dev/compare/termius/)
- [HostDock vs Tabby](https://hostdock.dev/compare/tabby/)
- [HostDock vs Royal TSX](https://hostdock.dev/compare/royal-tsx/)