# Tempest Knowledge Base
Tempest is a cross-platform SSH client with SFTP, FIDO2, OpenSSH certs, post-quantum KEX, AI, and presets for Teleport, Cloudflare Access, AWS SSM.
**Tempest** is a modern SSH client for **macOS, Windows, Linux, and the web** — with native support for SFTP, jump hosts, port forwarding, OpenSSH certificates, FIDO2 / YubiKey, post-quantum algorithms, and a built-in AI assistant. Beyond SSH, Tempest also handles Kubernetes, Telnet, Serial, RCON, S3, WebDAV, and FTP — all with the same tabbed terminal experience.
[**Download Tempest →**](https://gotempest.app)
This knowledge base covers:
* Step-by-step guides for the features most users ask about
* Compatibility notes for zero-trust SSH platforms (Teleport, Cloudflare Access, AWS SSM, GCP IAP, Tailscale)
* Authentication recipes (FIDO2 / YubiKey, OpenSSH certificates, post-quantum hybrid KEX)
* Privacy and end-to-end encryption details
* Release notes for Tempest Desktop and Tempest Mobile
## Popular guides
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](https://github.com/tempest-term/docs/tree/main/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale.md)
* [SSH Jump Host & Bastion Chaining](https://github.com/tempest-term/docs/tree/main/connect-to-servers/ssh-jump-host-bastion-chaining.md)
* [SSH Port Forwarding — Local, Remote, and Dynamic SOCKS5](https://github.com/tempest-term/docs/tree/main/connect-to-servers/ssh-port-forwarding.md)
* [SFTP File Manager — drag-and-drop SSH file transfer](https://github.com/tempest-term/docs/tree/main/files-and-storage/sftp-file-manager.md)
* [YubiKey & FIDO2 SSH Authentication](https://github.com/tempest-term/docs/tree/main/authentication/yubikey-fido2-ssh-authentication.md)
* [Post-Quantum SSH Algorithms (PQC) — ML-KEM hybrid KEX](https://github.com/tempest-term/docs/tree/main/authentication/post-quantum-ssh-algorithms.md)
* [Tempest AI Assistant — chat with your terminal](https://github.com/tempest-term/docs/tree/main/productivity/tempest-ai-assistant.md)
## Cross-platform support
Tempest is available on:
* **macOS** — native Apple Silicon (M1/M2/M3/M4)
* **Windows** — x64 and ARM64
* **Linux** — x64 and ARM64 (.deb, .rpm, AppImage, Snap)
* **Web** — connect from any browser to a self-hosted Tempest server
* **iOS & Android** — companion mobile apps
## Get help
* Community:
* Email support: visit
# SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale
Tempest works with Teleport, Cloudflare Access, AWS SSM, GCP IAP, and Tailscale via OpenSSH cert auth and ProxyCommand wizards.
**Tempest** is a polished SSH client for **macOS, Windows, and Linux** that connects to your servers through every major zero-trust SSH platform: **Teleport**, **Cloudflare Access**, **AWS Systems Manager (SSM) Session Manager**, **GCP IAP TCP forwarding**, **Tailscale SSH**, **HashiCorp Vault SSH**, **HashiCorp Boundary**, and **step-ca**. You bring your enterprise SSH gateway — Tempest gives you the GUI, tabs, SFTP, port forwards, AI agent shortcuts, and a real terminal on top.
If you found this page searching for *"Teleport macOS client"*, *"Cloudflare Access SSH GUI"*, *"AWS SSM SSH client"*, *"GCP IAP SSH client"*, or *"Tailscale SSH client for Mac"* — yes, Tempest works with all of them, and below is exactly how to set each one up.
### Why use a third-party SSH client for zero-trust platforms?
Every zero-trust SSH platform ships its own CLI: `tsh ssh`, `cloudflared access ssh`, `aws ssm start-session`, `gcloud compute ssh`, `tailscale ssh`. They all *work* — but they're terminal-only, with no tabs, no SFTP browser, no port-forward UI, no per-host themes, no session history, no jump-host chaining UX, no built-in AI agent shortcuts. Tempest is a real desktop SSH client that integrates with each platform's auth flow (short-lived OpenSSH certificates, ProxyCommand tunneling, MFA prompts) without re-implementing your security policy.
### Quick start: Connect Via Presets
1. Open **Tempest** → click `+` to add a new connection
2. Click **Connect Via Presets** (top of the SSH form)
3. Pick your platform — Teleport, Cloudflare Access, AWS SSM, GCP IAP, or Tailscale
4. Fill in the wizard fields (proxy hostname, instance ID, cluster, etc.) — defaults pre-fill from the doc when applicable
5. Click **Apply** — Tempest scaffolds auth method, private key path, certificate path, and proxy command for you
6. Save and connect
Each preset is a one-shot scaffold: after Apply you can edit any field freely.
### Teleport SSH client for macOS, Windows, Linux
Tempest is a fully compatible **Teleport SSH client** that consumes the short-lived certificates issued by `tsh login`. No need to re-implement Teleport's SSO/WebAuthn flow — Tempest plugs in *after* you've authenticated with `tsh`.
**Setup:**
```bash
# One-time per work day (or however your cluster's cert TTL is configured)
tsh login --proxy=proxy.example.com
```
In Tempest:
1. **Connect Via Presets → Teleport**
2. Wizard asks for: **Teleport proxy hostname**, **Teleport user**, **Cluster name**
3. The preset fills:
* Auth: Private Key (path mode)
* Private key: `~/.tsh/keys//`
* Certificate: `~/.tsh/keys//-ssh/-cert.pub`
* Proxy Command: `tsh proxy ssh -L %p:%h:0 @`
4. Set **Host** to the in-cluster server hostname
**Per-session MFA (YubiKey, hardware key)**: Tempest forwards `tsh proxy ssh`'s stderr into the SSH terminal, so when Teleport prompts you to tap your security key, the prompt appears in your Tempest tab — no missed taps, no silent timeouts.
**Cert rotation**: Tempest reads the cert from disk on every connect, so the next `tsh login` automatically refreshes credentials.
### Cloudflare Access SSH client
Tempest works as a **Cloudflare Access SSH client** by tunneling through the official `cloudflared` daemon — your existing SSH key + Cloudflare Access policy handle authentication.
**Setup:**
```bash
# One-time per Access application
cloudflared access login ssh.example.com
```
In Tempest:
1. **Connect Via Presets → Cloudflare Access**
2. Wizard asks for: **Cloudflare Access hostname** (the public hostname configured in your Access policy)
3. The preset fills:
* Host: the hostname you entered
* Proxy Command: `cloudflared access ssh --hostname=%h`
4. Configure your usual SSH auth (key, agent, password)
### AWS Systems Manager (SSM) SSH client
Tempest is an **AWS SSM SSH client** — connect to private EC2 instances over SSM Session Manager with no public IP, no bastion, IAM-gated. Requires the AWS CLI + Session Manager Plugin installed locally and the SSM Agent running on the target instance.
**Setup:**
In Tempest:
1. **Connect Via Presets → AWS Systems Manager**
2. Wizard asks for: **EC2 instance ID** (e.g. `i-0123456789abcdef0`)
3. The preset fills:
* Host: the instance ID (SSH host-key matching keys off it)
* Proxy Command: `aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters portNumber=%p`
4. Configure SSH auth as you normally would for the target instance (e.g., a private key uploaded via `EC2InstanceConnect` or a long-lived key on the AMI)
### GCP IAP TCP forwarding SSH client
Tempest is a **GCP IAP SSH client** — connect to private Compute Engine instances through Identity-Aware Proxy with no external IP. Requires `gcloud` CLI installed locally and the user holding the *IAP-secured Tunnel User* role.
**Setup:**
In Tempest:
1. **Connect Via Presets → GCP IAP TCP forwarding**
2. Wizard asks for: **GCE instance name**, **Zone**, **Project ID**
3. The preset fills:
* Host: the instance name
* Proxy Command: `gcloud compute start-iap-tunnel %h %p --listen-on-stdin --zone= --project=`
4. Configure SSH auth (works seamlessly with **GCP OS Login** if your project has it enabled)
### Tailscale SSH client for Mac, Windows, Linux
Tempest is a **Tailscale SSH client** — when `tailscaled` is running locally, Tempest connects directly to your tailnet hostnames (`*.ts.net`) or `100.x.y.z` IPs with no extra proxy needed.
**Setup:**
In Tempest:
1. **Connect Via Presets → Tailscale**
2. Wizard asks for: **Tailnet hostname** (e.g. `my-server.tailnet-xxxx.ts.net`)
3. The preset fills the Host; no proxy command needed (tailscaled handles routing transparently)
4. Configure SSH auth (your normal SSH key, or — if you've enabled **Tailscale SSH** on the target — Tailscale's own short-lived certificates work via Tempest's OpenSSH cert support)
### Other compatible zero-trust SSH platforms
| Platform | How Tempest connects |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **HashiCorp Vault SSH** (signed certs) | Same as Teleport — Private Key + Certificate fields point at the cert Vault issued |
| **HashiCorp Boundary** | Proxy Command: `boundary connect ssh -target-id=` |
| **step-ca** (Smallstep) | OpenSSH cert format works identically — point at the cert from `step ssh login` |
| **OpenSSH bastion / ProxyJump** | Built-in **Jump Host** feature, with recursive chaining |
| **Custom CA / SSO platform** | If it issues OpenSSH-format certs, Tempest's Certificate field accepts them; if it requires a tunnel, Proxy Command handles it |
### How Tempest's SSH cert support works
Tempest stores either the **inline contents** of your private key + certificate (default) or **filesystem paths** to them (path mode). Path mode is the right choice for short-lived credentials like Teleport's 12h-default certs — Tempest reads the latest cert from disk on every connect, so `tsh login` rotation is invisible.
Under the hood, Tempest attaches the certificate to your private key before authentication, so the SSH server sees a standard CA-signed cert auth — exactly what `tsh ssh`, `cloudflared`, etc. produce.
### FAQ
**Is Tempest free?** Yes. The core SSH client is free; advanced features (jump host chaining, startup commands, custom proxies, monitoring, session multiplexing) require Tempest Pro.
**Does Tempest work on macOS Apple Silicon?** Yes — native Apple Silicon (M1/M2/M3/M4) builds, plus Windows and Linux. Intel Macs are no longer supported.
**Does Tempest work with Teleport's per-session MFA / YubiKey?** Yes. The MFA prompt that `tsh proxy ssh` writes to stderr is forwarded into the Tempest SSH terminal so you see "Tap your security key" in the tab.
**Does Tempest store my SSH certificate?** In *path mode*, only the file path is stored — the cert is re-read from disk on every connect. In *inline mode* the cert content is stored in Tempest's local DB (use this only for long-lived certs).
**Does Tempest run on iOS or Android?** The desktop client is the primary product. A mobile companion is on the roadmap.
**Can I import my existing OpenSSH config / known\_hosts?** Tempest has an **Import Servers** button that reads your `~/.ssh/config` and creates a host per `Host` block.
**How does Tempest compare to Termius / Royal TSX / SecureCRT?** The pitch is: those clients give you tabs and themes; Tempest gives you tabs and themes *and* native compatibility with the zero-trust SSH platform your company uses, with a one-click wizard for each.
***
*Got a zero-trust SSH platform that should work with Tempest but doesn't? Open an issue on the project tracker — most platforms are reachable via the Certificate field + a Proxy Command, and we're happy to add an official preset.*
# SSH Jump Host & Bastion Chaining
Connect to private servers behind one or many SSH bastions with Tempest's recursive jump-host chaining — like OpenSSH ProxyJump, with a GUI.
Tempest's **Jump Host** feature is a GUI equivalent of OpenSSH's `ProxyJump` — connect to a private server through one or many SSH bastions, with each hop authenticated independently and tunneled over a `direct-tcpip` channel (no cleartext exposure on the bastion).
Use it whenever your target server isn't directly reachable: production hosts behind a corporate bastion, lab machines behind a VPN gateway, IoT devices behind a remote development box.
## Single jump host
1. Add the **bastion** as a normal SSH connection in Tempest. Save it.
2. Add the **target** server.
3. In the target's edit form, set **Jump Host** to your bastion.
4. Save and connect.
Tempest authenticates to the bastion first, opens an SSH `direct-tcpip` tunnel from the bastion to your target, and runs the SSH handshake with your target through that tunnel — exactly like `ssh -J bastion target`.
## Recursive chains (jump → jump → target)
Set the bastion's **own** Jump Host to a higher-level bastion. Tempest walks the chain:
```
Tempest → bastion-1 → bastion-2 → target
```
Each hop:
* Has its own credentials (password, key, cert, agent — independently configured).
* Verifies its own host key fingerprint with you the first time.
* Reports per-hop status messages in the SSH terminal as the connection builds.
There's no built-in chain length limit. Common patterns: 2 hops (corporate edge → app cluster), 3 hops (corporate edge → cluster bastion → namespace pod).
## How it differs from OpenSSH `ProxyJump`
| Feature | OpenSSH `-J` / `ProxyJump` | Tempest Jump Host |
| ------------------------------- | -------------------------- | -------------------------------- |
| Tunneling | `direct-tcpip` channel | Same |
| Per-hop auth method | Reads your `~/.ssh/config` | First-class form fields per host |
| Per-hop credentials in keychain | Manual | Tempest Keychain |
| Recursive chains | Yes (with config) | Yes (UI-driven) |
| GUI host-key verification | No | Yes — fingerprint dialog per hop |
## OpenSSH `ProxyJump` quick reference (`-J` and `~/.ssh/config`)
If you're on the command line instead, the equivalent OpenSSH setup is:
```bash
# One-off: jump through a bastion with -J
ssh -J bastion.example.com deploy@10.0.0.12
# Multiple hops: comma-separate the chain
ssh -J edge.example.com,bastion.internal deploy@10.0.0.12
```
Or persist it in `~/.ssh/config` so `ssh prod-db` just works:
```
Host prod-db
HostName 10.0.0.12
User deploy
ProxyJump bastion.example.com
```
`ProxyJump` (OpenSSH 7.3+) supersedes the older `ProxyCommand ssh -W %h:%p bastion` idiom. Tempest's Jump Host field is the GUI version of exactly this — same `direct-tcpip` tunneling, without hand-maintaining the config file on every machine.
## Pro feature
Jump host chaining is part of **Tempest Pro**.
## Combine with proxy commands
A jump host's *own* connection can also use a Proxy Command (e.g., `cloudflared access ssh`, `aws ssm start-session`). This lets you compose, for example:
```
Tempest → cloudflared tunnel → corporate-bastion → prod-target
```
The first hop reaches the bastion through Cloudflare Access; the second hop tunnels to the target via standard SSH `direct-tcpip`.
See [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale) for proxy-command setup.
## Troubleshooting
* **"Connection refused" to the target**: the bastion might not have a route to the target. SSH into the bastion first and verify with `nc -zv target 22`.
* **Host-key fingerprint dialog appears every connect**: make sure you accept the fingerprint, not just dismiss the dialog. Tempest stores it in the host's `fingerprint_v2` field.
* **First hop authenticates, second hop hangs**: check if the bastion sshd allows `direct-tcpip` (`AllowTcpForwarding yes`).
## See also
* [SSH Port Forwarding](/connect-to-servers/ssh-port-forwarding) — local / remote / dynamic forwards through your jump chain
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale)
# SSH Port Forwarding — Local, Remote & Dynamic SOCKS5
How to set up SSH port forwarding in Tempest — local (-L), remote (-R), and dynamic SOCKS5 (-D) forwards via a GUI with live status for each tunnel.
Tempest replaces the `ssh -L`, `ssh -R`, and `ssh -D` flags with a GUI for **port forwarding** — local forwards (access a remote service from your laptop), remote forwards (expose a local service to the remote network), and dynamic SOCKS5 forwards (turn the SSH session into a network proxy). Each forward is a row in the host's edit form; toggle it on/off and watch live connection state.
## Local forward (-L) — access a remote service locally
Use case: there's a Postgres on `db.internal:5432` that you can't reach directly, but you can SSH into a bastion that can.
1. Edit your SSH host → **Port Forwarding** → Add → **Local**
2. **Port**: the local port to listen on (e.g. `15432`)
3. **Remote host**: `db.internal`
4. **Remote port**: `5432`
5. Save and reconnect.
`localhost:15432` on your machine now talks to `db.internal:5432` through the SSH tunnel — point your `psql` or DBeaver at it.
## Remote forward (-R) — expose a local service remotely
Use case: you're running a webhook receiver on `localhost:3000` and need a remote partner server to call it.
1. Edit your SSH host → **Port Forwarding** → Add → **Remote**
2. **Port**: the port the server should listen on (e.g. `8000`)
3. **Local host**: `localhost`
4. **Local port**: `3000`
5. Save and reconnect.
The SSH server starts listening on `8000`; connections tunnel back to your laptop's `localhost:3000`. *Requires the sshd to allow `GatewayPorts`* if you want the listen address to be public on the server.
## Dynamic SOCKS5 forward (-D) — SSH-as-a-VPN
Use case: you want every connection from your browser or another tool to route through the remote network.
1. Edit your SSH host → **Port Forwarding** → Add → **Dynamic**
2. **Port**: the local SOCKS5 port (e.g. `1080`)
3. Save and reconnect.
Configure your browser / tool to use `socks5://127.0.0.1:1080` and *all* connections originate from the remote SSH host's network.
## Manage active forwards
Open **Port Forwarding** from the host's connection menu to see every forward grouped by host, with live counters showing how many connections are currently open through each tunnel. Disable any without disconnecting the SSH session.
## Combine with jump hosts
Port forwards work transparently through [jump host chains](/connect-to-servers/ssh-jump-host-bastion-chaining). The forward is anchored to the *target* SSH session (the last hop), but the bytes flow back to your laptop through every hop.
## How does this compare to the OpenSSH command line?
| OpenSSH | Tempest equivalent |
| --------------------------------------- | -------------------------------------------------------------------- |
| `ssh -L 15432:db.internal:5432 bastion` | Local forward, port=15432, remote-host=db.internal, remote-port=5432 |
| `ssh -R 8000:localhost:3000 server` | Remote forward, port=8000, local-host=localhost, local-port=3000 |
| `ssh -D 1080 bastion` | Dynamic forward, port=1080 |
## Pro feature
Configurable port forwards are part of **Tempest Pro**.
## See also
* [SSH Jump Host & Bastion Chaining](/connect-to-servers/ssh-jump-host-bastion-chaining)
* [Telnet client](/connect-to-servers/connect-to-telnet-servers) — wrap insecure protocols in an SSH tunnel
# SSH Connection Multiplexing
Tempest's SSH connection multiplexing reuses one authenticated connection across many sessions to the same host — instant new tabs, one MFA per host.
Tempest's **connection multiplexing** reuses one authenticated SSH connection across multiple sessions to the same host. New tabs to the same server open *instantly* — no second TCP handshake, no second SSH key exchange, no second MFA prompt — because Tempest opens additional channels on the existing connection.
This is the same idea as OpenSSH's `ControlMaster auto` / `ControlPath`, but built in and enabled with one toggle.
## Enable it
1. Edit your SSH host → **Transport** section.
2. Toggle **Connection multiplexing** on.
3. Save and reconnect.
The first connection authenticates normally. Every subsequent tab to the same host opens a new SSH `session` channel on the same authenticated connection — usually < 50 ms versus seconds for a fresh handshake.
## Why this is a big deal
* **Instant new tabs** to a frequently-used server.
* **One MFA prompt per host**, not per session — especially valuable for YubiKey / FIDO2 hosts where you'd otherwise tap-tap-tap per tab.
* **Faster SFTP**: opening the SFTP browser doesn't kick off a fresh handshake.
* **Lower load on the server**: one TCP socket and one auth event per active host, regardless of how many tabs you have open.
## When NOT to enable it
* If your server has aggressive `MaxSessions` limits and you frequently fan out many sessions per connection.
* When using [Mosh](/connect-to-servers/mosh-mobile-shell) — Mosh closes the SSH channel after bootstrap, so multiplexing has nothing to share.
* For one-off connections where you'll never open a second tab anyway (no benefit, slight memory cost).
## Pro feature
Connection multiplexing requires **Tempest Pro**.
## Compared to OpenSSH `ControlMaster`
| Feature | OpenSSH `ControlMaster` | Tempest |
| ----------------------------------------- | ------------------------------------------------------------------------ | ------------------------------------ |
| Setup | Add `ControlMaster auto` + `ControlPath ~/.ssh/cm/%C` to `~/.ssh/config` | Toggle in host edit form |
| Persistence across runs | Yes (until socket times out) | Per-Tempest-process |
| GUI to see active multiplexed connections | None | Connection panel shows session count |
## Combine with jump hosts
Multiplexing works through [jump host chains](/connect-to-servers/ssh-jump-host-bastion-chaining) — the chain is built once for the first session, and subsequent sessions reuse the entire chain. Particularly useful for "I have to bounce through 3 bastions to reach prod" workflows.
## See also
* [SSH Jump Host & Bastion Chaining](/connect-to-servers/ssh-jump-host-bastion-chaining)
* [YubiKey & FIDO2 SSH Authentication](/authentication/yubikey-fido2-ssh-authentication) — multiplexing means one tap per host instead of per session
# SSH Agent & X11 Forwarding
Use SSH agent forwarding (1Password, ssh-agent, Pageant) and X11 forwarding in Tempest — keep keys local and run remote GUI apps on Mac/Win/Linux.
Two classic SSH features that Tempest exposes as one-click toggles in the host edit form: **agent forwarding** (use your local SSH keys on the remote host without copying them) and **X11 forwarding** (run remote GUI applications on your local desktop).
## SSH agent forwarding
When you enable agent forwarding, processes on the remote host can use *your local* SSH keys for outbound SSH — without ever transferring the private keys. The remote `ssh` invocation talks to your local agent through a forwarded Unix socket.
The classic use case: you SSH into a bastion, then `git pull` from a private repo that requires your SSH key. Without agent forwarding you'd have to copy your key onto the bastion (insecure). With it, the `git` invocation transparently uses your laptop's key.
### Enable in Tempest
1. Edit your SSH host → **Agent Forwarding** → on.
2. Optional: **Agent Path** — point at a specific socket. Useful for:
* **1Password SSH agent** — `~/.1password/agent.sock` (macOS) or `\\.\pipe\openssh-ssh-agent` (Windows)
* Self-managed `ssh-agent` — wherever `$SSH_AUTH_SOCK` points
3. Save and reconnect.
Once connected, on the remote: `ssh-add -L` should list your local keys, and `ssh other-host` should work.
### 1Password SSH agent integration
Tempest works seamlessly with **1Password's SSH agent** — point Tempest at the 1Password agent socket and your SSH keys are touch-id-protected, never on disk, and synced via your 1Password vault. Each SSH auth attempt prompts 1Password to confirm.
### Pro feature
Agent forwarding is part of **Tempest Pro**.
### Security notes
* Agent forwarding lets *any process on the remote* request a signature from your local agent while you're connected. Don't enable it on hosts you don't fully trust.
* Use the [agent injection](/connect-to-servers/ssh-agent-x11-forwarding) feature (`ssh-add -L` to verify) to confirm before relying on the forwarded agent.
## X11 forwarding
Run a graphical Linux app remotely and have its window appear on your local desktop. Old-school but still the best way to run a one-off `wireshark`, `gimp`, or `firefox` from a remote box without setting up VNC / RDP.
### Enable in Tempest
1. Edit your SSH host → **X11 Forwarding** → on.
2. Optional: set **X11 Socket** if you have a non-default DISPLAY.
3. Save and reconnect.
### Local X server requirements
Tempest just opens the SSH X11 channel — you need an X server running on your machine to actually display the windows.
| Platform | X server |
| ----------- | ------------------------------------------------------------------------------ |
| **macOS** | [XQuartz](https://www.xquartz.org/) (`brew install --cask xquartz`) |
| **Windows** | [VcXsrv](https://sourceforge.net/projects/vcxsrv/), Xming, or WSL2 with `WSLg` |
| **Linux** | Already installed (X.Org or Xwayland) |
### Test it
After connecting:
```bash
echo $DISPLAY # should be set, e.g. localhost:10.0
xclock # a clock window appears on your machine
```
### Pro feature
X11 forwarding is part of **Tempest Pro**.
### Performance
X11 over SSH is bandwidth-heavy and latency-sensitive — fine on a LAN, painful over a slow VPN. For frequent remote desktop work, consider VNC, RDP, or [Mosh + tmux + a CLI workflow](/connect-to-servers/mosh-mobile-shell) instead.
## See also
* [YubiKey & FIDO2 SSH Authentication](/authentication/yubikey-fido2-ssh-authentication) — pair forwarded agent keys with hardware-backed auth on the remote
* [SSH Connection Multiplexing](/connect-to-servers/ssh-connection-multiplexing) — agent forwarding cost is amortized across multiplexed sessions
# Launch Tempest from URLs and External Tools
Launch Tempest from external tools, browsers, scripts, and bastion clients using Tempest deep links or SSH URLs on macOS, Windows, and Linux.
Tempest can be opened by other applications through OS-level links and command-line URLs. This is useful for internal portals, bastion clients, password managers, scripts, and compatibility shims that want to open a new SSH tab in Tempest.
## Registered Tempest URL scheme
Tempest registers the `tempest://` URL scheme with the operating system.
Today, the stable public `tempest://` route is used for collaboration links:
```
tempest://collaborate/#
```
Opening that URL brings Tempest to the foreground and joins the collaboration room.
## Launch an SSH tab
Desktop builds also support launching an ephemeral SSH connection by passing an SSH URL to Tempest:
```
ssh://user:password@host:22
```
Examples:
```bash
Tempest.exe --url ssh://alice:secret@127.0.0.1:2222
open -a Tempest --args --url 'ssh://alice:secret@127.0.0.1:2222'
tempest-desktop --url 'ssh://alice:secret@127.0.0.1:2222'
```
Tempest parses:
| Field | Source |
| -------- | ---------------------- |
| Host | URL hostname |
| Port | URL port, default `22` |
| Username | URL username |
| Password | URL password |
The connection is created as an ephemeral SSH tab. It is not saved to your encrypted vault unless you explicitly save it later.
## Compatibility with bastion clients
Some bastion systems launch a known SSH client such as Xshell, PuTTY, SecureCRT, or MobaXterm instead of a generic URL handler. In that case, use a small compatibility shim that accepts the third-party client's command-line format and forwards a normalized SSH URL to Tempest.
For example, an Xshell-style launch:
```
Xshell.exe -url ssh://user:password@127.0.0.1:2222 -newtab server-name
```
Can be converted by the shim into:
```
Tempest.exe --url ssh://user:password@127.0.0.1:2222
```
Common formats to normalize:
| Client | Typical SSH launch format |
| --------- | -------------------------------------------------------------- |
| Xshell | `-url ssh://user:password@host:port -newtab title` |
| PuTTY | `-ssh -l user -pw password -P port host` |
| SecureCRT | `/SSH2 /AUTH password /L user /PASSWORD password /P port host` |
Tempest itself should receive the normalized SSH URL through `--url`.
## Security notes
Putting passwords in URLs or command-line arguments can expose them to shell history, process listings, crash logs, and other local tooling. Prefer short-lived bastion credentials or one-time passwords when integrating through URLs.
For long-lived credentials, save the host in Tempest and store secrets in the encrypted vault or operating-system credential store instead.
## See also
* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials)
* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption)
* [SSH Jump Host & Bastion Chaining](/connect-to-servers/ssh-jump-host-bastion-chaining)
# Mosh (Mobile Shell) — Survive Flaky Connections
Tempest has built-in Mosh (Mobile Shell) — survive flaky Wi-Fi, laptop sleep, and IP changes with the same UI as a normal SSH tab.
Tempest's **Mosh** support gives you SSH that survives sleep, network changes, and lossy Wi-Fi. Bootstrap over your normal SSH connection, then Tempest switches the session to UDP and keeps the terminal alive even when your laptop goes through three different networks on the train ride home.
If you've ever lost a `vim` buffer to a 30-second VPN drop, this is the doc you wanted.
## How Mosh works
Standard SSH runs over TCP — when the underlying connection breaks, the session dies. Mosh:
1. Uses your existing SSH credentials to bootstrap (so you don't need a new auth method).
2. Spawns `mosh-server` on the remote.
3. Switches the terminal to a UDP-based protocol with a moving session key.
4. Reconnects automatically when your IP changes or when the network drops out and comes back.
The visible result: type a command, close your laptop lid, walk home, open it on a different Wi-Fi — your prompt is still there, your `vim` is still open, your `tail -f` resumes from where it left off.
## Enable Mosh on a connection
1. Edit your SSH host.
2. Toggle **Mosh** on in the Transport section.
3. Optional: customize the `mosh-server` command (default: `mosh-server new -s -c 256 -l LANG=en_US.UTF-8`).
4. Save and reconnect.
## Server-side requirements
* `mosh` (or at least `mosh-server`) installed on the remote: `apt install mosh`, `brew install mosh`, etc.
* UDP ports 60000–61000 open on the firewall (Mosh picks one in this range).
## What doesn't work with Mosh
Mosh closes the SSH channel after bootstrap, so anything that needs the underlying SSH connection is unavailable while Mosh is active:
* SFTP file transfer (use a separate non-Mosh tab)
* Port forwarding
* Tempest Monitoring (no SSH channel to run sample commands)
* Connection multiplexing
* Tempest agent injection
* X11 forwarding
These constraints come from how Mosh works, not from Tempest specifically.
## Windows note
Mosh is **not supported on Windows** in Tempest. If you enable Mosh on a Windows install, Tempest will fall back to plain SSH and warn you. The Mosh protocol depends on `mosh-server` and the upstream Mosh project doesn't ship a Windows client.
## See also
* [SSH Port Forwarding](/connect-to-servers/ssh-port-forwarding) — runs over SSH, not Mosh
* [SFTP File Manager](/files-and-storage/sftp-file-manager) — also SSH-only
# Telnet Client for macOS, Windows & Linux
Use Tempest as a Telnet client on macOS, Windows, and Linux — connect to routers, switches, network devices, and legacy systems with one tabbed UI.
Tempest works as a **Telnet client** for routers, switches, embedded devices, and legacy systems — same tabbed UI, same color schemes, same SSH-style connection list. As of Tempest 3.6+, the Telnet protocol is **fully native** (Rust implementation, no external `telnet` binary required) on **macOS, Windows, and Linux**.
If you're managing Cisco gear, MikroTik routers, factory PLCs, or anything else that still speaks Telnet, Tempest gives you a modern terminal experience without losing the ability to talk plain Telnet.
## Add a Telnet connection
1. Click `+` to add a new connection.
2. Choose **Telnet** as the protocol.
3. Set host and port (default: `23`).
4. Optional: configure proxy (HTTP CONNECT, SOCKS5, or ProxyCommand) for Telnet over a tunnel.
5. Click Connect.
The session opens in a tab. Encoding, color, and copy/paste behave identically to SSH tabs.
## Why native Telnet?
Older versions of Tempest shelled out to the system's `telnet` binary, which is no longer installed by default on macOS Sonoma+ or modern Windows. The native Rust implementation works out of the box on every platform — no `brew install telnet`, no Windows feature toggle.
## How to use Telnet on macOS (the `telnet` command was removed)
Apple removed the built-in `telnet` command in macOS 10.13 High Sierra and it never came back — on a modern Mac, typing `telnet` in Terminal prints `command not found`.
The fastest fix is Tempest: Telnet support is built in (native Rust implementation — nothing to install), so you just [download Tempest for macOS](https://gotempest.app/download/mac?utm_source=docs\&utm_campaign=telnet), add a Telnet connection with your host and port, and connect. Instead of a bare prompt you get tabs, saved connections, color schemes, and proxy support — with the same connection list synced to Windows, Linux, and your phone.
If you specifically want the classic command-line client back:
* `brew install telnet` restores it via Homebrew (or `brew install inetutils` for the full GNU network tools).
* `nc -vz 23` ships with macOS and works for checking whether a Telnet port is open — but netcat doesn't negotiate Telnet options, so interactive sessions with network gear can misbehave.
Windows is similar: the optional "Telnet Client" feature is off by default on Windows 10/11, which is why a client that speaks Telnet natively saves a trip through Windows Features.
## Security note
Telnet sends passwords and session data in cleartext. Use SSH whenever possible. Telnet is appropriate for:
* Legacy device management on isolated networks
* Initial bootstrap of devices that only support Telnet
* Reaching equipment behind a tunnel that you trust
For production access, [combine with a proxy or jump host](/connect-to-servers/ssh-jump-host-bastion-chaining) so the cleartext segment stays inside a trusted boundary.
## See also
* [SSH Port Forwarding](/connect-to-servers/ssh-port-forwarding) — wrap Telnet inside an encrypted SSH tunnel
* [Connect to Game Servers via RCON](/connect-to-servers/ssh-jump-host-bastion-chaining) — the same Rust implementation also powers Tempest's RCON support
# Serial Port Terminal
Tempest is a serial port terminal for Arduino, Raspberry Pi UART, Cisco console cables, and ESP32, with auto-port-detection on Mac/Win/Linux.
Tempest is a built-in **serial port terminal** for any USB-to-UART device — Arduino, Raspberry Pi GPIO console, Cisco / MikroTik console cables, ESP32 / ESP8266 boards, FTDI adapters, you name it. Same tab-based UI as your SSH connections, with auto-port-detection so you don't have to remember whether your cable is `/dev/tty.usbserial-A50285BI` today.
## Add a serial connection
1. Click `+` → **Serial**.
2. Tempest auto-discovers connected serial ports. Pick yours from the dropdown — or paste a path manually.
3. Set the baud rate (default 9600; 115200 is common for modern boards; 1200 for very old equipment).
4. Save and connect.
Common port paths:
| Platform | Typical path |
| -------- | ---------------------------------------------------- |
| macOS | `/dev/tty.usbserial-XXXX` or `/dev/tty.usbmodemXXXX` |
| Linux | `/dev/ttyUSB0`, `/dev/ttyACM0` |
| Windows | `COM3`, `COM4`, etc. |
## Common baud rates
| Use case | Baud |
| ------------------------- | ---------------- |
| Arduino default | 9600 |
| Arduino fast / ESP32 | 115200 |
| Raspberry Pi UART console | 115200 |
| Cisco console | 9600 |
| Legacy industrial gear | 1200, 2400, 4800 |
## Pro feature
Serial connections require **Tempest Pro**.
## Permissions
* **macOS**: works out of the box — macOS allows user access to FTDI / CDC-ACM devices.
* **Linux**: your user must be in the `dialout` group to access `/dev/ttyUSB*` without sudo:
```bash
sudo usermod -a -G dialout $USER
# log out and back in
```
* **Windows**: USB-serial drivers must be installed (FTDI, CH340, CP210x, etc. — plug it in once and Windows usually auto-installs).
## When to use this vs. minicom / screen / PuTTY
* **Tempest** when you also use SSH and want one client for both — same tabs, same theme, same key bindings.
* **screen / minicom** when you're already living in a Unix shell and the serial device is the only thing you need.
* **PuTTY** when you need a dead-simple Windows-only single-purpose tool.
## See also
* [Telnet Client](/connect-to-servers/connect-to-telnet-servers) — many serial devices also expose a Telnet management interface
* [SSH Port Forwarding](/connect-to-servers/ssh-port-forwarding) — tunnel a remote serial-over-IP server through SSH
# RCON Client for Game Servers
Tempest is a GUI RCON client for Minecraft, ARK, Rust, CS2, Source-engine, and Factorio — manage game servers from the same SSH client UI.
Tempest is a **GUI RCON client** for game servers. Add a Minecraft, ARK, Rust, Counter-Strike 2, Source-engine, Factorio, or any other RCON-speaking server as a connection, and you get the same tabbed interface as your SSH hosts — only the channel is the Source RCON protocol instead of SSH.
If you've been juggling separate Minecraft Console apps, ARK admin tools, and Source RCON tools per game, Tempest replaces all of them with one client.
## Add an RCON server
1. Click `+` → **RCON**.
2. Set host and port (Minecraft Java default `25575`, Source-engine default `27015`).
3. Set the RCON password (matches `rcon.password` in `server.properties` or your engine's equivalent).
4. Save and connect.
The tab opens with a command prompt. Type any RCON command supported by your server.
## Common commands
**Minecraft Java**:
```
list # list online players
kick PlayerName Goodbye
ban PlayerName
op PlayerName
say Server restart in 5 min
stop # graceful shutdown
```
**Source / CS2**:
```
status
say Welcome
mp_restartgame 1
changelevel de_dust2
```
**Factorio**:
```
/players
/silent-command game.print("hello")
```
## Native Rust implementation
As of Tempest 3.6+, RCON is a **native Rust implementation** (no shell-out, no `mcrcon` binary required). Same client works identically on macOS, Windows, and Linux.
## Proxy support
RCON connections support the same proxy modes as SSH:
* HTTP CONNECT
* SOCKS5
* ProxyCommand
Use this if your game server is behind a corporate firewall or a VPN gateway you reach through `cloudflared access` or a Tailscale-like tunnel.
## Why RCON in an SSH client?
Most homelab / indie hosting setups use the same machine for an SSH-managed Linux box and the Minecraft / ARK server it hosts. Tempest lets you keep them in adjacent tabs — type `tail -f /var/log/whatever` on the SSH side, run `say Server restart in 5 min` on the RCON side.
## See also
* [Connect to Telnet servers](/connect-to-servers/connect-to-telnet-servers) — same Rust networking layer
* [Tempest Push Notifications](/productivity/tempest-push-notifications) — alert when a player joins or a server crashes (via scripted snippets)
# SFTP File Manager
Drag-and-drop SFTP file transfer with bookmarks, in-app editing, chmod / chown, background transfers, and ZMODEM rz/sz support.
It works on any supported SSH server, and it integrates with the rest of Tempest: open a remote file in the in-app editor, run `chmod` from the GUI, bookmark folders you visit often.
## Open the SFTP browser
After connecting via SSH, click the right sidebar button on the top right corner, and then click **SFTP** icon in the right sidebar's toolbar.
**Alternatively**, right click on a host in the host list, and select "SFTP" to open a full screen SFTP session.
## Transfer files
* **Drag-and-drop:** single files, or whole folders
* Transfers run in the background; Use Task Manager pane to track progress
## In-app file editing
Double-click any text file on the remote side to open it in Tempest's built-in editor. Use ctrl+S or command+S to save, and Tempest uploads the changes via SFTP. No "download, edit locally, re-upload" loop.
## Path navigator and bookmarks
* Bookmark folders you visit often — they appear in a sidebar so they're one click away on every connect
* Bookmarks sync across devices via your encrypted vault
## chmod and chown from the GUI
Right-click any file → **Properties** → edit permissions and ownership without dropping into the terminal. Numeric and symbolic notation both supported.
## ZMODEM (rz / sz) support
Tempest's terminal also speaks **ZMODEM** — when a remote command emits a `sz file` (send) sequence, Tempest detects it and prompts you to choose a download location. Works the other direction too with `rz`.
This is the standard way to move files into and out of containers, network appliances, and VMs that have ZMODEM but no SFTP server.
## Performance
The SFTP layer is a native Rust implementation with parallel block transfers, so multi-MB files saturate your link. The same backend handles S3, WebDAV, and FTP transfers in Tempest, with a unified progress UI.
## See also
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale) — SFTP works over zero-trust gateways too
* [SSH Jump Host & Bastion Chaining](/connect-to-servers/ssh-jump-host-bastion-chaining) — SFTP transfers inherit the jump-host chain
# S3, WebDAV & FTP Browser
Tempest is a unified browser for S3 (incl. R2, B2, MinIO, Wasabi, Spaces), WebDAV, and FTP — same drag-and-drop file manager as SFTP.
Tempest is also a **cloud storage browser**. The same drag-and-drop file manager that handles SFTP also handles **S3** (and S3-compatible: Cloudflare R2, Backblaze B2, MinIO, Wasabi, DigitalOcean Spaces, Linode Object Storage), **WebDAV** (Nextcloud, ownCloud, Synology, Apache `mod_dav`), and **FTP / FTPS**. One client, one tabbed UI, one progress panel — instead of installing Cyberduck, Transmit, Filezilla, and an S3 GUI separately.
## S3 / S3-compatible
Add an S3 connection:
1. Click `+` → **S3**.
2. Set:
* **Endpoint** — `s3.amazonaws.com` for AWS, or your provider's URL (`r2.cloudflarestorage.com`, `s3.us-west-002.backblazeb2.com`, `.digitaloceanspaces.com`, etc.)
* **Region**
* **Bucket**
* **Access Key ID** and **Secret Access Key**
* **Path-style URLs** toggle — required for some non-AWS providers (MinIO, older R2 setups)
3. Save and connect.
The bucket appears as a directory tree. Browse, upload (drag-and-drop), download, rename, delete, and `mkdir` (creates a zero-byte object with a `/` suffix — the S3 idiom).
## WebDAV
Works with any WebDAV server: **Nextcloud**, **ownCloud**, **Synology**, **Apache mod\_dav**, **nginx + dav extras**, **Microsoft IIS WebDAV**, etc.
1. Click `+` → **WebDAV**.
2. **Endpoint** — e.g. `https://nextcloud.example.com/remote.php/dav/files/USERNAME/`.
3. **Username** and **Password** (or app password).
4. Save and connect.
## FTP / FTPS
For legacy file servers and some shared-hosting providers:
1. Click `+` → **FTP**.
2. **Endpoint** — `ftp://example.com:21` or `ftps://example.com:990`.
3. Username and password.
4. Save and connect.
## What you can do
All three share the same operations:
* **Drag-and-drop** between local and remote panes
* **Background transfers** with progress and pause/cancel
* **Rename, delete, mkdir** from the UI
* **Path navigator** with auto-complete
* **Bookmarks** for paths you visit often (synced via your encrypted vault)
* **Multi-select** for batch operations
## Performance
The transfer engine is a native Rust implementation with parallel block transfers — large file uploads and downloads saturate your link. The same engine powers Tempest's SFTP file manager (see [SFTP File Manager](/files-and-storage/sftp-file-manager)).
## Why a single client for SSH + S3 + WebDAV + FTP?
A typical day in DevOps / homelab life looks like:
* SFTP into a server to grab a config file
* Drop it into S3 as a backup
* Push the latest export to a Nextcloud share
Three different protocols, three different clients in most workflows. Tempest collapses them into one tabbed window with a unified progress panel and a single set of keyboard shortcuts.
## See also
* [SFTP File Manager](/files-and-storage/sftp-file-manager) — the SSH equivalent
* [SSH Snippets & Scheduled Runs](/productivity/snippets-scheduled-runs) — schedule periodic backups to S3 / WebDAV
# YubiKey & FIDO2 SSH Authentication
Use a YubiKey or any FIDO2 security key to authenticate SSH in Tempest on Mac, Windows, Linux — no agent or PAM module, works with ed25519-sk keys.
Tempest has **built-in FIDO2 support** for SSH — plug in a YubiKey, SoloKey, or any U2F/FIDO2 security key, generate an OpenSSH `ed25519-sk` or `ecdsa-sk` key, and Tempest handles the touch / PIN flow natively. No `ssh-agent`, no `pam_u2f`, no third-party tooling — just hardware-backed SSH on macOS, Windows, and Linux.
## Why hardware keys?
* The private key never leaves the security key — even if your laptop is fully compromised, the key can't be exfiltrated.
* A physical touch is required for every signature, so phishing and malware can't authenticate without you.
* GitHub, GitLab, Gitea, and most OpenSSH 8.2+ servers accept `ed25519-sk` / `ecdsa-sk` natively.
## Generate an sk key
You can generate the key with `ssh-keygen` outside of Tempest:
```bash
# Touch your key when prompted
ssh-keygen -t ed25519-sk -O resident -f ~/.ssh/id_ed25519_sk
```
Or use Tempest's built-in key generation if available in your platform build (Settings → SSH Keys).
The generated `~/.ssh/id_ed25519_sk` is *not* a private key in the traditional sense — it's a credential handle that tells the security key "use the resident credential for this site." The actual key material lives on the YubiKey.
## Use the sk key in Tempest
1. Edit your SSH connection.
2. Auth Method → **Private Key**
3. Key source → **Path**
4. Private key path → `~/.ssh/id_ed25519_sk`
5. Save and connect.
When Tempest needs to authenticate, it triggers the FIDO2 challenge — the YubiKey starts blinking, you tap it, and the SSH session continues. If the key is PIN-protected, Tempest prompts for the PIN.
## Touch and PIN behavior
* **Touch-only keys**: Tempest waits for a touch (the YubiKey LED flashes). Tap within \~30 seconds.
* **PIN + touch keys**: Tempest prompts for the PIN, then asks for touch.
* **Resident credentials**: enumerable via `ssh-add -K`, useful for moving between machines without copying any handle file.
## Multiple security keys
Tempest enumerates connected FIDO2 devices automatically. If multiple keys are plugged in, it'll use the one that holds the matching credential. You can also list devices from your shell with `fido2-token -L`.
## Compatibility
| Platform | Status |
| ------------------------- | ------------------------------------------------------------------------------------------------------ |
| **macOS** (Apple Silicon) | ✅ Works out of the box |
| **Windows** | ✅ Native FIDO2 + Windows Hello fallback — **may require running Tempest as administrator** (see below) |
| **Linux** | ✅ Native FIDO2 (requires udev rule for non-root use) |
| **iOS / Android** | ✅ NFC mode — tap an NFC-capable security key against your phone to authenticate |
## Windows: run as administrator
On Windows, raw HID access to FIDO2 devices is restricted by the OS — non-elevated processes can't talk to the security key directly. If Tempest can't see your YubiKey, **right-click the Tempest shortcut → Run as administrator**.
Alternatively, use the **WebHello** fallback (Windows Hello acting as a FIDO2 authenticator) which works without elevation if your machine has a TPM and Windows Hello set up.
## Linux udev permissions
If your security key isn't detected on Linux, install the YubiKey udev rules:
```bash
sudo cp ~/.ssh/70-u2f.rules /etc/udev/rules.d/
sudo udevadm control --reload
```
Most distributions provide a `libu2f-udev` or equivalent package that does this for you.
## See also
* [Post-Quantum SSH Algorithms](/authentication/post-quantum-ssh-algorithms) — pair hardware keys with PQ-safe key exchange
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale) — many zero-trust platforms can issue FIDO2-backed SSH certs
# Post-Quantum SSH Algorithms (PQC)
Post-quantum SSH explained — the ML-KEM (FIPS 203) and SNTRUP761 hybrid key exchanges OpenSSH 9+ ships, how to check your connection is quantum-safe, and why Tempest enables PQC by default.
Tempest ships with **post-quantum cryptography (PQC)** key-exchange algorithms enabled by default. Connect to OpenSSH 9.0+ servers using **ML-KEM (FIPS 203)** hybrids or **SNTRUP761** for resistance against future quantum-computer attacks — including the "harvest now, decrypt later" threat model where adversaries record today's traffic to break years from now. Among polished cross-platform GUI SSH clients, Tempest is one of the few that documents the specific PQ algorithms it negotiates rather than just claiming "PQ support."
If your server doesn't support PQ algorithms yet, Tempest negotiates down gracefully — there's a one-click switch to a legacy-only algorithm set if a particular server can't handle hybrid KEX.
## What's a post-quantum algorithm?
Classical Diffie-Hellman key exchange (X25519, ECDH-NIST-P\*) is broken in polynomial time by Shor's algorithm running on a sufficiently large quantum computer. Post-quantum algorithms — Kyber (ML-KEM), NTRU (SNTRUP), Dilithium, Falcon — are designed to resist both classical and quantum attacks.
Tempest currently supports the **hybrid** KEX modes that combine a classical curve with a PQ algorithm: if either is broken, the session is still secure. This is the same approach OpenSSH, Cloudflare, AWS, and Apple iMessage have adopted.
## Supported PQ algorithms
* **ML-KEM-768** hybrid with X25519 (`mlkem768x25519-sha256` and friends — names vary by upstream)
* **SNTRUP761** hybrid with X25519 (`sntrup761x25519-sha512`) — OpenSSH's original PQ choice
Tempest negotiates the strongest mutually supported algorithm per session.
## How to use it
PQ algorithms are **enabled by default** in new connections. To verify or change:
1. Edit your SSH host → **Security** → **Enabled Algorithms**
2. The default preset is **Post-Quantum (PQC)**.
3. If a server fails to handshake (older sshd), switch to **Legacy** — Tempest re-runs the handshake with classical-only algorithms.
The current negotiation is shown live in the connection security panel:
```
KEX sntrup761x25519-sha512
HostKey ssh-ed25519
Cipher chacha20-poly1305@openssh.com
HMAC hmac-sha2-256-etm@openssh.com
```
## Who you'll connect to with PQ KEX
* **OpenSSH 9.0+** — `sntrup761x25519-sha512` enabled by default
* **OpenSSH 9.5+** — `mlkem768x25519-sha256` available
* **Cloudflare's SSH proxy** — PQ enabled
* Most modern Linux distributions (Fedora 38+, Ubuntu 23.10+, etc.) ship OpenSSH new enough
## Why now?
NIST finalized ML-KEM (Kyber) as **FIPS 203** in August 2024. Major operating systems and browsers are rapidly adopting it — getting your SSH client onto PQ now means traffic you generate today is safe even if a quantum computer arrives in 5–10 years.
## Pro feature
Custom algorithm selection (manually picking which KEX, host key, cipher, and HMAC to advertise) is part of **Tempest Pro**. The default PQ-enabled preset is free.
## See also
* [YubiKey & FIDO2 SSH Authentication](/authentication/yubikey-fido2-ssh-authentication) — pair hardware-backed *signatures* with PQ-safe *key exchange*
* [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy) — the rest of the cryptography stack
# HashiCorp Vault — Fetch SSH Credentials at Connect Time
Fetch SSH credentials from HashiCorp Vault at connect time — Vault-signed SSH certificates or KV v2 secrets — instead of storing keys and passwords locally in Tempest.
Tempest can pull SSH credentials from **HashiCorp Vault** the moment you connect, instead of storing a static private key or password locally. Add a Vault connection once, then point any SSH host at it — Tempest talks to Vault directly (desktop, CLI, and mobile all share the same client) and nothing beyond the Vault token itself lives on disk.
Vault identities and Tempest's built-in Keychain are two parallel, unrelated credential types — switch between them with the mode selector at the top of the **Keychain** panel (Keychain / HashiCorp Vault). Once created, a Vault identity is selectable from any SSH host's **Auth Method → HashiCorp Vault**.
## Two modes
Tempest supports two ways of getting a credential out of Vault:
### SSH Certificate Signing (recommended)
Tempest keeps a normal SSH keypair locally — the private key never leaves your device. On connect, it sends the **public** key to Vault's [SSH secrets engine](https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates), and Vault signs it into a short-lived OpenSSH certificate. Tempest authenticates with that certificate.
* No long-lived secret to leak — a signed certificate typically expires in minutes to hours, set by the Vault role.
* The private key is generated and stored the same way as any other Tempest SSH key (Ed25519/ECDSA/RSA, optional passphrase) — Vault never sees it.
* Requires the target server to trust your Vault SSH CA (`vault write ssh/config/ca` + the server's `sshd` trusting the CA public key via `TrustedUserCAKeys`).
### KV v2 secret read
Tempest reads a static secret out of a [KV v2](https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2) mount and maps its fields to a username, password, and/or private key + passphrase. Use this if you're not running the SSH secrets engine and just want Tempest to pull an existing password or key out of Vault instead of pasting it into Tempest directly.
## Set up a Vault connection
1. Open **Keychain** in the sidebar, switch the mode selector at the top to **HashiCorp Vault**, and click **New**.
2. Fill in:
* **Vault Address** — e.g. `https://vault.example.com:8200`
* **Token** — a Vault token with read access to the mount/role you'll use
* **Namespace** *(optional)* — Vault Enterprise namespace, sent as `X-Vault-Namespace`
* **CA Certificate** *(optional, PEM)* — only needed for a self-signed or internal-CA Vault deployment
* **Username** *(optional)* — overrides the login username applied to the SSH connection using this identity
3. Pick a **Source**:
* **SSH Certificate Signing** — set the **SSH Secrets Mount** (e.g. `ssh`) and **SSH Role**, then generate or paste the local keypair Vault will sign. The role's `default_extensions` control what the resulting session is allowed to do (PTY, port forwarding, agent forwarding) — if those look "authenticated but broken," check the role config in Vault, not Tempest.
* **KV v2** — set the **KV Mount** and **path**, then map whichever of `username` / `password` / `private_key` / `passphrase` field names your secret uses.
4. Click **Test Connection** to confirm Tempest can reach Vault and read the role/path before saving.
5. On any SSH host, set **Auth Method → HashiCorp Vault** and pick this connection.
## Where the token lives
The Vault token itself is stored alongside your other Tempest credentials, under the same end-to-end encryption as everything else in your vault documents (see [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials)). It's a **static token** — Tempest doesn't currently drive a Vault login flow (AppRole, OIDC, etc.), so provisioning and rotating the token is on you, e.g. via your own Vault policy TTLs or a periodic token renewal outside of Tempest.
## Enterprise feature
Vault credential integration requires **Tempest Enterprise**.
## See also
* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials)
* [YubiKey & FIDO2 SSH Authentication](/authentication/yubikey-fido2-ssh-authentication) — another way to keep private key material off disk entirely
* [Post-Quantum SSH Algorithms (PQC)](/authentication/post-quantum-ssh-algorithms)
# Tempest AI Assistant
Tempest AI Assistant integrates Claude, GPT, Gemini, and self-hosted LLMs into your SSH terminal — explain commands, debug errors, generate one-liners.
The **Tempest AI Assistant** is an in-app chat panel that knows what's happening in your SSH session. Ask it to explain a stack trace, generate a one-liner, debug a failing systemd unit, or draft a migration script — and pipe the answer straight into the terminal. Think of it as Claude / GPT / Gemini sitting next to your shell, with full context.
## What it can see
The AI sees only what you give it — by default that's:
* The current command output you highlight
* Files you explicitly attach (drag-and-drop into the chat)
* Your typed question
It does **not** silently scrape your terminal history, your hosts list, or your keys. You stay in control of what reaches the model.
## What it can do
* **Explain**: paste an error → get a plain-English diagnosis
* **Generate**: "give me a one-liner to find files modified in the last hour" → get the command, optionally one-click "run in terminal"
* **Investigate**: "the disk is full, show me the biggest directories" → get a `du` invocation, run it, AI sees the output and follows up
* **Refactor**: paste a Bash script → get an idiomatic rewrite, side-by-side diff
* **Bridge to coding agents**: combine with the **Use AI Agents** preset on a connection to drop straight into Claude Code, Gemini CLI, Codex CLI, or OpenCode on the remote host
## Choose your model
Tempest doesn't lock you into one provider. Configure any of:
* **Anthropic Claude** (Sonnet, Opus, Haiku) — recommended default
* **OpenAI** GPT-4 / GPT-5 family
* **Google Gemini**
* **Self-hosted** — point at any OpenAI-compatible endpoint (Ollama, vLLM, llama.cpp, your enterprise gateway)
Configure your API key once in **Settings → AI** and the assistant is available in every connection tab.
## Privacy
* Tempest never proxies AI requests through our servers — they go directly from your device to the provider you configured.
* When you use a self-hosted model, prompts stay entirely inside your network.
* See [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy) for the full data-handling story.
## Configurable temperature
Set the model temperature in Settings — lower for deterministic command generation, higher for creative refactoring suggestions.
## Coding agents preset
The connection edit form has a **Use AI Agents** quick-config: pick **Claude Code**, **Gemini CLI**, **Codex CLI**, or **OpenCode**, give a working directory, and Tempest will `cd && ` on connect — perfect for jumping straight into a coding session on a remote dev box.
See the dropdown next to the **Startup Command** field in any SSH host's edit form.
## See also
* [Kubernetes Profiles](/productivity/kubernetes-profiles) — pair the AI with `kubectl` for cluster troubleshooting
* [Tempest Monitoring](/productivity/tempest-monitoring) — when a gauge spikes, ask the AI what to do
* [SSH Snippets](/productivity/tempest-monitoring) — save AI-generated commands as reusable snippets
# AI Agents for Server Automation (Codex, Claude Code, OpenCode)
Connect Codex CLI, Claude Code, OpenCode, or any MCP-compatible AI agent to Tempest's MCP server to automate SSH operations, server maintenance, and interactive terminal tasks without writing scripts.
Tempest ships a built-in **MCP (Model Context Protocol) server** that gives any compatible AI agent a full SSH terminal. The agent can open sessions to your saved servers, type commands, read the rendered screen, drive interactive TUIs (htop, vim, dialog), and close connections — all over the same tool protocol that Claude Desktop, Codex CLI, and OpenCode understand natively.
No shell scripts. No Ansible playbooks for one-off tasks. Just describe what you want, and the agent handles the keystrokes.
## How it works
```
┌─────────────┐ MCP (stdio / HTTP) ┌──────────────────────┐
│ AI agent │ ←────────────────────────→ │ tempest mcp server │
│ (Codex CLI, │ tool calls & results │ │
│ Claude, │ │ ssh_connect │
│ OpenCode…) │ │ feed_from_terminal │
└─────────────┘ │ feed_from_session │
│ list_ssh_servers │
│ … (15 tools total) │
└──────────┬───────────┘
│ libssh2 / PTY
▼
┌──────────────────────┐
│ your remote host │
└──────────────────────┘
```
The MCP server runs locally on your machine and acts as the SSH client. Credentials stay in your encrypted Tempest vault — the AI only ever sees server names and terminal output, never passwords or private keys.
## Setup
This page focuses on what the agent can do once it's connected. For step-by-step installation in Claude Code, Codex CLI, Claude Desktop, Cursor, VS Code, Zed, OpenCode, and other MCP clients — plus prerequisites, transport options, the full tool reference, and troubleshooting — see [Install Tempest MCP Server in Claude Code, Codex, Cursor & More](/productivity/install-tempest-mcp-server-in-ai-clients).
The short version: `claude mcp add tempest -- tempest mcp` (Claude Code), or the equivalent config entry in your client. Then ask the agent *"List my saved SSH servers"* to confirm it's wired up.
## Practical examples
### Check disk usage across all your servers
Prompt:
> List my saved SSH servers, connect to each one, run `df -h`, and give me a table of filesystem usage. Flag any filesystem over 80%.
The agent will:
1. Call `list_ssh_servers` to enumerate your vault.
2. For each host, call `ssh_connect_saved` → `feed_from_terminal` (`"df -h\r"`) → `feed_from_session` to read the output.
3. `disconnect` when done.
4. Summarize results in a markdown table.
### Restart a failing systemd service
Prompt:
> SSH into my web-01 server and restart the nginx service. Show me the journal output after restart and confirm it's running.
The agent will:
1. `list_ssh_servers` → pick `web-01` → `ssh_connect_saved`.
2. `feed_from_terminal`: `"sudo systemctl restart nginx\r"`.
3. `feed_from_session` to read any password or error prompts; respond if needed.
4. `feed_from_terminal`: `"sudo journalctl -u nginx -n 50 --no-pager\r"`.
5. `feed_from_session` → paste output back to you.
6. `disconnect`.
### Investigate a full disk
Prompt:
> My db-02 server is reporting a full disk. SSH in and find what's taking up space under /var.
```
du -sh /var/* | sort -rh | head -20
```
The agent runs the command, reads the screen, drills down into the largest directory, and proposes what to clean up — all without you touching a terminal.
### Drive an interactive TUI
Prompt:
> Open htop on my dev server and tell me which process is consuming the most CPU right now.
The agent:
1. `ssh_connect_saved` → dev server.
2. `feed_from_terminal`: `"htop\r"`.
3. Waits \~300ms, then calls `feed_from_session`.
4. Reads the rendered htop grid — process list, CPU bars, memory gauges — and summarizes the top consumer.
5. Sends `"q"` to quit, then `disconnect`.
`feed_from_session` returns the terminal screen **as rendered** (cursor position, alternate-screen flag, styled text with color annotations). The agent sees exactly what you would see.
### Batch deploy a config change to multiple servers
Prompt:
> Update /etc/sysctl.conf on all my "production" group servers to set net.core.somaxconn=4096, then reload without rebooting.
The agent opens sessions in sequence (or asks if you want parallel), runs `echo` / `tee` / `sysctl -p`, reads each server's output, and reports which hosts succeeded.
## Tips for writing effective prompts
**Name your servers clearly.** The agent calls `list_ssh_servers` and picks by name. A server named `db-primary-us-east` is easier to reason about than `srv-04`.
**Prefer saved servers over ad-hoc credentials.** `ssh_connect_saved` keeps credentials out of the conversation entirely — the vault decrypts locally. If you must use `ssh_connect` with a password, the password will appear in the agent's tool call log.
**Ask the agent to disconnect when done.** Sessions leak resources if left open. A prompt like *"clean up all connections when finished"* is enough.
**For long-running commands**, tell the agent to wait before reading: *"Run the backup script and give it 60 seconds before checking the output."* The agent can send the command, tell you it's waiting, then call `feed_from_session` after the delay.
## Auditing the agent at runtime
Most agent CLIs show tool calls before executing them — Codex CLI's `--approval-policy auto` vs. `cautious`, Claude Code's confirmation prompt, Cursor's per-tool approval. Review the `feed_from_terminal` calls before approving, especially for destructive operations (`rm`, `systemctl stop`, `DROP TABLE`). For broader credential and transport-level security, see the [Security notes](/productivity/install-tempest-mcp-server-in-ai-clients#security-notes) in the installation guide and [Reset Your Tempest Password](/account-and-privacy/resetting-password) for vault key rotation.
## See also
* [Install Tempest MCP Server in Claude Code, Codex, Cursor & More](/productivity/install-tempest-mcp-server-in-ai-clients) — full installation reference for every MCP client
* [Tempest AI Assistant](/productivity/tempest-ai-assistant) — built-in chat panel for ad-hoc questions in an open terminal tab
* [SSH Snippets & Scheduled Commands](/productivity/snippets-scheduled-runs) — run recurring commands on a schedule without an AI agent
* [Self-Hosted Tempest Server & Web Mode](/deployment/self-hosted-tempest-server) — host the MCP server on a remote machine for team use
* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials) — vault encryption details
# Install Tempest MCP Server in Claude Code, Codex, Cursor & More
Step-by-step guide to install the Tempest MCP server in Claude Code, Codex CLI, Claude Desktop, Cursor, VS Code (Copilot & Continue), Zed, OpenCode, and any other Model Context Protocol-compatible AI
Tempest ships a **Model Context Protocol (MCP) server** that exposes your saved SSH hosts, local shells, and Telnet sessions as tools any MCP-compatible AI agent can call. This guide walks through installing the server in each major MCP client — from one-line CLI registration in Claude Code, to JSON configuration in Cursor, to the YAML schema used by VS Code Continue.
If you want a feature overview of what the agent can do once connected (use cases, prompts, example sessions), read [AI Agents for Server Automation](/productivity/using-ai-agents-to-manage-servers) first. This page is the installation reference.
## Prerequisites
1. **Install Tempest** (desktop app or CLI) and make sure the `tempest` binary is on your `PATH`:
```bash
tempest --version
```
2. **Log in and unlock your vault** — required for the saved-server tools to decrypt credentials locally:
```bash
tempest login # OAuth2 sign-in, stores token in ~/.tempest/auth.json
tempest unlock # cache the vault key for this session
```
3. Save at least one SSH host in Tempest so you can test the connection (Settings → Servers, or `tempest ssh add`).
No Node.js, Python, or `npx` proxy is required — the MCP server is compiled into the `tempest` binary.
## Choose a transport
Tempest implements both transports defined in the MCP specification. Pick whichever your client supports best:
| Transport | When to use | Command |
| -------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
| **stdio** | Default for almost every client. The client spawns `tempest mcp` as a child process and talks to it over stdin/stdout. | `tempest mcp` |
| **HTTP / SSE** | When you want one long-running server shared by multiple clients, or when your client only supports HTTP MCP. | `tempest mcp --http` (binds to `127.0.0.1:3456`) |
The HTTP transport listens on loopback only and is unauthenticated — do not expose it to a non-local network without putting an authenticating reverse proxy in front.
## Install in Claude Code
Register the server once with the Claude Code CLI:
```bash
claude mcp add tempest -- tempest mcp
```
To make it available in every project, install it globally:
```bash
claude mcp add --scope user tempest -- tempest mcp
```
For the HTTP transport (start `tempest mcp --http` first):
```bash
claude mcp add --transport http tempest http://127.0.0.1:3456/mcp
```
Verify the registration:
```bash
claude mcp list
```
In a Claude Code session, type `/mcp` to see the active servers and their tools.
## Install in Codex CLI
Edit `~/.codex/config.toml` (or `.codex/config.toml` at your project root) and add:
```toml
[mcp_servers.tempest]
command = "tempest"
args = ["mcp"]
```
For the HTTP transport:
```toml
[mcp_servers.tempest]
type = "sse"
url = "http://127.0.0.1:3456/sse"
```
Restart any open Codex session — on next launch, Codex spawns `tempest mcp` automatically and the tools become available to the model.
## Install in Claude Desktop
Open **Claude → Settings → Developer → Edit Config**, which opens `claude_desktop_config.json`. Add a `mcpServers` entry:
```json
{
"mcpServers": {
"tempest": {
"command": "tempest",
"args": ["mcp"]
}
}
}
```
Save the file and fully quit Claude Desktop (⌘Q on macOS), then reopen. The 🔌 icon in the input box should now list `tempest` and its tools.
If Claude Desktop reports `spawn tempest ENOENT`, use the absolute path returned by `which tempest` (typical: `/usr/local/bin/tempest` or `/opt/homebrew/bin/tempest`) as the `command` value.
## Install in Cursor
Open **Cursor → Settings → Tools & MCP → Add new MCP server**. Cursor writes to `~/.cursor/mcp.json`; paste:
```json
{
"mcpServers": {
"tempest": {
"command": "tempest",
"args": ["mcp"]
}
}
}
```
Reopen the MCP panel and toggle `tempest` on. Cursor's Composer (`⌘I`) and Agent mode will pick up the tools.
## Install in VS Code (GitHub Copilot Chat)
Open the Command Palette and run **MCP: Add Server**. Choose **Command (stdio)** when prompted, then enter:
* **Command:** `tempest`
* **Arguments:** `mcp`
* **Server ID:** `tempest`
This appends an entry to `.vscode/mcp.json` (project-scoped) or your User `settings.json` under `"mcp.servers"`. Copilot Chat's Agent mode will list the new tools in its picker.
## Install in VS Code (Continue extension)
Continue uses YAML. Edit `~/.continue/config.yaml`:
```yaml
mcpServers:
- name: tempest
command: tempest
args:
- mcp
```
Reload the Continue panel and the tools appear under the **Tools** tab.
## Install in Zed
Open the Command Palette → **agent: add context server**, or edit `~/.config/zed/settings.json` directly:
```json
{
"context_servers": {
"tempest": {
"source": "custom",
"command": "tempest",
"args": ["mcp"]
}
}
}
```
Open the Assistant panel and the Tempest tools will be available in agent mode.
## Install in OpenCode
Add to `opencode.json` at your project root (or `~/.config/opencode/opencode.json` for global):
```json
{
"mcp": {
"tempest": {
"type": "local",
"command": "tempest",
"args": ["mcp"]
}
}
}
```
## Install in Windsurf
Open **Windsurf → Settings → Cascade → MCP Servers → Edit raw config** and add:
```json
{
"mcpServers": {
"tempest": {
"command": "tempest",
"args": ["mcp"]
}
}
}
```
Hit **Refresh** in the MCP panel.
## Install in any other MCP client
Most clients accept either a stdio command or an HTTP URL. For Tempest the values are:
* **stdio:** `command = tempest`, `args = ["mcp"]`
* **HTTP / SSE:** start `tempest mcp --http` and point the client at `http://127.0.0.1:3456/mcp` (streamable HTTP) or `http://127.0.0.1:3456/sse` (SSE).
Tempest implements the MCP 2024-11-05 specification.
## Verify the installation
After registering the server in your client, ask the model:
> List my saved SSH servers.
The agent should call `list_ssh_servers` and return your vault entries. If that works, try:
> Connect to `` and run `uptime`.
You'll see the agent call `ssh_connect_saved`, `feed_from_terminal`, and `feed_from_session` in sequence.
## Tools exposed by the server
| Tool | Purpose |
| ---------------------- | --------------------------------------------------------------------------- |
| `list_ssh_servers` | List saved SSH hosts (id, name, group, host:port) — no credentials returned |
| `ssh_connect_saved` | Open SSH session to a saved host, credentials decrypted locally |
| `ssh_connect` | Open SSH session to an ad-hoc host (user/host/auth supplied inline) |
| `telnet_connect_saved` | Open Telnet session to a saved host |
| `local_shell_start` | Spawn a local bash / zsh / fish / pwsh shell in a PTY |
| `feed_from_terminal` | Send keystrokes to a session — commands, control codes, arrow keys |
| `feed_from_session` | Snapshot the rendered terminal screen, including TUI layouts |
| `list_sessions` | List all open sessions and their state |
| `resize` | Resize a session's PTY |
| `disconnect` | Close a session and free resources |
For prompt patterns and full use-case walkthroughs, see [AI Agents for Server Automation](/productivity/using-ai-agents-to-manage-servers).
## Troubleshooting
**`spawn tempest ENOENT` / `command not found`.** The client's PATH does not include the directory holding the `tempest` binary. Use the absolute path from `which tempest` as the `command` value, or launch the client from a shell where `tempest --version` works.
**Tools return `vault is locked`.** Run `tempest unlock` in a terminal before starting the agent session, or enable the OS keyring integration in **Settings → Vault → Keyring** so the key persists between launches.
**HTTP transport refuses the connection.** Confirm `tempest mcp --http` is running and printed `listening on 127.0.0.1:3456`. If you changed the port, update the client URL to match (`--port 4000` → `http://127.0.0.1:4000/mcp`).
**Saved-server tools are missing but `local_shell_start` works.** You're logged out or your token expired. Run `tempest login` and try again.
**The agent connects but its commands "hang."** Some interactive prompts (sudo password, `yes/no`, pager) wait for input. Ask the agent to call `feed_from_session`, observe the prompt, and respond with the matching `feed_from_terminal` payload (e.g. `"y\r"`).
## Security notes
* **Credentials never leave your device.** The MCP server decrypts vault entries locally; the AI only ever sees server metadata (name, group, host:port) and terminal output.
* **Prefer SSH agent authentication.** With keys loaded into `ssh-agent`, no secret material flows through any tool call.
* **Audit destructive tool calls.** Each client surfaces tool calls before executing them — review `feed_from_terminal` payloads when the agent is about to run `rm`, `systemctl stop`, `DROP TABLE`, etc. Codex CLI's `--approval-policy cautious`, Claude Code's confirmation prompt, and Cursor's per-tool approval all serve this purpose.
* **The HTTP transport trusts localhost.** Do not expose `tempest mcp --http` beyond `127.0.0.1` without an authenticating reverse proxy.
## See also
* [AI Agents for Server Automation — Codex, Claude Code & OpenCode](/productivity/using-ai-agents-to-manage-servers) — use cases, example prompts, and what the agent can actually do once installed
* [Tempest AI Assistant](/productivity/tempest-ai-assistant) — the in-app chat panel that lives next to your terminal
* [Self-Hosted Tempest Server & Web Mode](/deployment/self-hosted-tempest-server) — share one MCP server across a team
* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials) — vault encryption details
# Design Reusable AI Skills for Ops Automation
Package prompts, scripts, and docs into reusable AI skills so your AI agent runs SSH and server operations the same reliable way every time. A practical guide with a real DevOps example, built on Temp
AI agents are great at one-off answers and terrible at doing the *same* task the same way twice. Ask an agent to "check why the server is slow" on Monday and again on Friday, and you'll get two different investigations, two different command sets, and two different levels of thoroughness.
**AI skills fix this.** A skill packages the knowledge, the exact scripts, and the "when to use me" trigger into one reusable unit your agent loads on demand. Instead of re-explaining your runbook every time, you teach the agent *once* and it executes reliably forever.
This guide shows you how to design skills that turn flaky, ad-hoc AI help into dependable, repeatable ops automation — whether you use the built-in [Tempest AI Assistant](/productivity/tempest-ai-assistant) or an [external agent like Codex or Claude Code](/productivity/using-ai-agents-to-manage-servers).
## What is an AI skill?
An **AI skill** is a self-contained, reusable capability you give an AI agent. In practice it is a small folder:
```
diagnose-high-load/
├── SKILL.md # what it does, when to use it, how it works
├── collect.sh # gather load, top processes, IO wait
└── summarize.py # turn raw output into a ranked diagnosis
```
The `SKILL.md` is the brain. Everything else is the muscle. When the agent decides the skill is relevant — based on its `description` — it reads `SKILL.md`, then runs the scripts it references.
This model was popularized by coding agents such as Claude Code, which load skills from a `skills/` directory, each with a `SKILL.md` whose frontmatter tells the model *when* to reach for it. The same pattern works beautifully for **infrastructure and ops**, where "do it exactly like the runbook" matters even more than in code.
### Skill vs. prompt vs. script
| Approach | Reusable? | Deterministic? | The AI knows when to use it? |
| ------------------ | ------------------- | ---------------------- | ------------------------------ |
| **One-off prompt** | ❌ retyped each time | ❌ varies per run | ❌ |
| **Bare script** | ✅ | ✅ | ❌ agent doesn't know it exists |
| **AI skill** | ✅ | ✅ scripts + ✅ guidance | ✅ via its `description` |
A skill is the only option that is reusable, deterministic *and* self-advertising. That last property — the agent knowing **when** to use it — is what makes skills scale.
## Why reusable skills beat one-off prompts
1. **Consistency.** The same steps run every time, in the same order, with the same thresholds.
2. **Safety.** You review the scripts once. The agent runs vetted commands instead of improvising `rm -rf` at 2 a.m.
3. **Speed.** No re-explaining context. The agent loads the skill and goes.
4. **Team leverage.** One engineer writes the skill; the whole team's AI inherits it.
5. **Portability.** A well-formed skill is just Markdown + scripts, so it works across agents — the built-in assistant today, an external agent tomorrow.
## Anatomy of a great `SKILL.md`
The `SKILL.md` file is where skills succeed or fail. Give it frontmatter and a body:
```markdown
---
name: diagnose-high-load
description: >
Diagnose high CPU or load average on a Linux host. Use when a server feels
slow, load average is elevated, or a monitoring alert fires for CPU/IO.
Identifies the top offending processes and IO wait, and proposes next steps.
---
# Diagnose High Load
## When to use
Trigger this when: load average > number of cores, a CPU/latency alert fires,
or the user says the box is "slow" / "pegged" / "hanging".
## How it works
1. Run `collect.sh` on the target host to snapshot load, top, iostat, and the
busiest processes.
2. Pipe the raw output through `summarize.py` to rank likely root causes.
3. Report the top suspect + a recommended action. Do NOT restart services
without confirmation.
## Guardrails
- Read-only. Never kill processes or restart services automatically.
- If IO wait dominates, suggest checking disk health, not CPU.
```
### The three fields that matter most
* **`name`** — a short, kebab-case identifier. Stable; don't rename casually.
* **`description`** — *the single most important line in the whole skill.* This is what the agent reads to decide whether to load it. Write it for **discovery**: name the symptoms, the trigger words, and the outcome. A vague description ("helps with servers") never gets picked; a specific one ("use when load average is elevated or a CPU alert fires") gets picked exactly when it should.
* **When-to-use** (in the body) — reinforce the triggering conditions so the model doesn't misfire.
> **The description is a search query the *****model***** runs against your skill library.** Optimize it the way you'd optimize a page title — for the exact terms the situation will surface.
## Design your first skill in 5 steps
1. **Pick a task you repeat.** The best first skill is a runbook you've explained to a teammate more than twice.
2. **Write the scripts first.** Get `collect.sh` working by hand over SSH. Make it idempotent — safe to run twice.
3. **Write the `description` last, and sweat it.** List the symptoms and trigger words. This is your discovery surface.
4. **Add guardrails.** Explicitly state what the skill must *not* do (no restarts, no writes, no deletes without confirmation).
5. **Store it where the agent can find it** — a folder in [Tempest Drive](/productivity/snippets-scheduled-runs) (more below).
## Best practices for reliable, safe skills
* **One skill, one job.** A skill that "does everything" gets loaded for the wrong reasons. Split broad skills.
* **Idempotent scripts.** Running twice should be safe. Prefer read-only collection; separate any mutation into a clearly-named step.
* **Least privilege.** Keep destructive capabilities in their own skill with heavy guardrails and required confirmation.
* **Deterministic output.** Have scripts emit structured, stable text (or JSON) so the AI's summary is consistent run to run.
* **Pin the environment.** State the target OS/shell assumptions in `SKILL.md`; don't let the agent guess.
* **Name for the trigger, not the mechanism.** `diagnose-high-load` beats `run-top-and-iostat` — the agent matches on the problem, not the tool.
## A real example you can copy
**Goal:** when a Linux box is slow, find the culprit safely.
`collect.sh`:
```bash
#!/usr/bin/env bash
# Read-only load snapshot. Safe to run repeatedly.
set -euo pipefail
echo "== uptime =="; uptime
echo "== top (5s) =="; top -b -n1 | head -20
echo "== iowait =="; iostat -xz 1 2 2>/dev/null | tail -30 || echo "iostat not installed"
echo "== top mem/cpu procs =="; ps aux --sort=-%cpu | head -10
```
`summarize.py` ranks likely causes from that output — CPU-bound vs IO-bound vs memory pressure — and names the top offending process, emitting a stable, sectioned report. `SKILL.md` ties them together with a `description` that says *use me when the box is slow or a CPU alert fires* and a guardrail that says *read-only, never restart anything*.
Now any time a server feels slow, the agent loads this one skill and runs the same disciplined investigation — no improvisation.
## Where to store skills: Tempest Drive
A skill is only reusable if your agent can find it. **Tempest Drive** — the same store behind [Snippets & Scheduled Runs](/productivity/snippets-scheduled-runs) — is a natural home: it holds documents and scripts as first-class items, organized into **folders**. And a skill is just a folder:
```
Drive/
└── skills/
└── diagnose-high-load/
├── SKILL.md (Markdown)
├── collect.sh (Shell)
└── summarize.py (Python)
```
Because Drive items carry a folder path and a language (Markdown, Shell, Python, and more), a skill needs **no special format** — it's an ordinary folder of ordinary files. Drive syncs [end-to-end encrypted](/account-and-privacy/end-to-end-encryption) across your devices, so a skill you write on your laptop is available to your agent everywhere, and shareable with your team's vault.
That means:
* **You** can author and edit skills in the Drive UI, with folders and breadcrumbs.
* **Your AI** can *read* a skill to execute it — and save new skills back to Drive as it learns your environment.
## Using skills across agents
Skills are portable by design, so the same folder works no matter which brain is driving:
* [**Tempest AI Assistant**](/productivity/tempest-ai-assistant) — reference a skill's `SKILL.md` and scripts as context, and the assistant follows the runbook, using its terminal and file tools to run the steps on the target host.
* [**External agents**](/productivity/using-ai-agents-to-manage-servers) such as Codex or Claude Code, connected over the [Tempest MCP server](/productivity/install-tempest-mcp-server-in-ai-clients) — these manage their own skills on disk. Point them at the same skill folder, or let them save skills to Drive so your whole toolchain shares one library.
Because a skill is just Markdown plus scripts, there's no lock-in: write it once, run it with any agent that can read a file and run a command.
## Frequently asked questions
**What is an AI skill?**\
A reusable capability packaged as a folder — a `SKILL.md` describing what it does and when to use it, plus the scripts it runs. The agent loads it on demand based on the description.
**How is a skill different from a prompt?**\
A prompt is retyped and varies each run. A skill is stored once, runs deterministic scripts, and advertises itself to the agent via its `description`, so it's picked automatically at the right moment.
**What should go in `SKILL.md`?**\
Frontmatter with a `name` and a sharp `description`, plus a body covering *when to use it*, *how it works*, and *guardrails* (what it must never do).
**How do I make an AI skill safe?**\
Keep it least-privilege and idempotent: read-only diagnostics by default, destructive actions isolated into their own guarded skill that requires confirmation.
**Where do I store AI skills?**\
Anywhere the agent can discover them — most naturally in **Tempest Drive**, which stores each skill as a synced, optionally shared folder of Markdown and scripts.
**Can different AI agents share the same skill?**\
Yes. A skill is just Markdown plus scripts, so the built-in assistant and external MCP agents can all read and run the same skill folder.
## Conclusion
The jump from "AI that helps sometimes" to "AI that reliably runs your ops" is skills. Package your runbooks as folders — a sharp `SKILL.md` plus vetted, idempotent scripts — store them in [Tempest Drive](/productivity/snippets-scheduled-runs), and any agent you use inherits your team's operational knowledge.
Start with one skill for a task you repeat. Sweat the `description`. Add guardrails. Then watch your AI do the same job, the same safe way, every single time.
# SSH Snippets & Scheduled Commands
Save reusable shell commands as Tempest Snippets and run them on a schedule across one or many SSH hosts, with cross-device notifications on failure.
**Snippets** are Tempest's saved shell commands — paste a command once, give it a name, and re-run it on any host with a click. **Scheduled runs** turn snippets into cron jobs that fire on the hosts you choose, with notifications routed to your phone via [Tempest Push](/productivity/tempest-push-notifications) when a run fails.
It's the missing layer between "I keep retyping the same `journalctl -u …`" and "I don't want to set up Ansible just for three commands."
## Save a snippet
1. Open the **Snippets** panel.
2. Click **New Snippet**.
3. Paste your command (multi-line is fine — bash heredocs, pipelines, etc.).
4. Give it a name and optionally a description.
5. Save.
Snippets sync across your devices via your encrypted vault, just like hosts.
## Run a snippet
* In any SSH tab, open the snippet panel and pick one — Tempest sends it through the channel
* Or **target multiple hosts** at once: pick the snippet, select hosts from your list, run. Each host gets its own output panel.
## Schedule a snippet
1. Open a snippet → **Schedule** tab.
2. Set the cron expression (UI helper for common patterns: every hour, every day at 3 AM, etc.).
3. Pick targets: one host, a tag-matched group, or all hosts.
4. Optional: enable **Notify on failure** → exit code ≠ 0 triggers a Tempest Push to your phone.
5. Save.
The schedule runs **in the Tempest backend** (Electron main process / standalone server), not in the renderer. So:
* Your laptop can be asleep and the run still happens — as long as the Tempest backend is up.
* On the **standalone Tempest server**, schedules survive even if no client is connected (perfect for lightweight ops automation).
## Run history
Each scheduled run records:
* Start / end timestamp
* Exit code
* Stdout / stderr captured (configurable size limit)
* Per-target status when running fan-out
Browse history in **Snippets → History** with filters by snippet, host, and status.
## When to use snippets vs. an actual config-management tool
| Use Snippets when | Use Ansible / Puppet / Salt when |
| ----------------------------------------------------------------------- | ------------------------------------------------- |
| 1–10 hosts | Hundreds of hosts |
| Operational commands ("show me the disk usage", "restart this service") | Declarative state ("nginx must be installed") |
| You want one-shot fan-out from your laptop | You want a CI pipeline triggering converged state |
| Quick fix for a specific incident | Reproducible infrastructure |
The two complement each other — snippets handle ad-hoc operational tasks, real config-management tools handle long-lived state.
## Pro feature
Scheduled runs are part of **Tempest Pro**. Saving and one-off running of snippets is free.
## See also
* [Tempest Push Notifications](/productivity/tempest-push-notifications) — how failure alerts reach your phone
* [Tempest AI Assistant](/productivity/tempest-ai-assistant) — generate snippet content from a natural-language description
# iperf3 Network Speed Test
Built-in iperf3 in Tempest — measure throughput, latency, and jitter to any server without installing iperf3 on either side.
Tempest ships an **embedded iperf3** so you can measure server bandwidth, latency, and jitter without `apt install iperf3` on either end. Open the iperf3 panel inside any tab, point it at the host, and Tempest runs the TCP / UDP test natively — no client to install, no server-side dependency, just a chart in your terminal.
This is the fastest way to answer "is this slow because of the network or the app?" when you're already SSH'd into a box.
## Run a speed test
1. Open any SSH connection (or use Tempest's local shell).
2. Open the **iperf3** panel from the tab toolbar.
3. Choose direction:
* **Download** (server → client) — most common
* **Upload** (client → server)
* **Bidirectional**
4. Optional: choose **TCP** (default, throughput) or **UDP** (latency / jitter / packet loss).
5. Set duration (default 10 s) and parallel streams.
6. Click **Run**.
The chart updates per-second; results panel shows aggregate throughput, retransmits (TCP), or jitter / loss (UDP).
## Native implementation
Tempest links iperf3 directly into the binary (Rust FFI to the upstream C library), so:
* **No install on the remote** — Tempest spins up an in-process iperf3 server when needed.
* **No install on your machine** — it's part of Tempest.
* Works on **macOS, Windows, and Linux** with identical behavior.
## When you'd use this
* Diagnosing slow `git clone` / `apt update` — is it the network or the registry?
* Validating a new VPS provider's advertised bandwidth before committing
* Comparing two cloud regions before deciding where to deploy
* Verifying a VPN / Tailscale / WireGuard tunnel is operating at line speed
* Pre-flight check before a large `rsync` job
## Limitations
* iperf3 measures end-to-end network throughput, not application performance. A `curl` against an HTTP API still depends on the server's ability to respond fast.
* UDP tests can be rate-limited by intermediate routers; treat results as a *lower bound*.
## See also
* [Tempest Monitoring](/productivity/tempest-monitoring) — live network I/O gauge for the same SSH session
* [SSH Port Forwarding](/connect-to-servers/ssh-port-forwarding) — tunnel iperf3 over an SSH connection if direct UDP is blocked
# Kubernetes Profiles
Manage multiple kubeconfig contexts in Tempest — one Kubernetes cluster per tab, with kubectl, helm, and k9s ready to go on macOS, Windows, and Linux.
Tempest manages your **kubeconfig** files as first-class connection profiles. Each profile gets its own tab with the `KUBECONFIG` environment variable pre-set, so `kubectl`, `helm`, `k9s`, `kustomize`, and any other CLI tool just work — no manual context switching.
This solves the everyday "which cluster am I talking to?" problem: dev cluster in tab 1, staging in tab 2, prod in tab 3 — never type `kubectl config use-context` again.
## Add a kubeconfig
1. Open the **New Kubeconfig** dialog.
2. Paste a kubeconfig YAML or load from a file. Tempest parses the contexts inside.
3. Click **Connect**. Tempest opens your local terminal with `KUBECONFIG` already pointing at this profile.
## Use kubectl, helm, k9s
Inside the tab, run any tool exactly as you would in a normal shell:
```bash
kubectl get pods -A
helm list -A
k9s
```
**Tip**: keep one kubeconfig profile open per cluster — different tabs can target different clusters at the same time without env-var conflicts.
## Install the Kubernetes CLI
Tempest doesn't bundle `kubectl` — install it once with your platform's package manager.
| Platform | Install command |
| ------------------- | ------------------------------------------------------------------------------------------- |
| **macOS** | `brew install kubectl` (requires [Homebrew](https://brew.sh)) |
| **Windows** | `scoop install kubectl` (requires [Scoop](https://scoop.sh)) |
| **Ubuntu / Debian** | See [official install guide](https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/) |
For `helm` and `k9s` use the same package managers (`brew install helm k9s`, `scoop install helm k9s`).
## See also
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale) — many production Kubernetes clusters live behind these zero-trust gateways
* [Tempest AI Assistant](/productivity/tempest-ai-assistant) — ask the AI to draft `kubectl` commands and pipe results back into the terminal
# Tempest Monitoring
Live CPU, memory, disk, and network gauges for any SSH server you connect to with Tempest — privacy-respecting, no agent install, runs only with consent.
**Tempest Monitoring** turns any SSH session into a live system dashboard: CPU, memory, disk, and network gauges update in real time inside the same tab where you're working — no Grafana, no Prometheus, no agent install required. It's a quick "is this box healthy?" answer for any Linux server you can SSH into.
## Enable monitoring
> Monitoring is part of **Tempest Pro**.
1. Open the connection's **Edit** form.
2. Toggle **Monitoring** on.
3. Save and reconnect.
Monitoring option in Edit form
Gauges appear above the terminal once a successful sample is collected.
## What runs on your server
> Tempest never sends your monitoring data anywhere — it's parsed locally and shown only in your tab.
Tempest periodically runs three standard Unix commands and parses the output:
* `top -b -n1` — first 5 lines, for CPU and memory
* `df` — for disk usage
* `cat /proc/net/dev` — for network I/O
These are read-only, available on virtually every Linux distribution, and require no special privileges. No agent, no daemon, no kernel module.
## Compatibility
* **Linux**: full support (any distro with `top` and `/proc/net/dev`).
* **macOS / BSD**: partial — CPU/memory work; some disk/network parsing differs.
* **Windows servers**: not supported (no `/proc/net/dev`).
## Privacy
See [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy) for the full data-handling story. Monitoring samples never leave your device.
## See also
* [Tempest AI Assistant](/productivity/tempest-ai-assistant) — ask the AI to investigate when a gauge spikes
* [Kubernetes Profiles](/productivity/kubernetes-profiles) — pair monitoring with `kubectl top`
# Split Screens — Tile Multiple SSH Sessions
How to split, tile, and arrange terminal panes in Tempest — keyboard shortcuts for vertical and horizontal splits on macOS, Windows, and Linux.
Tempest lets you split any tab into multiple terminal panes so you can watch logs in one half while running commands in the other, or compare two servers side by side without window-juggling.
## Vertical split (left ↔ right)
| Platform | Shortcut |
| --------------- | ------------------ |
| macOS | `⌘ + D` |
| Windows / Linux | `Ctrl + Shift + D` |
The pane that has focus is split into two equal halves; the new pane opens an empty terminal where you can start a new session or paste a connection string.
## Horizontal split (top ↔ bottom)
Drag a tab into the top, bottom, left, or right edge of any existing pane to dock it there. The drop zones are highlighted as you drag.
## Closing a pane
Closing the underlying SSH / Local Shell session closes its pane. Remaining panes resize automatically.
## Tabs vs. splits — when to use which
* **Tabs**: independent sessions that you switch between (cheap to keep many open).
* **Splits**: sessions you want to watch *simultaneously* (e.g., `tail -f` in one pane, `vim` in the other).
## Tips
* Run a `top` / `htop` / Tempest Monitoring view in one pane and your editor in another to keep an eye on resource usage while you work.
* Combine splits with [SSH Jump Host chains](/connect-to-servers/ssh-jump-host-bastion-chaining) to view the bastion's logs and the target's logs at once.
# Tempest Push Notifications
Tempest Push sends cross-device notifications — get a push on your phone when a scheduled snippet fails. End-to-end encrypted, opt-in per device.
**Tempest Push** delivers push notifications between your Tempest devices: your laptop runs a scheduled snippet, the run fails, your phone gets a notification. The opposite works too — start a long-running command from your phone via a saved snippet, get notified on your Mac when it finishes.
The whole flow is opt-in per device and end-to-end encrypted.
## What you can be notified about
* **Scheduled snippet failures** — a cron-style run exits non-zero
* **Long-running snippet completions** — for jobs you fired and forgot
* **Connection errors** on critical hosts (configurable per-host)
## Setup
1. Sign in to Tempest on each device that should send or receive notifications.
2. **Settings → Notifications → Tempest Push** → toggle on per device.
3. On mobile (iOS / Android), grant push permission when prompted.
4. On desktop, register the device with the OS notification center.
Each device gets its own opt-in toggle — you can have a phone that *only* receives, or a server that *only* sends.
## How the routing works
* Your laptop / server / phone each register a push token with the Tempest backend.
* When one device emits a notification, the payload is encrypted to the receiving devices' public keys *before* it leaves the sending device.
* The Tempest backend hands the ciphertext to APNs (iOS) / FCM (Android) / OS notification API (desktop) — but never sees the plaintext message.
See [End-to-End Encryption](/account-and-privacy/end-to-end-encryption) for the cryptographic detail.
## Device push token (desktop)
Desktop Tempest doesn't go through OAuth2 — it uses a **device push token** (`LSDevicePushToken`) issued by Tempest's web services for sending notifications. The token is per-device, can be revoked individually, and is what allows headless / standalone Tempest backends to send pushes without holding any user OAuth credentials.
## Disable / revoke
Per device:
* **Settings → Notifications → Tempest Push** → toggle off.
Globally:
* **gotempest.app → Account → Devices** → revoke the device's push token. This stops all notification traffic from that device immediately.
## Limitations
* Push delivery best-effort — APNs / FCM may delay or drop messages under load.
* Critical alerts should still flow through dedicated tools (PagerDuty, Opsgenie, etc.). Tempest Push is for individual / small-team workflows.
## See also
* [Snippets & Scheduled Runs](/productivity/snippets-scheduled-runs) — the most common notification source
* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption) — how plaintext stays on your devices
# Self-Hosted Tempest Server & Web Mode
Run your own Tempest sync server — keep encrypted vault sync inside your network and access SSH from any browser via Tempest's Web Mode.
Tempest can run as a **self-hosted server** — a Node.js process that handles encrypted vault sync, SSH session multiplexing, and Tempest Push routing for the devices you connect to it. Combined with Tempest's **Web Mode** (the same UI running in a browser), this lets you SSH from any device that has a browser — without installing anything on it — while keeping all the encrypted sync inside your own infrastructure.
This is the right setup for:
* Privacy-sensitive teams that want zero data on third-party servers
* Air-gapped or restricted networks
* "I want to SSH from my Chromebook / iPad without installing apps"
* Homelab enthusiasts who already self-host everything
## Configure on the welcome screen
When you first launch Tempest desktop or open a fresh browser tab to your server URL:
1. Welcome screen → **Self-hosted server** section
2. Enter your server URL (e.g. `https://tempest.example.com`)
3. Sign in with your account credentials
After this, all sync, scheduled runs, and notifications flow through your server.
## Web Mode — Tempest in any browser
Self-hosted server + Web Mode is the killer combo: visit your server URL in any browser, sign in, and you get the full Tempest UI — host list, terminal tabs, SFTP, AI assistant — running entirely in the browser.
This is great for:
* SSH from a Chromebook or iPad
* Quick access from a borrowed machine without installing the desktop client
* Mobile-friendly access in a pinch
The browser → server channel uses WebSockets; the server holds the SSH connections (per the C/S architecture), and the browser receives pre-rendered terminal frames.
## Auto-reconnect
The browser ↔ server WebSocket reconnects automatically if your network blips, with visible "disconnected, reconnecting…" / "reconnected" toasts so you know what's happening.
## Privacy & E2E with self-hosting
Even when you self-host:
* Your **vault encryption keys never leave your devices**.
* The server still only sees ciphertext (it's the same E2EE design as the cloud sync — see [End-to-End Encryption](/account-and-privacy/end-to-end-encryption)).
The benefit of self-hosting isn't a different security model — it's that *you* are the operator of the relay, with full audit log access and no third-party data residency questions.
## Backend responsibilities
The Tempest server runs:
* **Encrypted vault sync endpoint** — receives encrypted vault docs from your devices
* **SSH multiplexing** — holds the actual SSH connections so the browser doesn't (browsers can't speak SSH directly)
* **Snippet scheduler** — fires scheduled snippet runs even when no client is connected
* **Tempest Push relay** — forwards encrypted notification payloads to APNs / FCM
* **Notification module** — local channels (webhook, Pushover, SMTP) sent directly from the server
## What the server does *not* hold
* Your vault encryption keys (only your devices do)
* OAuth2 tokens (those stay in the browser / desktop client per the C/S design)
See the [Tempest Knowledge Base](/) for what each layer does.
## Deployment
Tempest server is a Docker image. Detailed deployment configs please contact support for early access.
## See also
* [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy)
* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption) — applies whether sync is cloud or self-hosted
* [Tempest Push Notifications](/productivity/tempest-push-notifications) — works through self-hosted server
# How Tempest Protects Your Privacy
Tempest uses zero-knowledge end-to-end encryption — your SSH keys and passwords are encrypted on your device before sync. We cannot read them.
Tempest is built on **zero-knowledge end-to-end encryption (E2EE)**. Your SSH keys, passwords, snippets, and connection metadata are encrypted on your device *before* anything is uploaded for cloud sync — meaning we couldn't read them even if compelled to. This is the same security model that 1Password, Bitwarden, and Signal use.
## What that means in practice
* **You** hold the only key that can decrypt your data — your **vault password**, which never leaves your device.
* **Tempest's servers** see only ciphertext. We sync it between your devices but cannot read it.
* If you forget your vault password, **your data is unrecoverable**. We don't have a backdoor and we can't make one. See [Reset Your Tempest Password](/account-and-privacy/resetting-password).
## The cryptography
| Layer | Algorithm | Purpose |
| ------------------------ | ------------------------------------------------- | ---------------------------------------------------------------------- |
| Key derivation | **BLAKE2b** | Stretches your vault password into a symmetric key |
| Symmetric encryption | **xsalsa20poly1305** (authenticated encryption) | Encrypts each record before sync |
| Transport | **TLS 1.3** | Protects the wire between your device and Tempest sync servers |
| Sync conflict resolution | **Multi-master replication** over encrypted blobs | Lets multiple devices stay in sync without the server seeing plaintext |
The crypto layer will be open-sourced so anyone can audit it.
## What is *not* encrypted
A small amount of operational metadata is necessarily plaintext on our servers:
* Your sync account email (so we can sign you in)
* Document IDs and revision counters (so the sync engine can replicate)
* Approximate document sizes (limit enforcement)
We never see hostnames, usernames, passwords, key contents, snippet text, or any other connection detail.
## What about [Tempest Monitoring](/productivity/tempest-monitoring)?
Monitoring data is parsed locally inside your Tempest tab and is **never sent anywhere** — not even to your other devices via sync. It's a render-only feature.
## What about [Tempest AI Assistant](/productivity/tempest-ai-assistant)?
AI requests are sent to the model provider you've configured (OpenAI, Anthropic, Google, or your self-hosted endpoint). Tempest acts as a transport — we don't proxy or log the requests. You can also point Tempest at a fully local model.
## See also
* [Reset Your Tempest Password](/account-and-privacy/resetting-password) — sync vs. vault passwords explained
* [SSH Cert Storage](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale#how-tempests-ssh-cert-support-works) — short-lived certs are stored as paths, not contents, when possible
# End-to-End Encryption (E2EE)
Tempest's end-to-end encryption explained — threat model, key derivation, per-record encryption, conflict-free sync, and what the server cannot see.
Tempest is **end-to-end encrypted**. Your SSH keys, passwords, snippets, and connection metadata are encrypted on your device with a key derived from your vault password — a key that **never leaves your device** — before anything reaches our sync servers. We literally cannot decrypt your data, even if compelled to. This is the same security architecture as 1Password, Bitwarden, Signal, and ProtonMail.
This page goes into the cryptographic detail. For the high-level pitch, see [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy).
## Threat model
E2EE is a defense against specific attackers. Tempest's E2EE defends against:
| Attacker | Defended? | How |
| ---------------------------------------- | --------- | ------------------------------------------------------------------------ |
| Tempest server breach | ✅ | Server only stores ciphertext; no keys to leak |
| Tempest employees | ✅ | Same — we never see plaintext |
| Network MITM (TLS terminator, ISP, etc.) | ✅ | Records are already ciphertext before TLS |
| Government request for "the user's data" | ✅ | We can hand over only what we have — encrypted blobs |
| Malware on your device | ❌ | Once your vault is unlocked locally, malware with that scope can read it |
| You forgetting your vault password | ❌ | Recovery would require us to hold a key — defeating E2EE |
The last two are inherent to any zero-knowledge system. Tempest can't recover a forgotten vault password — see [Reset Your Tempest Password](/account-and-privacy/resetting-password).
## Key derivation: vault password → encryption key
When you set a vault password, Tempest derives a 256-bit symmetric key:
```
key = BLAKE2b(vault_password, salt, output_length=32, person="tempest-vault-v1")
```
* **BLAKE2b** is a fast, modern cryptographic hash — RFC 7693, used in WireGuard, Argon2's reference, and many others.
* The salt is generated per vault and stored locally (it's also synced as part of the encrypted profile so a new device can re-derive the same key).
* The `person` field domain-separates this hash from any other use — a defense-in-depth measure so the same password used elsewhere can't accidentally produce the same key.
The resulting key never leaves your device. It's held in process memory while Tempest is unlocked and zeroed when you sign out.
## Per-record encryption: xsalsa20poly1305
Each document in your vault (a host, a snippet, a keychain entry, etc.) is encrypted independently:
```
ciphertext = secretbox.encrypt(plaintext, nonce, key)
```
Where `secretbox` is a standard **authenticated symmetric encryption** primitive:
* **xsalsa20** stream cipher — confidentiality
* **Poly1305** MAC — authenticity / tamper detection
* **24-byte random nonce** per record — no nonce reuse risk
Per-record encryption (rather than encrypting the whole vault as one blob) means:
* Sync replicates only the documents that changed — not gigabytes per edit
* A damaged record doesn't corrupt the rest
* Conflict resolution can happen at the per-document level without ever decrypting
## Sync transport: TLS over ciphertext
Encrypted records are then transported over **TLS 1.3** between your device and Tempest's sync servers. TLS gives us:
* Forward secrecy on the wire
* Server identity verification (so you can't be MITMed onto a fake Tempest)
* Defense-in-depth — even if the E2EE were ever broken, an attacker would also need to break TLS to passively observe
The double encryption is intentional: TLS protects the *protocol*, E2EE protects the *contents*.
## Conflict-free sync without decryption
Tempest sync uses a **multi-master replication protocol** designed for offline-first apps. The server treats each E2EE document as an opaque blob with:
* A document ID
* A revision counter
* The encrypted body
When two devices edit the same document offline and then sync, the server records both revisions and lets the client decide how to merge — *without the server ever seeing the contents*. This is unusual for a sync system and is a key reason Tempest can offer real-time multi-device sync without compromising E2EE.
## What the server *does* see
A small amount of operational metadata is necessarily plaintext:
| Visible to server | Why |
| --------------------------------------------- | ----------------------------------------------------- |
| Sync account email | We need to know which account the document belongs to |
| Document IDs and revision counters | The sync engine matches revisions across devices |
| Approximate document sizes | Quota enforcement |
| Device public keys (for Tempest Push routing) | We need to deliver notifications to specific devices |
| Last-sync timestamps | Diagnostics and "is this device still active?" |
We never see hostnames, usernames, passwords, key contents, snippet text, or any other connection detail.
## What the server cannot see
* Anything inside any encrypted document (hosts, keys, certs, snippets, keychain entries, sftp bookmarks…)
* Your vault password
* The derived encryption key
* Plaintext of `Tempest Push` notification payloads (these are E2EE'd to your other devices' public keys before submission)
## Comparison to other security models
| Model | Server can read your data? | Recovery if password lost? |
| ------------------------------------------------------------ | ----------------------------- | -------------------------- |
| **No encryption** (typical SaaS) | Yes | Yes — admin reset |
| **Server-side encryption at rest** (most cloud DBs) | Yes (key managed by provider) | Yes |
| **Encryption in transit only** (HTTPS but plaintext at rest) | Yes | Yes |
| **End-to-end encryption** (Tempest, 1Password, Bitwarden) | **No** | **No** |
The trade-off is explicit: lose the password, lose the data — in exchange for the strongest possible privacy guarantee.
## Tempest Push notifications and E2EE
When [Tempest Push](/productivity/tempest-push-notifications) sends a notification from one of your devices to another, the payload is encrypted to the receiving device's public key *before* hitting our notification relay. APNs / FCM see only:
* A target device token
* A small ciphertext (decrypted on-device into the actual notification text)
We never see the snippet that ran, the host that failed, or the user-readable notification message.
## Limitations and roadmap
* **Local malware**: any process running as you with disk + memory access can read your vault while it's unlocked. Use OS-level disk encryption (FileVault, BitLocker, LUKS) and don't run untrusted code as your user.
* **Quantum threat for stored ciphertext**: xsalsa20 is symmetric and not currently considered broken by Shor's algorithm. The vault's protection against future quantum attacks is acceptable.
* **Open source**: the crypto implementation will be open-sourced for independent audit — see [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy).
## See also
* [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy) — the high-level overview
* [Reset Your Tempest Password](/account-and-privacy/resetting-password) — what happens when you forget
* [Post-Quantum SSH Algorithms](/authentication/post-quantum-ssh-algorithms) — the *transport* protocol's PQ story
# Where Tempest Stores Your Credentials
Where Tempest stores secrets per platform — Keychain (macOS), Credential Manager (Windows), Secret Service (Linux) with in-memory fallback.
When Tempest needs to remember a secret across restarts — your vault unlock key, OAuth tokens, the device push token — it uses the **operating system's secure credential store**. Each platform has its own; Tempest picks the right one automatically. This page explains exactly what gets stored where and how the fallback behaves on systems without a usable keystore.
(For how vault contents themselves are encrypted before sync, see [End-to-End Encryption](/account-and-privacy/end-to-end-encryption). This page is about local secret storage.)
## What Tempest stores locally
| Item | Why it's stored |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| **Vault unlock key** (or a wrapped form of it) | So you don't have to type your vault password on every launch |
| **Sync session token** | To keep you signed in across app restarts |
| **Device push token** | Long-lived per-device token used by Tempest Push (desktop) |
| **OAuth2 refresh tokens** | Renew sync sessions without re-typing credentials |
| **Per-host credentials** flagged as *"save in keychain"* (optional, opt-in) | So you can choose to skip vault-level encryption for low-risk hosts |
Everything else (your hosts, snippets, SSH keys, certs) lives inside the encrypted vault — see [End-to-End Encryption](/account-and-privacy/end-to-end-encryption).
## Per-platform storage
### macOS — Keychain
Tempest stores secrets in the **macOS Keychain** under the service name `app.gotempest.tempest`. Secrets are protected by your macOS login password and (where available) Touch ID / system biometrics.
To inspect: open **Keychain Access.app** → search for "tempest".
### Windows — Windows Credential Manager
Tempest stores secrets in **Windows Credential Manager** (the same store used by Microsoft Edge, Outlook, and most Win32 apps). Secrets are protected by your Windows account password and DPAPI.
To inspect: **Control Panel → User Accounts → Credential Manager → Windows Credentials** → entries prefixed with `tempest`.
### Linux — Secret Service (libsecret)
Tempest uses the **freedesktop Secret Service API** — implemented by **GNOME Keyring** (default on GNOME, Cinnamon, Unity) or **KWallet** (default on KDE Plasma).
If you're running a desktop environment that ships either, you don't need to do anything. Tempest secrets show up in:
* `seahorse` (GNOME Keyring viewer)
* KWallet Manager
#### **In-memory fallback when no keystore is available**
Some Linux setups have no Secret Service:
* Minimal window managers (i3, sway, dwm, awesome) installed without GNOME Keyring or KWallet
* Headless servers (no DBus session)
* Some restricted enterprise installs
In these cases, Tempest **falls back to an in-memory secret store**. This means:
* **You'll be prompted to enter your vault password every time Tempest starts.**
* Sync session tokens are lost on restart, so you'll re-sign-in to your account too.
* OAuth2 refresh tokens aren't persisted — same caveat.
This is intentional — writing secrets to a plaintext file on disk would be a worse outcome. To enable persistent secret storage, install a Secret Service implementation:
```bash
# Most desktop distros
sudo apt install gnome-keyring # or libsecret-tools
# Or for KDE
sudo apt install kwalletmanager
```
After install, restart Tempest. It'll detect the new keystore and start using it for the next session's secrets.
### Web Mode (browser)
When Tempest runs in [Web Mode](/deployment/self-hosted-tempest-server), there's no OS keystore the browser can write to. Instead:
* Vault unlock key lives in **session storage** — cleared when you close the tab.
* Sync session token lives in a **secure HTTP-only cookie** scoped to your Tempest server.
You'll need to re-enter your vault password each time you open Tempest in a new browser session. This is by design — browsers are too varied an environment to guarantee a secure persistent secret store.
### iOS / Android
Mobile platforms have first-class secure storage:
* **iOS** — **Keychain Services**, hardware-backed by the Secure Enclave when available.
* **Android** — **Android Keystore**, hardware-backed by StrongBox / TEE on supported devices.
Both are Tempest's default; no fallback is needed.
## How to wipe stored credentials
If you want to remove all Tempest secrets from the OS keystore:
| Platform | Action |
| ------------- | --------------------------------------------------------------------- |
| macOS | Keychain Access → search `tempest` → delete entries |
| Windows | Credential Manager → Windows Credentials → delete `tempest:*` entries |
| Linux (GNOME) | `seahorse` → Login keyring → delete `tempest:*` entries |
| Linux (KDE) | KWallet Manager → kdewallet → delete `tempest:*` entries |
| iOS / Android | Uninstall the app — secrets are scoped to the app's keychain entry |
After wiping, your next Tempest launch starts cold: you'll re-enter your vault password and sign in to sync again.
## Security notes
* Tempest never writes secrets to plaintext files or to its own SQLite database. Secrets are *always* either in the OS keystore or in process memory.
* On macOS / Windows / iOS / Android, the keystore is hardware-protected (Secure Enclave / TPM / StrongBox where available).
* On Linux, security depends on your Secret Service implementation. GNOME Keyring and KWallet both encrypt secrets at rest under your login password.
* The in-memory fallback (Linux without keystore) is *less convenient* but *not less secure* — it just means you re-authenticate on every launch.
## See also
* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption) — how the vault contents themselves are encrypted before sync
* [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy) — the high-level security overview
* [Reset Your Tempest Password](/account-and-privacy/resetting-password) — sync vs. vault password explained
# Reset Your Tempest Password (Sync Account & Vault)
How to reset your Tempest sync account password and your end-to-end-encrypted vault password — and what to do if you've lost the vault password entirely.
Tempest has **two separate passwords**:
1. **Sync account password** — authenticates you with the Tempest cloud sync service.
2. **Vault password** — encrypts your hosts, keys, and snippets locally before sync. This password never leaves your device, which is why end-to-end encryption works — but it also means **we cannot recover it for you**.
## Reset the sync account password
You can reset this any time at . You'll need it to sign in on a new device.
## Reset the vault password (you still have access)
If you're already signed in and remember your current vault password:
**Settings → Account → Change Vault Password**
Enter the current password, then set a new one. The vault is re-encrypted in place; no data is lost.
## Vault password lost — recovery options
The vault password is non-recoverable by design. If you've forgotten it, contact support at . We can wipe the encrypted vault on the server so you can set a new password — **but all previously synced data will be permanently lost** (because we never had the keys to decrypt it).
If you still have a device where Tempest is signed in and unlocked, copy the most important hosts and credentials out manually before triggering the reset.
This is the trade-off of true zero-knowledge end-to-end encryption: see [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy) for the cryptographic details.
# Termius vs MobaXterm vs PuTTY vs iTerm2: SSH Clients Compared 2026
Termius or MobaXterm? PuTTY or iTerm2? Side-by-side 2026 comparison of the top SSH clients — platforms, price, FIDO2 & post-quantum auth, AI, E2EE sync — and how Tempest stacks up against all of them.
A factual comparison of the most popular SSH clients — Termius, MobaXterm, PuTTY, and iTerm2 — side by side with Tempest. Several of the classic SSH clients are platform-locked (PuTTY = Windows + Linux, iTerm2 = macOS, MobaXterm = Windows), which makes cross-platform support the first axis to compare on.
Download Tempest Free
## At a glance
| | Tempest | Termius | MobaXterm | PuTTY | iTerm2 |
| ------------------------------------- | --------------------------------------------- | ----------------------------------- | -------------------- | ------------------------ | ---------------------------- |
| **Platforms** | macOS · Win · Linux · iOS · Android · **Web** | macOS · Win · Linux · iOS · Android | **Windows only** | Windows · Linux | **macOS only** |
| **Native FIDO2 / YubiKey SSH** | ✅ | ✅ | ❌ | ❌ | Inherits from system OpenSSH |
| **OpenSSH certificate auth** | ✅ | ✅ | ❌ | ❌ | Inherits from system OpenSSH |
| **Post-quantum SSH (PQ KEX)** | ✅ default — ML-KEM + SNTRUP761 | ✅ | ❌ | ✅ | Inherits from system OpenSSH |
| **Zero-trust platform presets**¹ | ✅ one-click wizard | ❌ | ❌ | ❌ | ❌ |
| **Self-hostable sync server** | ✅ | ❌ | n/a | n/a | n/a |
| **Browser-based access (Web Mode)** | ✅ | ❌ | ❌ | ❌ | ❌ |
| **AI assistant** | ✅ — Claude / GPT / Gemini / self-hosted | ✅ — Termius AI Agent + Gloria | ❌ | ❌ | ❌ |
| **E2EE sync** | ✅ zero-knowledge | ✅ zero-knowledge | ❌ (no built-in sync) | ❌ | ❌ |
| **SFTP file manager** | ✅ | ✅ | ✅ | ❌ (separate PSCP) | ❌ |
| **Mosh** | ✅ | ✅ | ❌ | ❌ | ❌ |
| **Telnet · RCON · Serial** | ✅ | ⚠️ Telnet · serial | ⚠️ Telnet · serial | ⚠️ Telnet · serial · raw | ❌ |
| **S3 / WebDAV / FTP** | ✅ | ❌ | ⚠️ FTP/SFTP only | ❌ | ❌ |
| **Windows Remote Desktop(RDP) / VNC** | ✅ (All Platforms) | ❌ | ✅ (Windows Only) | ❌ | ❌ |
| **Perpetual License** | ✅ | ❌ | ✅ | Free | Free |
| **Pro pricing** | $4.99/mo annual (limited discount) | $10/mo annual | $69/user/yr | Free | Free |
¹ Built-in setup wizards for **Teleport, Cloudflare Access, AWS SSM Session Manager, GCP IAP TCP forwarding, and Tailscale**. See [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale).
Download Tempest Free
## When to pick each one
### Termius
Cross-platform (macOS, Windows, Linux, iOS, Android), E2EE sync, AI assistant, native FIDO2, OpenSSH cert auth, claimed PQ KEX support.
Differences from Tempest:
* **Zero-trust platform integrations** — Tempest ships one-click wizards for Teleport, Cloudflare Access, AWS SSM, GCP IAP, Tailscale. Termius does not.
* **Web Mode** — Tempest runs in a browser via a self-hosted server. Termius is desktop/mobile only.
* **Self-hosted sync** — Tempest's sync server can run on your own infrastructure. Termius requires their cloud.
* **PQ algorithm transparency** — Tempest allows users to choose specific algorithms (`mlkem768x25519`, `sntrup761x25519`).
* **Pricing** — Termius Pro is $10/month annual; Tempest Pro is lower.
* **Truly cross-platform.** Tempest gives you the *same* core feature set on desktop and mobile.
* **Maturity** — Termius has a larger user base and longer-running mobile apps.
### MobaXterm
Windows-only multi-protocol client (SSH, RDP, VNC, Telnet, FTP) with a bundled X server and Cygwin-style Unix toolset. Home Edition is free for single-user installs; Professional is $69/user/year subscription (changed from perpetual in 2024).
Differences from Tempest:
* **Platform** — MobaXterm is Windows-only. Tempest runs on macOS, Windows, Linux, iOS, Android, and the web.
* **Modern auth** — MobaXterm's UI doesn't surface FIDO2, OpenSSH certs, or PQ KEX configuration; it inherits whatever its bundled OpenSSH supports.
* **AI assistant** — MobaXterm has none.
* **Zero-trust presets** — MobaXterm has none.
* **E2EE sync** — MobaXterm has no built-in sync (settings live in `MobaXterm.ini`).
* **X server** — MobaXterm bundles one. Tempest does not (use XQuartz / VcXsrv / WSLg).
* **Bundled Unix toolset** — MobaXterm includes Cygwin tools. Tempest assumes the OS provides them.
### PuTTY
MIT-licensed, free. Runs on Windows and Linux (no native macOS). Has post-quantum KEX (SNTRUP761 since v0.78, ML-KEM since v0.83). No native FIDO2 in mainline (PuTTY-CAC fork adds smart-card auth).
Differences from Tempest:
* **Platform** — PuTTY runs on Windows and Linux. Tempest also runs on macOS, mobile, and the web.
* **Host inventory** — PuTTY's session list is flat with no grouping, tagging, or search. Tempest has a structured inventory with groups, tags, snippets.
* **SFTP** — PuTTY ships PSCP / PSFTP as separate command-line tools. Tempest has an integrated SFTP file manager.
* **Modern features** — Tempest has FIDO2, OpenSSH certs, AI, sync, monitoring, port-forward UI, jump-host UI. PuTTY mainline has none of these.
* **Distribution** — PuTTY is a small single-purpose binary with no account or sync component. Tempest is a larger application that includes optional account-based sync.
### iTerm2
macOS-only terminal emulator. Not strictly an SSH client — relies on the system `/usr/bin/ssh` for the protocol, inheriting whatever that build supports (FIDO2 if installed via Homebrew OpenSSH, PQ KEX in newer versions).
Differences from Tempest:
* **Platform** — iTerm2 is macOS-only.
* **Host inventory** — iTerm2 has none. Hosts are managed in `~/.ssh/config` directly.
* **Built-in features** — iTerm2 doesn't include SFTP browsing, sync, AI, vault, monitoring, zero-trust presets. It's a terminal emulator that happens to launch shells.
* **Terminal-emulator features** — iTerm2 includes shell integration, image rendering protocols, and tmux integration. Tempest's terminal does not implement these.
### SecureCRT
VanDyke SecureCRT runs on Windows, macOS, and Linux. Per-seat pricing is roughly $110 plus $35/year maintenance. Includes scripting in VBScript, Python, and JavaScript, and supports terminal emulations such as TN3270, TN5250, Wyse, and SCO ANSI.
Differences from Tempest:
* **Pricing** — Tempest Pro is lower than SecureCRT's per-seat license + maintenance.
* **Mobile, Web, AI, zero-trust presets, native FIDO2, PQ KEX, E2EE sync** — present in Tempest, not in SecureCRT.
* **Scripting depth** — SecureCRT exposes VBScript / Python / JavaScript automation APIs. Tempest's snippets and scheduled runs cover ad-hoc fan-out but do not match SecureCRT's scripting surface.
* **Terminal emulations** — SecureCRT supports legacy mainframe and minicomputer terminal types (TN3270, TN5250, Wyse) that Tempest does not implement.
## Migrating from another client
Use Tempest's **Import Servers** feature.
## See also
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale)
* [Post-Quantum SSH Algorithms](/authentication/post-quantum-ssh-algorithms)
* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption)
# Release Notes for Tempest Desktop
What's new in Tempest for Windows, macOS & Linux — full desktop release notes with every version's new features, improvements, and bug fixes.
### v3.14.0
#### New Features
* Added HashiCorp Vault support for SSH credentials — read keys from Vault KV v2 or have Vault sign SSH certificates, with a built-in connection test
* The SSH host list now supports multi-select and bulk editing, so you can update many hosts at once
* Remote Desktop (RDP) gains client-rendered cursors, remote-to-local clipboard text, and clipboard file transfer
* The SFTP file manager now shows native system file icons, a Kind column, and Reveal in Finder/Explorer
* The file manager and Shell History are now virtualized lists with resizable, hideable columns that remember your layout
* Copilot shows a live context-usage meter with per-model token limits, so you can see how much of the window a conversation is using
#### Improvements
* Replaced the code editor with a lighter in-house build for faster loading and lower memory use
* Much smoother rendering with many panels open — hidden panels are no longer rendered or fed data, and the command palette no longer re-renders the whole window
#### Fixes
* Fixed OSC 8 terminal hyperlinks not opening in the browser
* Fixed native folder and file-type icons on Windows and Linux
* Fixed standalone SFTP panels borrowing the host of the focused terminal
* Fixed the Settings tab occasionally getting stuck on a loading spinner, and settings occasionally failing to save
* Fixed command palette entries disappearing after leaving the settings panel
* Fixed local terminals occasionally spinning in a render loop
* Fixed a newly generated private key not being visible in the key edit form
* Fixed a silent connection failure on Vault-authenticated SSH hosts
### v3.13.3
#### New Features
* Remote Desktop (RDP) connections now support SOCKS5/HTTP proxies, matching what SSH already offered
* Added a Shell History panel to the session dock, showing your terminal's command history (bash/zsh/fish/PowerShell) with search
#### Improvements
* SSH connections to servers with strict session limits no longer freeze for up to a minute while secondary features (SFTP, monitor) fail silently in the background
* When a server doesn't support certain SSH features, Tempest now remembers that and stops retrying, with a clear notification instead of repeated delays
* Additional password and secure FTP/S3/WebDAV transfers are now part of the Pro plan
#### Fixes
* Fixed Remote Desktop sessions showing stale or corrupted screen content after a window resize on certain servers
* Fixed dropped screen updates on Remote Desktop connections under slow or unstable network conditions
* Fixed a form bug where a previously shown validation error could block saving an SSH/Telnet server even after the underlying issue was fixed
### v3.13.2
#### New Features
* Added SSH agent forwarding with three modes — off / system / Tempest Keychain
* Added more color schemes
* Added compact display mode for SSH host list
* Added sudo password support: send the sudo password directly from the terminal or the SSH Monitor panel for privileged actions
* Reworked the SSH Monitor panel into a tabbed layout with port listing, process termination, and Docker container actions, including Docker port mappings
* Added Dock/taskbar right-click actions and proper deep-link handling on cold app start
* Added self-hosted server support
* The AI command-safety firewall can now be centrally configured and overridden by server policy
* Added AI prompt and secret snippet types
* Completed full localization of the desktop UI
* Allow team admins to assign entitlements in the webui
#### Improvements
* Server edit form redesigned as a two-column layout; private keys are now shown redacted; minor snippet dialog refinements
* The personal vault option is automatically hidden when disabled by the server
* Terminal windows now wait for the GPU to go idle before releasing resources, reducing occasional stutters/crashes
* Cleaned up connection-multiplexing text and logic reuse
#### Fixes
* Fixed deep links being lost on cold app start
* Fixed cloned documents (servers/snippets) carrying over stray database metadata
* Fixed compatibility errors when upgrading data with legacy agent-forwarding/boolean fields
* Fixed a theme-settings crash on windows without a title bar overlay
* Fixed an occasional crash during update checks and sourcemap upload ordering
* Fixed several SSH session-stability issues reported recently
### v3.13.0
#### New Features
* Brand-new launch splash screen
* Open ssh:// and rdp\:// links directly from your browser or other apps
* RDP: hardware-accelerated H.264 video decoding on Windows, Linux, iOS, and Android for noticeably smoother remote desktop sessions
* RDP: certificate verification
* File Manager: Windows drive picker and a redesigned toolbar for faster navigation
* Copilot: send images and file attachments on ACP, and let the AI read and save reusable skills in Tempest Drive
* Reconnect to SFTP and monitoring sessions manually
#### Improvements
* Faster, more reliable SSH connections thanks to a rebuilt connection engine
* Better handling of SSH two-factor/MFA authentication
* More consistent connections across the app, reducing stuck "connecting" SFTP
* Copilot input now supports history navigation with up and down arrow keys
#### Fixes
* Fixed SFTP sidebar occasionally hanging or getting stuck on "connect a host first"
### v3.12.10
#### New Features
* Added "Run as Administrator" option for local shells on Windows
* SSH/Telnet connections now support per-host character encoding (GBK, Big5, and other legacy charsets)
* Import SSH host lists in bulk from an xlsx file
#### Improvements
* Upgraded terminal link detection to use the new terminal rendering engine
* Refined title bar layout with responsive design
### v3.12.9
#### New Features
* SFTP-only bastion handoffs now open straight into a File Manager pane for instant file browsing
#### Improvements
* Windows builds are now digitally signed, no more SmartScreen warnings during installation
* AI agent tools are now better at reusing your existing sessions instead of opening duplicate connections
#### Fixes
* Fixed a crash caused by lingering SFTP file handles when a connection was dropped unexpectedly
* Fixed SFTP handoffs from bastion portals occasionally failing protocol negotiation
### v3.12.7
#### New Features
* Mosh is now free for everyone — no longer a Pro-only feature.
* Monitor now shows a Docker containers section alongside system stats.
* Launch SSH sessions directly from external ssh:// URLs.
#### Improvements
* Port forwarding: listen/bind address is now editable, and forwards are grouped by host for easier management.
* Port forwarding: clearer icons and improved labeling for each forward type.
* Copilot: assistant replies now use the full width, with tool calls collapsed by default for a cleaner chat view.
* Copilot: messages sent while a task is running are now queued, with the ability to steer mid-task.
* Smoother, more reliable input during remote desktop sessions (RDP/VNC).
#### Fixes
* Fixed a crash and garbled input when pasting long or fast text into RDP/VNC sessions.
* Fixed an issue where local port forwarding only bound to one address instead of all resolved addresses (affecting localhost/IPv6 coverage).
* Fixed a memory/connection leak in the system monitor.
* Fixed a file transfer issue that could exhaust session limits during heavy SFTP use.
* Fixed focus tracking when switching between split panes in Copilot.
### v3.12.5
#### Improvements
* Full-screen terminal apps (vim, tmux, htop, and other TUIs) now fill the entire pane edge-to-edge — the leftover gutter around the grid is gone.
#### Fixes
* The Copilot chat box again responds to / and @ shortcuts (a duplicate editor engine was breaking the command menu).
* No more white flash when resizing the window in dark mode on macOS and Windows.
### v3.12.4
#### New Features
* Clearer, more helpful error messages when a Remote Desktop (RDP) connection fails
#### Improvements
* More reliable saving of hosts and settings
* Hardened the native connection engine
* Connections to custom AI providers now always require valid TLS certificates
#### Fixes
* Fixed RDP connections to GNOME Remote Desktop failing to connect
* Fixed VNC sessions freezing silently on connection errors
* Fixed terminal rendering issues on systems where the GPU is unavailable
* Fixed AI Copilot occasionally reporting spurious errors when sending messages
* Fixed various crashes and error-handling issues for improved overall stability
### v3.12.3
#### New Features
* Remote Desktop clipboard sync — copy and paste text both ways between your local machine and the remote desktop
* Remote Desktop control bar — send Ctrl+Alt+Del in one tap, and quickly paste or type clipboard contents
* Remote cursor — the remote desktop's pointer shape and position now sync in real time
* Terminal header actions — new "New Terminal" dropdown, "Close all", and an overflow menu for additional actions
* Telemetry opt-out toggle and the third-party analytics component have been removed
* aarch64 support for Windows and Linux
#### Improvements
* Remote Desktop now supports adjustable wire quality (Low / Medium / High)
* New rendering pipeline for sharper, smoother Remote Desktop streaming
* More stable streaming over weak connections
* Added an "Ignore certificate errors" option for S3, WebDAV, and custom AI providers
#### Fixes
* Fixed stuck modifier keys in Remote Desktop (Ctrl/Alt/Shift staying "held" after release)
* Fixed the file manager hanging on connect when a certificate or authentication check failed
* Improved terminal view stability to prevent occasional crashes
* Hardened SSH connection resource cleanup and mosh network error handling
### v3.12.2
#### New Features
* **Configurable default shell** — the terminal button (and Cmd/Ctrl+T) now launches the shell you pick in Settings → General → Default Shell, with a quick-launch menu of your saved local shells.
* A new sidebar panel to view and join active collaboration sessions.
* **Multiple Full-Screen Copilot panels** — open as much as you want AI Copilot panels, with separate chat and thread-list navigation.
#### Improvements
* Collaboration now negotiates one shared terminal size across all shareable session types, keeping every participant's screen in sync.
* Redesigned Kubernetes list to match the host list, with a new kubeconfig editor and right-click actions (connect / edit / delete).
* Updated translations across all locales.
#### Fixes
* Improved SSH/Mosh stability by eliminating several crashes on the disconnect path.
* Fixed terminal focus not landing correctly after opening a panel.
### v3.12.1
#### New Features
* **Command Palette** — A new quick‑open palette (⌘/Ctrl+Shift+P) to instantly find and run any command, jump to hosts, open sessions, and Kubernetes contexts. Use ⌘/Ctrl+Shift+F to search hosts. Menu actions appear with their keyboard shortcuts and run right from the palette.
#### Improvements
* Terminals now support program‑driven clipboard copy (OSC 52) and track the current working directory and shell prompts more reliably.
* The host list or Copilot automatically focuses the search box / input.
* Tab‑cycling and ⌘/Ctrl+Number pane shortcuts are now applied to any group.
* Tab and jump keyboard shortcuts now work consistently on Windows and Linux.
* The "Plan Upgrade Required" prompt can now be dismissed with "Upgrade Later".
* Diagnostic log files are now automatically pruned to keep disk usage in check.
#### Fixes
* File Manager no longer shows an error toast for handled SFTP errors.
* "Create Vault" now opens the correct vaults page.
### v3.12.0
#### New Features
* AI Copilot now supports external coding agents — connect **Claude Code, Codex, OpenCode, Cursor, and Qwen** directly inside Tempest and drive them for long tasks from the chat panel.
* Pick your AI model — new provider system with a model picker, live usage ring, and free-tier access to built-in Storm AI.
* Run multiple Copilot conversations in parallel, each with its own provider and live status.
* Copilot can read and edit files — both locally and over your active SSH session — and run commands with per-action approval.
* Slash commands & @host mentions in chat — type / for agent commands and @ to pick a saved host and auto-connect.
* Open remote files in your default desktop app — edits are watched and automatically uploaded back over SFTP on save.
* Fixed Tab Title setting — pin a custom title to a terminal tab.
* New keyboard shortcuts — Ctrl+Tab to cycle sessions and a shortcut to toggle the Copilot panel.
#### Improvements
* Redesigned AI settings with brand logos and clearer sections
* Theme selection (Light / Dark / System) moved into Appearance settings.
* Polished the Copilot input UI
* External-agent conversations now resume when you reopen them.
* Rate-limited (429) requests now fail fast instead of hanging.
#### Fixes
* "Copied" now only appears when a clipboard write actually succeeds.
* Cmd+C now works correctly inside DevTools.
* Fixed the Windows SFTP upload dialog only showing folders.
* Fixed an SSH crash caused by a double-free of forwarded channels.
* Surface a clear error toast when an external agent fails to start.
### v3.11.0
#### New Features
* Remote Desktop (RDP & VNC): Connect to Windows machines over RDP and Linux/macOS over VNC directly from Tempest
* Snippet & Host Folder Browsing: Browse host and snippet folders with drag-and-drop organization and a unified edit dialog
* Copilot: Bypass Permissions Mode: Let Copilot automatically approve run\_command calls without prompting, for faster automated workflows
* Copilot: Read-Only Observation Mode: Copilot can now observe your terminal session without issuing commands
* SFTP Upload Picker: Web-mode file upload now supports multi-file selection and a go-to-path field
* Protocol Icons: Server form now shows a visual icon-grid picker instead of a dropdown for protocol selection
#### Improvements
* Copilot: @-Mention Navigation: Tab / Shift+Tab now cycles through @-mention suggestions in the Copilot input
* Copilot Mode Renamed: "Agent mode" is now called "Ask Permissions" for clarity
* App Security: ASAR integrity verification enabled for the Electron app bundle
#### Fixes
* Fixed Cmd+Z (undo) not working in text fields due to a custom menu entry overriding the native role
* Fixed Ctrl+Shift+V triggering a double-paste
* Fixed SSH fingerprint dialog not receiving keyboard focus on open
* Fixed SFTP bookmark not saving when editing an existing connection
* Fixed terminal link highlight extending beyond the correct range on wrapped lines
### v3.10.2
#### New Features
* Folder Upload — Upload entire folders to your server via drag-and-drop or the upload button
* Recursive Folder Download — Download entire directories over SFTP with per-file progress and speed indicator
* Show/Hide Hidden Files — Toggle visibility of dotfiles and hidden entries in the file manager
#### Improvements
* The app remembers your paste preference (bracketed vs. direct) and Ctrl+V now routes through the same flow consistently
* SFTP errors now display human-readable descriptions instead of raw error codes
#### Fixes
* Fixed terminal textarea not auto-focusing when switching or opening tabs
* Fixed terminal not correctly intercepting Ctrl+V for multiline paste
### v3.10.1
#### New Features
* Collaboration sessions now share the host's server name and tab title with connected guests
* Auto-share Terminals — New terminal tabs are automatically shared with your other signed-in devices during a collaboration session
#### Improvements
* Added an option to suppress the multiline paste confirmation dialog
#### Fixes
* Fixed an issue where port forwarding tunnels could fail to establish in certain cases
* Fixed incorrect link highlight range in wrapped terminal lines
* Fixed SFTP bookmarks not saving correctly
* Fixed port number type coercion for SSH, Rcon, and Telnet connections
### v3.10.0
#### New Features
* Real-time collaboration: share a terminal session with teammates with end-to-end encryption, in-session chat, host moderation (kick / mute), and cross-account invites via link.
* Three access modes for shared sessions: full collaborator, read-only, and link-only view — with read-only enforcement and a friendlier UX when an invite is incomplete or you've been removed.
* Dual-pane file manager: a new built-in file manager with local file system, cross-pane drag, group actions, and full Windows path support.
* Drag files in and out of the app: drag files out to Finder / Explorer via native OS drag, and drag files onto a terminal to paste their path.
* Sign in with device code: new RFC 8628 device-flow login, so the desktop app, CLI, and MCP server all share the same sign-in flow.
* Workspace tab context menu: right-click any tab in the workspace for quick actions (close, close others, etc.).
#### Improvements
* Terminal auto-focuses when you switch tabs or open a new one — start typing immediately.
* Unified right-click menus across the app for a more consistent feel.
* Faster, smaller crypto pipeline: renderer now uses a single Rust/WASM crypto module, dropping legacy JS dependencies.
#### Fixes
* Copilot: workaround for models that emit empty reasoning\_content, preventing stuck responses.
* Windows: fixed an issue that affected SSH socket close.
* MCP read\_buffer: clearer fallback hint when the buffer is unavailable.
### v3.9.0
#### New Features
* **Shared Team Vaults** — securely share saved hosts and credentials with teammates; manage members and per-vault access from the new Vault Settings dialog.
* **Multi-Session AI Copilot** — Copilot can now work across several terminal sessions at once; @-mention a session to target it, and control which sessions Copilot is allowed to act on.
#### Improvements
* Upgraded vault encryption (v3), with automatic, seamless migration from older vaults.
* Redesigned Copilot chat: cleaner message rendering, click-to-copy code blocks, and an always-visible terminal status badge.
* More reliable terminal automation — Copilot reads command output and screen state more accurately.
* Click a URL in the terminal to copy it, even when it wraps across multiple lines.
#### Fixes
* Fixed SSH authentication failures caused by probing auth methods before the username was resolved.
* Port-forwarding rules now save reliably and show clear error messages when something goes wrong.
* Credentials are now isolated per account — fixed stale keys carrying over after account switches or sign-out.
* Fixed cloud invites failing silently when the sign-in session had expired.
* Fixed occasional crashes when resizing the terminal.
* Polished localization for the setup and upgrade screens.
### v3.8.2
#### New Features
* **Native ZMODEM transfer** — `rz` / `sz` now run on a built-in Rust implementation, replacing the old JavaScript library. Faster, more reliable transfers with fewer hangs and corruption edge cases.
* **Recording auto-upload** — When a enterprise shared vault enforces session recording, terminals now record automatically and the file is queued for upload to your Tempest workspace when the session ends.
* **Tempest Cloud for Session Recording** — After you stop a recording manually, choose whether to upload it to your workspace or keep it on disk.
* **Vault permission tiers** — Vault membership now distinguishes "view credentials" from "edit". Host list, keychain, port forwarding, and Kubernetes entries are read-only for view-only members.
#### Improvements
* **Selection toolbar** — Selecting text in the terminal automatically reveals the copy/share toolbar.
* **Clearer AI Agent warnings** — Improved wording when an AI Agent action is blocked or needs confirmation in a terminal session.
#### Fixes
* Fixed AI tool calling may fail in the last version.
### v3.8.0
#### New Features
* Reworked on our MCP server, and Copilot can now attach to your live SSH session. It sees what's on your screen and can run commands right there with you, like a pair-programming partner.
* Removed Tempest Smart Shell. By default, it's already smart enough!
* Record terminal sessions. Hit record on any SSH, Telnet, Mosh, Kubernetes, or local shell tab and save the whole session as a replayable file. Great for sharing reproductions, demos, or audit trails. (Pro)
* Introducing Tempest CLI. SSH into synced hosts, browse and copy files, pick servers from a TUI, and act as an MCP server for your own AI tools. Install it to your PATH with `tempest install-cli`.
* Telegram and Discord notifications. New push channels alongside the existing ones.
#### Improvements
* Local shell on Windows is dramatically better. Rebuilt on a new terminal engine — fewer hangs, correct exit codes, proper argument quoting.
* Smarter Copilot tool routing — fewer misfires and stalls when the model picks the wrong action.
* Refreshed terminal right-click menu with a tidier set of actions.
* Search bar consolidated into a single button group for a cleaner look.
* Settings → Social links now stay up-to-date without needing an app update.
#### Fixes
* SFTP editor: Cmd/Ctrl+S now actually tells you when a save fails, and uploads now reliably finish before reporting success.
* Closing a Telnet tab now properly tears down the session.
* The close button of notification banners no longer accidentally hijack the title-bar drag area.
* Languages: confirmation dialogs and toasts now respect your selected UI language.
### v3.7.0
#### New Features
* Customizable SSH agent socket path
* SSH certificate authentication support
* SSH Jump Host with recursive multi-hop chaining and per-hop fingerprint verification
* SSH Keepalive to maintain active connections (default 60s interval)
* Built-in iPerf3 network speed test tool
* Support Claude Code, Codex, Gemini and OpenCode startup commands
* Support Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale via proxy command
* Full screen SFTP and other file manager
* FTP file manager with unified file management experience
* S3 / WebDAV file manager
* NerdFont Mono fonts bundled with live preview in the font selector
* Telnet and RCON protocol support
* SSH environment variables passed to remote sessions
* Terminal bell sound, terminal type, and scrollback buffer settings
* Additional language options and translations
#### Improvements
* Auto-select basename (without extension) when renaming files
#### Fixes
* Fixed potential crash when closing Mosh connections
* Fixed errors
### v3.6.1
#### New Features
* Native RCON & Telnet protocol support — fully rewritten in Rust, no longer relies on system binaries
* Proxy authentication for HTTP (Basic Auth) and SOCKS5 (RFC 1929)
* SSH environment variables — send custom env vars to the remote server
* Terminal bell sound support
* Configurable terminal type and scrollback buffer size
* Self-hosted server support — configure your own Tempest server on the welcome screen
* In-app changelog — automatically shown on version update, also accessible from Settings
* WebSocket auto-reconnect with disconnect/reconnect notifications (web mode)
#### Improvements
* Redesigned SSH host list with protocol labels, color indicators, and connection strings
#### Fixes
* Fixed SFTP file editor opening before download completed
* Fixed error when opening many sessions simultaneously
* Fixed font preload errors on platforms with limited API access
* General stability improvements and dependency updates
### v3.5.4
#### New Features
* Tempest Push — receive snippet and scheduled-run notifications on your other devices, per-device opt-in
* SFTP Properties dialog with chmod / chown editing, plus owner / group / size display
* SFTP now opens in the remote home directory on first connect, with an inline error panel when access fails
* Configurable AI temperature in settings
#### Improvements
* Faster, more reliable background jobs: scheduled snippets, notifications and SFTP transfers now run through a unified native job queue and keep working even when the UI is closed
* SFTP download / upload use native system file dialogs with proper progress
* Clearer titles and subtitles for every running task in the Task screen
#### Fixes
* Crash fix in the native SSH library
* AI notification loop and snippet progress reporting fixed
### v3.5.3
#### New Features
* New Notification system with Webhook, Pushover and SMTP channels
* Snippet Scheduling with per-run configuration (env, working dir, notification channel, interval)
* AI-generated run summary, with exit code awareness so the AI decides when you actually need to be notified
* Snippet language selector for cross-shell execution
#### Improvements
* Unified Ask / Agent into a single AI pipeline with a cleaner tool set and rewritten prompts
* AI summary now includes the current system time for more accurate reporting
#### Fixes
* File drag-and-drop into the terminal works again on recent Electron versions
* Snippet output marker extraction no longer matches the echoed command itself
### v3.5.2
#### New Features
* Port forwarding list redesigned as a table with inline validation
* Your local IP is shown in the port forwarding UI for quick copy
* Multi-select in the SSH host list for bulk actions
* "Send to current terminal" button in the Snippet screen
* Snippet toolbar actions consolidated into a cleaner dropdown menu
### v3.5.1
#### New Features
* Detect remote shell and OS automatically; distro logo and CPU model now show in SSH Monitor
* Snippets can run on Windows cmd.exe / PowerShell with the right syntax per shell
#### Improvements
* Auto-focus the Name field when editing a host
#### Fixes
* No more orphan SSH / PTY processes left running after quitting the app
* FIDO2 / Security Key regression fixed (libfido2 1.16.0)
### v3.5.0
#### New Features
* Mosh protocol support on macOS and Linux
* SSH session import — import sessions from SSH Config, Xshell, MobaXterm, and PuTTY
* Post-quantum cryptography (PQC) algorithm support with preset selector for SSH connections
* Security Key (FIDO2/YubiKey) authentication with PIN prompt support
* SSH security screen — view negotiated algorithms and connection security details
* Keyboard-interactive authentication support with multi-round prompt
* SSH connection retry with automatic reconnect
* SFTP async I/O with prefetch pipeline for significantly faster file transfers
* SSH zlib compression support
* "None" authentication method for password-less SSH servers
* Terminal text selection pill menu
* Clear the terminal buffer with a keyboard shortcut
* Search in snippet and keychain screens
#### Improvements
* Redesigned port forwarding UI with flow preview
* Redesigned empty state UI across all screens
* Redesigned keychain UX with "Load from file" for private key import
* Backspace behavior setting for SSH connections
* Support more SSH algorithms
* Connection multiplexing stability improvements with auto-reconnect on channel limit
* Updated translations
#### Fixes
* Fixed reversed TX/RX network statistics display
* Fixed connection multiplexing channel limit causing disconnects
* Fixed database switch race condition
* Fixed memory chart segment ordering (used → cache → free)
* Fixed Windows DPAPI support for credential storage
### v3.4.0
#### Features
* AI/Copilot was reworked into clearer agent modes (local ask/local agent/codex) with updated AI settings and Codex toggle flow.
* Added MCP server.
* Added command approval in Copilot to gate risky command execution.
* Introduced Crypto v2 upgrade.
* Expanded SSH security capabilities: fingerprint trust/persistence unification, algorithm selection, and X11 socket support.
* Added SFTP bookmarks (Pro).
* Added unified task pane/task manager for SFTP and command-related progress tracking.
* Improved Snippet: title, sorting, smarter execution options, and stronger script-run pipeline.
* Added key type support in key generation/keychain flows (RSA/ECDSA/Ed25519 related support across stack).
#### Fixes
* Fixed multiple Copilot reliability issues: duplicate chat history, stuck command execution, reject-state non-response, and command output handling.
* Fixed BYOK-related behavior.
* Fixed sync/vault edge cases.
* Fixed SFTP issues: special-character upload handling, transfer progress/error reporting, cancellation channels, and navigation refinements.
* Fixed Kubernetes monitor crash and several UI regressions (panel sizing/switching, dialog behavior, scrolling/state retention).
* Fixed the copy action.
### v3.2.0
Get the latest Tempest here:
#### New Features
* SFTP file editor with tab support and unsaved-changes confirmation
* AI Copilot chat history
* AI command output summary in Copilot
* Optional SSH agent injection with confirmation per session
* Remember credentials option in connection dialog
* Removed workspace panel limits
* Performance monitor sidebar with per-core CPU usage
* Port forward host list search and sorting
#### Improvements
* Enhanced AI settings layout and tab structure
* Improved SSH agent injection feedback
* Updated upgrade feature names and descriptions
#### Bug Fixes
* Fixed missing hosts in port-forward list
* Fixed macOS mount point parsing
* Fixed settings UI glitches
* (Mobile) status bar theme
* (Mobile) process and memory usage in the performance monitor
### v3.0.0
Get the latest Tempest here:
#### New Features
* Initial AI Copilot support
* AI auto-summary after command execution
* SSH and SFTP Copilot screen
* Quick SSH connect
* SFTP file operations (create directory, sort, context menu)
* File detail display in SFTP browser
* (Mobile) Full-screen arrow gesture control for terminal navigation
* (Mobile) Text selection context menu
* (Mobile) Terminal tutorial with first-run onboarding
* (Mobile) Long-press back to disconnect session
* (Mobile) Integrated monitoring actions into host context menu
#### Improvements
* AI streaming stability and message handling
* Copilot UI text color and layout
* Emoji selector usability
* Scratch pad dynamic theme
* Desktop font loading
* Pane button spacing
* (Mobile) Improved touch handling on iPad / mobile devices
#### Bug Fixes
* Fixed prompt disappearing issue
* Fixed SFTP listener issues
* Fixed quick-connect fingerprint dialog
* Fixed key button visibility when no key configured
* Fixed TEM-168 regression
* Fixed Linux MOTD emulation
* Various UI style fixes
### v2.4.0
Download latest Tempest here:
#### New Features
* Added some languages translated by AI
* Define command for kubernetes shell
#### Improvements
* Tempest will show more info for SFTP
#### Fixes
* Fixed some error in rare case
### v2.3.3
**New Features**
* Launch SFTP by long-pressing the server in the list
* SFTP will show folders first
* (Desktop) Right-click in the terminal to paste content from the clipboard
* Now provide AppImage format for Linux distributions
**Fixes**
* Bug fixes
* Fixed false SFTP failure alarm when connecting in the desktop version
### v2.3.1
* bug fixes
* added Discord community
### v2.3.0
#### New Features
* Tempest Drive(Originally Snippet) now supports Markdown
* You can manage game servers via the RCON protocol now
* Custom AI provider
### v2.2.1(Mobile Only)
#### Improvement
* We’ve improved our in-app purchase experience.
### v2.2.0
#### New Features
We’ve improved our in-app purchase experience.\
If you experienced billing issues, please contact us at — we’re happy to make it right.
#### Improvement
* Improved the UI for the port-forwarding feature on dark mode
* Show user UID in Settings -> Account for a better support experience
### v2.1.0(Mobile Only)
#### New Features
* Search on mobile
* More control keys on mobile
### v2.0.2
* Show available updates in settings
* Fixed auto-update
* Renamed Snippets to Tempest Drive
* Allow a custom path for Serial
* Show vault name in "Unlock Vault" screen
* Fixed copy\&paste on mobile
### v2.0.0
{% hint style="info" %}
In Tempest Mobile, this version may be referred as v1.6.0
{% endhint %}
#### New Features
* Introduced the new Grid Window System.
* Displayed AI chats in the sidebar.
* Brand new UI design
#### Bug Fixes
* Fixed an issue where SFTP could not be started.
* Resolved a problem where switching vaults had no effect and always defaulted to *My Vault*.
* Fixed a crash on mobile when closing the last session from the session manager.
#### Improvements
* Moved the Compose bar to the right and repurposed it as *Copilot*.
* Added support for Lifetime subscriptions.
* Added a *Retry* button for failed sessions.
* Upgraded AI model from `gpt-3.5-turbo` to `gpt-4o-mini`.
* Enabled password visibility in the editor view.
* Introduced a smart SSH form for easier setup.
* Added support for forgetting saved fingerprints.
* Replaced the "Add New Host" sheet with a dialog.
* Added server host search functionality.
* Removed Composebox following the switch to Copilot.
* Removed `msys2` shortcut, and we will allow custom local shells soon.
* Updated clipboard behavior: content is now only copied using keyboard shortcuts, not automatically.
### v1.6.3
**Bug Fixes**
* Can't save new host
**Known Issues**
* SFTP crashes. Will be fixed soon
### v1.6.2
**Optimization**
* Upgraded Dependencies
**Bug Fixes**
* Telnet and Serial server are not shown in the main list
### v1.6.1
**Bug Fixes**
* Fixed unclear fonts in upgrade UI
* Emojis can't be saved
* Private key authentication fails
### v1.6.0
**New Features**
* Launch Tempest via `-url [`*`protocol://`*`][`*`user`*`[`*`:password`*`]`*`@`*`]host[`*`:port`*`]` command line option
**Bug Fixes**
* SSH remaining methods logic update
**Optimization**
* Upgraded Election to v35
* Upgraded React to 19
### v1.5.2
**Bug Fixes**
* Tempest icon is faulty in the GNOME dash
**New Features**
* New Santa icon for macOS and Linux
* Tempest Monitoring is available on Tempest Mobile
### v1.5.1
**Bug Fixes**
* Fixed an issue where the application could fail to start. (\[TEM-96])
* Resolved a problem where PTY was failing. (\[TEM-97])
**New Features**
* Introduced an Agent option in Auth. (\[TEM-72])
* Improved port forwarding status display. (\[TEM-89])
* Added AI indicator to the Compose Box. (\[TEM-90])
* Enabled right-click editing and duplication of servers. (\[TEM-91])
* Added support for toggling NIC and FS monitoring by click. (\[TEM-92])
* Enhanced collaboration mode with improved closing prompts. (\[TEM-95])
* Included default background images for JINX, November, and Manhattan. (\[TEM-15])
* Highlighted key features with dedicated sections on the website. (\[TEM-7])
* Changed host creation flow to a more guided experience. (\[TEM-20])
### v1.5.0
***
**Bug Fixes**
* Fixed incorrect Terminal Size on initial load.
* Added ability to cancel shared vault password input.
* Resolved performance issues during first sync on mobile.
* Fixed mobile keychain screen unexpectedly redirecting to edit mode.
***
**New Features**
* Added ability to view and edit snippets on mobile.
* Enabled support for code snippets on mobile.
* Enabled editing of keychain on mobile.
* Added ability to view and copy kube config on mobile.
* Introduced ZMODEM support.
* Added serial port functionality.
* Implemented port forwarding feature.
* Added x11 forwarding capability.
* Added Cursor blink, cursor style and more font settings
* Now default to WebGL rendering
* Detect links in terminal
### v1.4.4
**New Features**
* Remove ssh-history feature due to performance impact, we are looking for new solutions
* Clear screen upon shell startup
* Use WebGL renderer engine
* Support link detection in desktop versions
* Search shortcuts, and will autofocus when you use search function
* Haptic feedback in the terminal
**Bug Fixes**
* Incorrect font color in iOS dark mode settings
* Fixed incorrect terminal boundary for the first startup in desktop versions
### v1.4.3
{% hint style="info" %}
This version is only available for Tempest Mobile
{% endhint %}
**New Features:**
* Brand new Settings UI for a more intuitive experience
* Updated Edit UI with smoother interactions
* Prompts for username and password upon connection
* No need to store passwords in Tempest; Tempest will prompt for the password each time you connect
* Updated Connection UI to match the desktop version
* Dark mode is back for a more comfortable user experience
* New dark icon on iOS
**Performance Optimization:**
* Improved overall performance and responsiveness of the app
**Authentication Options:**
* Added support for multiple authentication methods: password, keychain, private key, and keyboard-interactive (not available yet)
### v1.4.2
**New Features**
* **Revamped SSH Connection Interface**: A modern, user-friendly interface for establishing SSH connections.
* **Enhanced SSH Performance**: The Desktop now utilizes the Rust-based SSH backend(), dramatically improving connection speed and responsiveness.
* **Automatic Window Management**: This feature opens new windows when existing ones reach a high number of tabs, optimizing user experience.
* **Advanced Proxy Support**: Connect to hosts using HTTP or SOCKS5 proxies, or configure a custom proxy command.
* **Improved Host Edit Interface**: Streamlined host editing for ease of use.
* **Password-Free Connections**: Users are no longer required to store passwords in Tempest. The application now prompts for credentials upon connection.
* **Support for Keyboard-Interactive Authentication**: Enables more secure and interactive authentication options.
* **Flexible Authentication Selection**: Users can choose their preferred authentication method within the host edit settings.
**Optimizations**
* **Performance Enhancements**: General improvements to streamline and speed up performance.
* **Immediate Connection**: Directly connect to a host when using the `ssh user@host` syntax in the search bar.
### v1.4.1
#### New Features
* Tempest now syncs with your chosen terminal theme instead of syncing theme settings to the cloud. Upon upgrading to v1.4.1, the theme will reset to default once.
* Added keyboard shortcuts for easier navigation: `Ctrl + W` to close a tab, `Ctrl + T` to open a new tab, and `Ctrl + number` to switch tabs.
* Updated default font to **Hack** or **Operator Mono Medium** (if available on your system).
* New Tab bar design
#### Optimizations
* Removed the SFTP tab, adding an SFTP connect button to the main SSH servers tab for quicker access.
#### Fixes
* In some cases, user can't open Tempest for the second time on Windows
### v1.3.3
#### New Features
* Tempest will sign in immediately when starts. Users no longer need to wait to sign in
* Move account status to the vault selection drop-down
#### Optimizations
* Settings UI adjusting
### v1.3.2
#### New Features
* Snippets are available now. You can add, view, and edit snippets in the snippet tab, and can access them in the terminal using the compose box
* Tempest now supports keyboard-interactive authentication. However, currently, only supports trying to password set for the host, but will not ask for user-interactive
#### Fix
* Fixed some UI bugs
* Fingerprint does not persist after editing
### v1.3.1
#### New Features
* Tempest will now check and save host fingerprints. When the host is not recognized or the fingerprint doesn't match, Tempest will prompt the user to decide whether to continue connecting for security purposes.
#### Fix
* SFTP not working
* The text was not readable when the user didn't select any theme. Tempest will now fall to the Tempest theme
### v1.3.0
#### New Features
* Tempest now supports Telnet protocol on Desktop. Add your telnet servers using the **Add Host** tool
* Telnet requires installation, please refer to for instructions
* Added more instructions in the app
* Switch Vault in Tempest Mobile
#### Fixes
* Fixed Always show Keyboard option on mobile
#### Improvements
* Detect Kubectl and Telnet binary on the device, and will instruct users to install the tools they need
* Hide the Pro badge if the user's already using a Pro account
* Improved the user experience for copy & paste on mobile
### v1.2.9
#### New Features
* [Internationalization and localization](https://en.wikipedia.org/wiki/Internationalization_and_localization) are supported. We're adding more languages to Tempest
* Tempest Desktop can view, clear, and log server connection history now
#### Fixes
* The vault selection looks weird on the light theme. It is now being fixed
### v1.2.8
#### New Features
* Mobile users can long press and drag to copy & paste into the terminal
* Switch between multiple vaults on the Desktop. Please be aware that this feature is in the very alpha phase, and subject to drastic change, which means your data in additional vaults may be lost without prior notification. The multiple vaults function is now accessible for all users but will be available only in the Team plan when it rolls into the stable phase.
* Generate ed25519 private key in Keychain screen on Tempest Desktop, and you can get public key once you've saved the keychain entry.
#### Improvements
* Tempest Monitoring is now stable, we've removed the Preview tag for it and added a help button beside the switch for users to understand how it works under the hood, and its security model.
* Added Help button on Kubernetes screen.
### v1.2.7
#### New Features
* Always show control keys for mobile. If you're using a split soft keyboard, or floating and other soft keyboard that Tempest cannot detect, this option will let Tempest always show the control keys
#### Optimizations
* Optimized database size
* Optimized desktop new tab and settings speed
#### Fixes
* In rare cases, tab bar on the desktop may behave incorrectly
### v1.2.6
#### New Features
* Read Keychain entries on Tempest Mobile
* Tempest can now remember connection history. You can access it in Tools -> History on Tempest Mobile
* Brand new design of edit and settings UI on Tempest Mobile
#### Removal
* Temporarily remove keep the connection in the background feature for iOS
### v1.2.5
#### Critical
We have identified a bug that may cause data loss. To prevent data loss, users have to upgrade to v1.2.5 to continue to use cloud features.
Users will be required to re-enter their password
#### Enhancement
* Upgraded Tempest security model. Tempest is now safer
### v1.2.4
#### New Features
* Tempest Autocomplete will suggest useful command autocomplete information when you type in the compose box. It is still in the alpha phrase, and subject to limitations.
* Added syntax highlighting for the compose box. Currently only supports shell scripts.
* You can now edit multiple lines simultaneously just like vs code in compose box
#### Optimize
* For the compose box, will not ask AI if a shebang is detected
* For SFTP, use list as default view
### v1.2.3
#### New Features
* Users can now move, select, and download multiple files at one time in the SFTP manager
* Brand new SFTP manager UI
* SFTP now has breadcrumb navigation
#### Optimization
* Added cancel button to welcome page
#### Fixes
* The auto theme on light systems may have a strange background
### v1.2.2
#### Optimizations
* Tempest Mobile can join the collaboration now
* In-App Purchase works for yearly and monthly billing mode
#### Fixes
* Users may not be able to open SFTP sessions
### v1.2.0
#### New Features
* Tempest AI and compose box (Pro only)
* Collaboration Dialog
* New Tab Bar Appearance
#### Fixes
* Memory leak of monitoring
* Ubuntu icon
* Updated app home
### v1.1.13
#### New Features
* feat: monitor disk space and network speed
* feat: pick emoji in edit form
#### Fixes
* fix: delete and edit dialog bugs
* fix: windows control button color
* fix: conditional ssh-agent warning
### v1.1.12
fix: the user may not be able to create a new vault
### v1.1.11
feat: monitoring(you need to enable monitoring in edit form)
fix: auto system theme
feat: change vault password
fix: emoji may load slow
feat: new themes(November, Dracula, Manhattan, Homebrew, and Tempest Default)
fix: theme select ui
fix: theme settings may not open
### v1.1.10
feat: Notorized macOS app
### v1.1.9
fix: search bar
fix: pane resizing
chore: code optimization
feat: ai compose box(preview)
feat: collaborate(preview)
feat: broadcast
feat: device limit exceeded instructions
### v1.1.6
fix: fixed ERR\_E2E\_PASSWORD\_WRONG
fix: app hangs at Syncing
### v1.1.4
feature: default font on desktop
### v1.1.3
feature: supports the adaptive terminal theme
feature: ssh host sort
feature: ssh last connection time
feature(mobile): display arrow keys when using gesture
feature(mobile): more control keys
fix(mobile): theme problems
# Release Notes for Tempest Mobile
What's new in Tempest for Android & iOS — full mobile release notes with every version's new features, improvements, and bug fixes.
### v3.14.0
#### New Features
* HashiCorp Vault support for SSH credentials — store keys and certificates in Vault (KV v2 and SSH certificate signing) and pick Vault as the authentication method right in the host editor (Enterprise).
* Bulk edit for SSH hosts — select multiple hosts and change their settings, including group assignment, in a single step.
* RDP clipboard sharing — copy text and files between your device and the remote desktop in both directions.
* AI context usage meter — the Copilot usage panel now shows how much of the model's context window the current conversation is using.
#### Improvements
* RDP now renders the remote cursor and adapts to window resizing for a smoother session.
* Cleaner host list actions: the separate "set group" action has been folded into the new bulk edit flow.
* Updated the underlying graphics, SSH, and AI engines for better performance and stability.
#### Fixes
* Fixed sign-in to self-hosted enterprise servers over plain HTTP on Android, which previously returned to the welcome screen without any error.
* Fixed saved authentication settings being reset in the host list and editor after connecting to a host that used a plan-restricted credential type.
* Fixed keychain access on iOS so saved credentials are stored reliably.
* Fixed missing RDP connection status messages while credentials were being resolved from Vault.
### v3.13.3
#### New Features
* RDP connections now support HTTP/SOCKS5 proxies, matching the existing SSH proxy support.
* Added optional secure (FTPS/HTTPS) endpoints for FTP, S3, and WebDAV transfers (Pro).
#### Improvements
* Improved RDP performance under network backpressure, reducing dropped frames.
* RDP sessions now resize correctly even when the server doesn't announce dynamic resize support.
* More reliable SSH secondary channel handling to avoid hangs on slow networks.
#### Fixes
* Fixed a false "failed to render" error that could appear when opening a terminal session on some Android devices.
### v3.13.2
#### New Features
* Added sudo elevation support to SSH session monitoring: toggle sudo mode and reconnect directly from the session switcher menu
* Added more color schemes
* Added kill-process and Docker container actions to the Monitor view, plus Docker port information
* Added a sudo password field to connection edit forms and a "send sudo password" terminal action
* Added SSH agent forwarding support (Tempest Keychain agent)
#### Improvements
* Improved team-scoped vault switching, fixing issues when switching between teams
* Membership entitlement checks are now correctly scoped to the currently active team
* Added compatibility for servers with the personal vault disabled
* Fixed incorrect wording in connection-multiplexing messages
#### Fixes
* Fixed a false-positive terminal failure alert shown on Android during GPU startup
* Fixed terminal/RDP crashes caused by the system tearing down the rendering surface early, and a related ANR deadlock
* Fixed a race condition between the mosh control bar disconnect action and an in-flight reconnect
* Fixed a low-level crash that could occur when a terminal view was torn down on some devices
### v3.13.0
#### New Features
* RDP: now with hardware-accelerated video decoding, for a much smoother experience.
* Added trusted host-key verification for RDP.
* The AI Copilot agent can now run commands over Telnet and Local Shell sessions, not just SSH.
#### Improvements
* SSH connections are more robust: faster reconnects and safer handling of multi-factor (2FA) authentication.
* Membership and policy settings moved to the web console. Non-team accounts will not be able to create new shared vaults.
* Various performance and stability improvements under the hood.
#### Fixes
* Fixed an intermittent SSH crash on iOS.
* Fixed navigation getting stuck after opening Performance Monitor.
* Fixed the session menu button on tablets.
* Fixed occasional freezes and crashes when switching between workspace sessions.
### v3.12.10
#### New Features
* Connect to hosts using legacy character encodings (GBK, Big5, and more) with a new per-host terminal encoding setting.
* Refreshed monitoring screen with section icons.
#### Improvements
* Snippet runs across multiple hosts are more reliable and consistent.
* New sessions connect in the background as soon as they're added.
* Improved layout and performance metrics display on the SSH monitor screen.
#### Fixes
* Fixed occasional connection drops during mosh and iperf sessions.
* Fixed a file handle leak that could occur when closing SFTP sessions.
* Fixed connection failure dialogs not appearing correctly in some cases.
### v3.12.7
#### New Features
* Added an "IPerf3 Benchmark" shortcut to quickly test network throughput against a host, from the host list or the active session's toolbar.
#### Improvements
* If a downgraded account causes a Pro-only setting to be silently disabled, you'll now see an alert explaining what happened instead of the feature just quietly not working.
* Port forwarding: the host picker now only shows SSH hosts, and forward rows display clearer, desktop-style icons and labels.
* Port forwarding: you can now set the local bind address directly when creating or editing a forward.
* New host setup screen now always has a Cancel button, so you can back out even when starting from an empty host list.
#### Fixes
* Fixed a bug where mosh is disabled silently for free users, it is now usable for all users.
* Fixed a crash/freeze (ANR) that could occur in the GPU-accelerated terminal.
* Fixed remote desktop (RDP/VNC) sessions crashing or garbling text when pasting long content or typing very fast.
* Fixed bulk file downloads over SFTP failing with channel errors when transferring many files at once.
* Fixed local port forwarding not binding correctly to localhost on some networks.
* Fixed a rare crash that could occur when an SSH session became unresponsive.
* Fixed occasional local database sync errors.
### v3.12.4
#### Improvements
* Clearer connection error messages for Remote Desktop
* Streaming resolution of Remote Desktop is now temporarily capped at 1920 px on high-resolution devices, reducing bandwidth usage and improving responsiveness
#### Fixes
* Fixed RDP connections to GNOME Remote Desktop failing with an "invalid state" error right after sign-in
* Fixed a crash when browsing files on FTP / S3 / WebDAV storage
* Fixed VNC sessions freezing on the last frame after an internal error
* Fixed crashes
### v3.12.3
#### New Features
* Remote Desktop clipboard — copy and paste text between your device and RDP/VNC sessions.
* Custom control keys for Remote Desktop, with presets that sync across your devices.
* Ignore Certificate Errors toggle for S3 and WebDAV connections (matches desktop).
* Allow Remote Desktop in both landscape and portrait modes
#### Improvements
* Redesigned Remote Desktop toolbar with a single wrench menu, quality presets (low / medium / high).
* Resume RDP/VNC sessions straight from the Sessions screen.
* Smoother remote pointer with a client-rendered cursor.
* Reworked two-finger scrolling and more precise pinch-to-zoom and panning.
* Settings now has separate Forum, Discord, and Manual links.
#### Fixes
* Fixed several crashes on Android in the remote-desktop and terminal views.
* Fixed a rate SSH crash.
* Fixed a Mosh session crash.
* Fixed being unable to delete saved RDP/VNC hosts.
* Fixed the keyboard covering the whole screen in landscape Remote Desktop.
* Fixed accidental zooming during a single-finger drag in Remote Desktop.
### v3.12.2
#### New Features
* Snippet folders — organize your snippets (Drive) into folders, with quick up-navigation and per-snippet language selection.
* Quick Connect — paste a user\@host -p port string to instantly start a session from the host list or command palette.
#### Improvements
* "Remote Sessions" is now called Handoff Sessions.
* Live collaboration now negotiates a shared terminal size, so every participant sees a consistent, coordinated grid.
* The back button now uses a cleaner chevron in Remote Desktop sessions.
* Filled in missing translations and aligned all 14 supported languages.
#### Fixes
* Fixed participant identity collisions when joining from the same account for collaboration.
### v3.12.1
#### New Features
* You can now tap "Upgrade Later" to dismiss the device-limit prompt and continue into the app — cloud sync stays off until you decide to upgrade.
#### Improvements
* Unlocking a Pro feature now opens the upgrade screen directly, skipping the extra confirmation dialog.
* The in-app Changelog screen is cleaner and easier to read.
* Diagnostics logs now rotate automatically, so they no longer grow unbounded and take up storage over time.
#### Fixes
* Fixed crashes that could occur when disconnecting SSH or Mosh sessions.
* Fixed the Create Vault link so it opens the correct page.
### v3.12.0
#### New Features
* Fixed tab title — New option to lock a terminal tab to its connection name, ignoring title changes sent by the remote shell.
#### Improvements
* Redesigned LLM Provider settings to match the desktop app — add a provider from the "+" button in the navigation bar, and long-press any provider for Edit / Delete (just like the SSH host list).
* More powerful AI Copilot matches with the desktop app
Fixes
* Android: terminal text-selection handles now track your finger smoothly instead of drifting behind or jumping to catch up.
### v3.11.1
#### New Features
* App theme selector — pick Light, Dark, or System under Appearance settings.
#### Improvements
* Remote Desktop (RDP & VNC) now runs as tabs. Open multiple remote desktops alongside your SSH, Telnet, and serial sessions, and switch between them; backgrounded desktops keep their connection and screen alive.
* Smarter Copilot agent now matches the desktop experience with step-by-step plan/reasoning, file tools, and a safety check before running shell commands.
#### Fixes
* Android: fixed the duplicate "Which Tempest?" chooser that could appear when opening tempest:// login and deep links.
### v3.11.0
#### New Features
* RDP & VNC viewer — Connect to Remote Desktop and VNC servers directly from your phone.
* Pinch-to-zoom & pan — Two-finger pinch to zoom and pan on remote desktop sessions. Supports both direct and touchpad input
* Protocol icons — SSH connections now display protocol-specific icons for quicker visual identification
#### Improvements
* Android build reduced to arm64 only — faster install and smaller app size
#### Fixes
* Fixed SSH channel stability issue that could cause unexpected disconnects
* Fixed paste behavior in terminals that use bracketed-paste mode
* Fixed SFTP file transfer job display names
* Fixed delayed collaboration text inputs
### v3.10.0
#### New Features
* Collaborative Sessions — Invite teammates to join your terminal session in real time. Share a link to let others connect, observe, or participate in your SSH session with end-to-end encryption.
* Session Chat & Members — Chat with collaborators and see who's connected, right from the session screen.
* Remote Sessions List — View all active sessions across your desktop devices in one place, with tab title and hostname shown for each.
* Diagnostics Viewer — Per-session log files with message filtering and a one-tap export flow, accessible from Settings → Diagnostics.
#### Improvements
* Improved terminal text selection menu positioning.
* Cryptography now runs entirely through the native Rust engine for better performance and reliability.
#### Fixes
* Zmodem file transfers now reliably show the Save-As dialog; iOS shows a preview.
* Fixed a crash that could occur during native SSH operations.
### v3.9.0
#### New Features
* AI Copilot — a built-in AI assistant that understands your terminal. Ask shell-aware questions, tap code blocks to run them, or switch to Agent mode to have it run commands for you.
* ZMODEM file transfer — send and receive files directly inside your SSH and local shell sessions.
* Team vault management — new Members and Vault Settings screens, including one-tap "Approve All" for pending member requests.
* Session recording — now supports organization-enforced recording policies with automatic upload.
* Refreshed navigation — the AI assistant now sits front and center in the tab bar.
#### Improvements
* The AI chat transcript is now preserved when you close and reopen the chat.
* You can now clear a selected keychain when editing an SSH host.
* Edit screens now respect your organization's vault permissions.
* Refined translations on the vault setup and upgrade screens.
#### Fixes
* Fixed a crash when sharing files on iPad.
* Fixed SSH authentication when a per-host username is configured.
* Fixed SSH sessions not closing cleanly after a failed login.
* Fixed terminal rendering errors after a GPU surface failure.
* Fixed hardware-keyboard input being lost in text fields.
* Fixed snippet runs not being detected as complete.
* Fixed a crash when stopping an AI assistant response.
### v3.8.1
#### New Features
* Session recording: capture terminal sessions in asciicast v2 format (Pro feature)
#### Improvements
* App Lock has moved into General Settings for easier discovery
* Local shell now surfaces the process exit code when a session closes
* Updated translations for SFTP, App Lock, and session recording across all supported languages
#### Fixes
* Fixed navigation when opening SFTP / Monitor from a long-press
* Fixed an error when re-signing into the same account
* Fixed a rare case error when opening external links
* Resolved a rare conflict that could occur while syncing saved servers
### v3.8.0
#### New Features
* Added PIN and biometric app lock.
* Added serial connections for USB and Bluetooth devices.
* Added a native GPU-powered terminal renderer for 120hz complicated terminal sessions.
* Added Select All to the terminal long-press menu.
* Added support terminal clipboard sync.
#### Improvements
* Improved SSH authentication by detecting server-supported methods before prompting.
* Improved security key and PIN authentication flow.
#### Fixes
* Fixed a foreground ANR.
* Fixed rare SSH authentication loops.
* Fixed crashes around iOS YubiKey NFC handling.
* Fixed port forwarding performance.
* Fixed terminal gesture, arrow key, haptic, and selection edge cases.
### v3.7.0
#### New Features
* iPerf3 network bandwidth testing tool with client/server modes and real-time auto-scrolling results
* SSH jump host support with multi-hop chaining and per-hop authentication flow
* SSH certificate authentication support
* FTP protocol support, fully integrated into the file manager
* S3 / WebDAV cloud storage file management
* Universal bookmarks for all file manager protocols
* Nerd Font Mono bundle with font preview and size slider
* Terminal preset color themes significantly updated and expanded
* Foreground service with SSH keepalive for background sessions
* Prompt to disable battery optimization on first SSH connect
* Added multiple new languages (Traditional Chinese, Japanese, Korean, etc.)
#### Improvements
* SFTP rename dialog prefills the original filename and selects the basename before the extension
* Configurable SSH keepalive interval
* Comprehensive i18n translation sync and gap filling
#### Fixes
* Fixed multiple crashes
### v3.6.1
#### New Features
* Proxy authentication support — connect through HTTP and SOCKS5 proxies with username/password
* SSH environment variables — pass custom environment variables to the remote server
* Terminal emulation type — choose your terminal type (xterm-256color, etc.) per host
* Bell sound — audible terminal bell with configurable sound
* Hardware keyboard: full support for F1–F12, navigation keys (Home/End/PgUp/PgDn/Insert/Delete), and Ctrl+key combinations
* Hardware keyboard: dead key composition and AltGr support for European keyboard layouts (Android)
* Ctrl/Alt modifier lock
* iOS spacebar trackpad for cursor movement
#### Improvements
* Disable Gboard suggestion strip for cleaner terminal input (CJK input unaffected)
* Changelog now supports dark mode
#### Fixes
* Fixed Android keyboard not appearing when tapping the terminal
* Fixed CJK (Chinese/Japanese/Korean) composing — selecting candidates now works reliably
* Fixed physical keyboard triggering the soft keyboard on Android
* Fixed keyboard show/hide reliability across all Android devices
* Fixed session not closing properly when removed while app is backgrounded
* Fixed Telnet terminal type not applying correctly
### v3.6.0
#### New Features
* Added Telnet and RCON protocol support
* Terminal now supports mouse wheel and click events in alt screen apps like vim and htop
* Added custom server endpoint configuration
* Session switcher bar extended to all session types
#### Improvements
* Changelog screen now uses native Markdown rendering for faster loading
### v3.5.5
#### Fixes
* Fixed intermittent keyboard failure on Android
* Fixed crash
### v3.5.4
#### New Features
* Brand-new single-page SFTP browser for a smoother workflow
* SFTP opens to the remote home directory on first connect
* SFTP remembers and restores the last visited path when resuming a session
* Added sort-by menu in SFTP (name, size, date, etc.) with full localization
* Added parent-directory entry and go-to-path menu in SFTP
* Added inline error view in SFTP
* New in-app changelog screen, auto-shown after version upgrades
* Haptic feedback on the terminal floating cursor
#### Improvements
* Selection overlay now tracks scroll accurately in the terminal
* Fine-tuned floating cursor timing on iOS
* Push notification settings page reorganized with a cleaner layout
* Database unlock screen now respects the dynamic theme colors
#### Fixes
* Fixed a crash when closing all sessions at once
* Fixed a crash caused by writing to a Mosh session during shutdown
* Fixed a rare crash underlying SSH socket on session teardown
* Fixed empty session tabs being rendered incorrectly
### v3.5.3
#### New Features
* Push notification support for desktop snippet run result delivery
* SFTP Properties dialog with chmod / chown editing, plus owner / group / size display
* Native SFTP download & upload powered by Rust engine
* Snippet language type support
* OAuth authentication with PKCE
* xterm.js upgraded to 6.0 with Unicode 11 addon
#### Improvements
* Terminal text input routed through native layer to handle CJK chars input better
* Floating cursor with axis-lock and focus-driven behavior
* SFTP operations migrated to rust job queue for better reliability
#### Fixes
* Fixed severe battery drain on Android (removed PARTIAL\_WAKE\_LOCK)
### v3.5.2
#### New Features
* Local port forwarding — listen on all interfaces (0.0.0.0)
* Custom keyboard — key sequences, cloud-synced presets, hold keys
* Dynamic UI color themes
* Mosh protocol — dedicated signals, service messages, and SSH fallback
* Terminal keep-awake during active sessions
* Server monitor shows OS logo and CPU model
* Snippet multi-select for batch execution on multiple hosts
* Terminal options screen
#### Improvements
* Per-field validation on SSH host editor and port forward forms
* Welcome screen updated with new feature highlights
#### Fixes
* Fixed Mosh SIGPIPE crash and stale timestamp
* Fixed non-ASCII (e.g. Chinese) terminal input encoding
* Fixed multi-select long press and group assignment issues
### v3.5.1
#### New Features
* iPad multi-window support with independent session instances
* Android multi-window support with independent activity instances
* Server OS detection with distro logos
#### Fixes
* Fixed Android 15 foreground service dataSync timeout crash
* Fixed Android 12+ ForegroundServiceStartNotAllowedException
* Fixed iOS crash when tapping Sign In
* Fixed AI compose box displaying garbage characters
* Fixed OS detection not triggering on mobile
### v3.5.0
#### New Features
* Mosh protocol for low-latency, roaming-friendly remote sessions over UDP
* Hardware security key (FIDO2 / YubiKey) authentication via NFC with ed25519-sk and ecdsa-sk keys
* Post-Quantum Cryptography — one-tap switch between post-quantum and classic SSH algorithms
#### Improvements
* Keyboard-interactive authentication (multi-round)
* "None" authentication for password-less servers
* Configurable Backspace key behavior per host
* zlib compression
* Connection multiplexing — reuse sessions for faster reconnect
* Support more algorithms
* Connect to the server via HTTP or SOCKS5 proxy
* Fixed UI freezing during SFTP transfers
* Support for custom AI models and endpoints
* Long-press space bar to move cursor (very alpha stage)
* Scrollable control key bar with pinned "More" button
* Redesigned host list — emoji badges, active session indicators, group chips, entry animations
* Search in Snippets and Keychain
* Copy host key fingerprint
* Vault name shown in navigation header
* Improved credential and validation display
* New app icon
#### Fixes
* Lower CPU and energy usage in the performance monitor
* Fixed pinch-to-zoom accidentally resetting font size (Android)
* Fixed reversed TX/RX statistics in the performance monitor
* Wake lock support (Android)
### v3.4.0
#### SSH and Terminal
* Added multi-session SSH tab switching, with quick access to open, switch, and close sessions.
* Introduced a new SSH Security screen to review negotiated algorithms and manage enabled algorithm categories.
* Improved SSH host browsing with a better host group selection flow and a smoother empty-state create-host path.
* Optimized wide-screen layouts with a 3-column host list on larger devices.
* Improved SSH session switching and close behavior.
* Refined terminal with updated double-tap gesture for Tabs.
* Allow SSH server algorithm selection and reordering.
#### Vault and Security
* Redesigned the vault unlock and onboarding flow for a clearer first-run and recovery experience.
* Added database version checks and an explicit migration prompt when a vault upgrade is required.
* Added support for changing the vault password.
* Upgraded vault crypto to Crypto v2 for stronger security.
* Improved vault switching robustness.
* Fixed errors in new vault creation and hardened the unlock flow.
#### Sync and Reliability
* Delivered major sync performance improvements.
* Improved resilience around crypto setup and migration failure scenarios.
* Included additional UI and layout fixes.
### v3.2.0
Get the latest Tempest here:
#### New Features
* SFTP file editor with tab support and unsaved-changes confirmation
* AI Copilot chat history
* AI command output summary in Copilot
* Optional SSH agent injection with confirmation per session
* Remember credentials option in connection dialog
* Removed workspace panel limits
* Performance monitor sidebar with per-core CPU usage
* Port forward host list search and sorting
#### Improvements
* Enhanced AI settings layout and tab structure
* Improved SSH agent injection feedback
* Updated upgrade feature names and descriptions
#### Bug Fixes
* Fixed missing hosts in port-forward list
* Fixed macOS mount point parsing
* Fixed settings UI glitches
* (Mobile) status bar theme
* (Mobile) process and memory usage in the performance monitor
### v3.0.0
Get the latest Tempest here:
#### New Features
* Initial AI Copilot support
* AI auto-summary after command execution
* SSH and SFTP Copilot screen
* Quick SSH connect
* SFTP file operations (create directory, sort, context menu)
* File detail display in SFTP browser
* (Mobile) Full-screen arrow gesture control for terminal navigation
* (Mobile) Text selection context menu
* (Mobile) Terminal tutorial with first-run onboarding
* (Mobile) Long-press back to disconnect session
* (Mobile) Integrated monitoring actions into host context menu
#### Improvements
* AI streaming stability and message handling
* Copilot UI text color and layout
* Emoji selector usability
* Scratch pad dynamic theme
* Desktop font loading
* Pane button spacing
* (Mobile) Improved touch handling on iPad / mobile devices
#### Bug Fixes
* Fixed prompt disappearing issue
* Fixed SFTP listener issues
* Fixed quick-connect fingerprint dialog
* Fixed key button visibility when no key configured
* Fixed TEM-168 regression
* Fixed Linux MOTD emulation
* Various UI style fixes
### v2.4.0
Download latest Tempest here:
#### New Features
* Added some languages translated by AI
* Define command for kubernetes shell
#### Improvements
* Tempest will show more info for SFTP
#### Fixes
* Fixed some error in rare case
### v2.3.3
**New Features**
* Launch SFTP by long-pressing the server in the list
* SFTP will show folders first
* (Desktop) Right-click in the terminal to paste content from the clipboard
* Now provide AppImage format for Linux distributions
**Fixes**
* Bug fixes
* Fixed false SFTP failure alarm when connecting in the desktop version
### v2.3.1
* bug fixes
* added Discord community
### v2.3.0
#### New Features
* Tempest Drive(Originally Snippet) now supports Markdown
* You can manage game servers via the RCON protocol now
* Custom AI provider
### v2.2.1(Mobile Only)
#### Improvement
* We’ve improved our in-app purchase experience.
### v2.2.0
#### New Features
We’ve improved our in-app purchase experience.\
If you experienced billing issues, please contact us at — we’re happy to make it right.
#### Improvement
* Improved the UI for the port-forwarding feature on dark mode
* Show user UID in Settings -> Account for a better support experience
### v2.1.0(Mobile Only)
#### New Features
* Search on mobile
* More control keys on mobile
### v2.0.2
* Show available updates in settings
* Fixed auto-update
* Renamed Snippets to Tempest Drive
* Allow a custom path for Serial
* Show vault name in "Unlock Vault" screen
* Fixed copy\&paste on mobile
### v2.0.0
{% hint style="info" %}
In Tempest Mobile, this version may be referred as v1.6.0
{% endhint %}
#### New Features
* Introduced the new Grid Window System.
* Displayed AI chats in the sidebar.
* Brand new UI design
#### Bug Fixes
* Fixed an issue where SFTP could not be started.
* Resolved a problem where switching vaults had no effect and always defaulted to *My Vault*.
* Fixed a crash on mobile when closing the last session from the session manager.
#### Improvements
* Moved the Compose bar to the right and repurposed it as *Copilot*.
* Added support for Lifetime subscriptions.
* Added a *Retry* button for failed sessions.
* Upgraded AI model from `gpt-3.5-turbo` to `gpt-4o-mini`.
* Enabled password visibility in the editor view.
* Introduced a smart SSH form for easier setup.
* Added support for forgetting saved fingerprints.
* Replaced the "Add New Host" sheet with a dialog.
* Added server host search functionality.
* Removed Composebox following the switch to Copilot.
* Removed `msys2` shortcut, and we will allow custom local shells soon.
* Updated clipboard behavior: content is now only copied using keyboard shortcuts, not automatically.
### v1.6.3
**Bug Fixes**
* Can't save new host
**Known Issues**
* SFTP crashes. Will be fixed soon
### v1.6.2
**Optimization**
* Upgraded Dependencies
**Bug Fixes**
* Telnet and Serial server are not shown in the main list
### v1.6.1
**Bug Fixes**
* Fixed unclear fonts in upgrade UI
* Emojis can't be saved
* Private key authentication fails
### v1.6.0
**New Features**
* Launch Tempest via `-url [`*`protocol://`*`][`*`user`*`[`*`:password`*`]`*`@`*`]host[`*`:port`*`]` command line option
**Bug Fixes**
* SSH remaining methods logic update
**Optimization**
* Upgraded Election to v35
* Upgraded React to 19
### v1.5.2
**Bug Fixes**
* Tempest icon is faulty in the GNOME dash
**New Features**
* New Santa icon for macOS and Linux
* Tempest Monitoring is available on Tempest Mobile
### v1.5.1
**Bug Fixes**
* Fixed an issue where the application could fail to start. (\[TEM-96])
* Resolved a problem where PTY was failing. (\[TEM-97])
**New Features**
* Introduced an Agent option in Auth. (\[TEM-72])
* Improved port forwarding status display. (\[TEM-89])
* Added AI indicator to the Compose Box. (\[TEM-90])
* Enabled right-click editing and duplication of servers. (\[TEM-91])
* Added support for toggling NIC and FS monitoring by click. (\[TEM-92])
* Enhanced collaboration mode with improved closing prompts. (\[TEM-95])
* Included default background images for JINX, November, and Manhattan. (\[TEM-15])
* Highlighted key features with dedicated sections on the website. (\[TEM-7])
* Changed host creation flow to a more guided experience. (\[TEM-20])
### v1.5.0
***
**Bug Fixes**
* Fixed incorrect Terminal Size on initial load.
* Added ability to cancel shared vault password input.
* Resolved performance issues during first sync on mobile.
* Fixed mobile keychain screen unexpectedly redirecting to edit mode.
***
**New Features**
* Added ability to view and edit snippets on mobile.
* Enabled support for code snippets on mobile.
* Enabled editing of keychain on mobile.
* Added ability to view and copy kube config on mobile.
* Introduced ZMODEM support.
* Added serial port functionality.
* Implemented port forwarding feature.
* Added x11 forwarding capability.
* Added Cursor blink, cursor style and more font settings
* Now default to WebGL rendering
* Detect links in terminal
### v1.4.4
**New Features**
* Remove ssh-history feature due to performance impact, we are looking for new solutions
* Clear screen upon shell startup
* Use WebGL renderer engine
* Support link detection in desktop versions
* Search shortcuts, and will autofocus when you use search function
* Haptic feedback in the terminal
**Bug Fixes**
* Incorrect font color in iOS dark mode settings
* Fixed incorrect terminal boundary for the first startup in desktop versions
### v1.4.3
{% hint style="info" %}
This version is only available for Tempest Mobile
{% endhint %}
**New Features:**
* Brand new Settings UI for a more intuitive experience
* Updated Edit UI with smoother interactions
* Prompts for username and password upon connection
* No need to store passwords in Tempest; Tempest will prompt for the password each time you connect
* Updated Connection UI to match the desktop version
* Dark mode is back for a more comfortable user experience
* New dark icon on iOS
**Performance Optimization:**
* Improved overall performance and responsiveness of the app
**Authentication Options:**
* Added support for multiple authentication methods: password, keychain, private key, and keyboard-interactive (not available yet)
### v1.4.2
**New Features**
* **Revamped SSH Connection Interface**: A modern, user-friendly interface for establishing SSH connections.
* **Enhanced SSH Performance**: The Desktop now utilizes the Rust-based SSH backend(), dramatically improving connection speed and responsiveness.
* **Automatic Window Management**: This feature opens new windows when existing ones reach a high number of tabs, optimizing user experience.
* **Advanced Proxy Support**: Connect to hosts using HTTP or SOCKS5 proxies, or configure a custom proxy command.
* **Improved Host Edit Interface**: Streamlined host editing for ease of use.
* **Password-Free Connections**: Users are no longer required to store passwords in Tempest. The application now prompts for credentials upon connection.
* **Support for Keyboard-Interactive Authentication**: Enables more secure and interactive authentication options.
* **Flexible Authentication Selection**: Users can choose their preferred authentication method within the host edit settings.
**Optimizations**
* **Performance Enhancements**: General improvements to streamline and speed up performance.
* **Immediate Connection**: Directly connect to a host when using the `ssh user@host` syntax in the search bar.
### v1.4.1
#### New Features
* Tempest now syncs with your chosen terminal theme instead of syncing theme settings to the cloud. Upon upgrading to v1.4.1, the theme will reset to default once.
* Added keyboard shortcuts for easier navigation: `Ctrl + W` to close a tab, `Ctrl + T` to open a new tab, and `Ctrl + number` to switch tabs.
* Updated default font to **Hack** or **Operator Mono Medium** (if available on your system).
* New Tab bar design
#### Optimizations
* Removed the SFTP tab, adding an SFTP connect button to the main SSH servers tab for quicker access.
#### Fixes
* In some cases, user can't open Tempest for the second time on Windows
### v1.3.3
#### New Features
* Tempest will sign in immediately when starts. Users no longer need to wait to sign in
* Move account status to the vault selection drop-down
#### Optimizations
* Settings UI adjusting
### v1.3.2
#### New Features
* Snippets are available now. You can add, view, and edit snippets in the snippet tab, and can access them in the terminal using the compose box
* Tempest now supports keyboard-interactive authentication. However, currently, only supports trying to password set for the host, but will not ask for user-interactive
#### Fix
* Fixed some UI bugs
* Fingerprint does not persist after editing
### v1.3.1
#### New Features
* Tempest will now check and save host fingerprints. When the host is not recognized or the fingerprint doesn't match, Tempest will prompt the user to decide whether to continue connecting for security purposes.
#### Fix
* SFTP not working
* The text was not readable when the user didn't select any theme. Tempest will now fall to the Tempest theme
### v1.3.0
#### New Features
* Tempest now supports Telnet protocol on Desktop. Add your telnet servers using the **Add Host** tool
* Telnet requires installation, please refer to for instructions
* Added more instructions in the app
* Switch Vault in Tempest Mobile
#### Fixes
* Fixed Always show Keyboard option on mobile
#### Improvements
* Detect Kubectl and Telnet binary on the device, and will instruct users to install the tools they need
* Hide the Pro badge if the user's already using a Pro account
* Improved the user experience for copy & paste on mobile
### v1.2.9
#### New Features
* [Internationalization and localization](https://en.wikipedia.org/wiki/Internationalization_and_localization) are supported. We're adding more languages to Tempest
* Tempest Desktop can view, clear, and log server connection history now
#### Fixes
* The vault selection looks weird on the light theme. It is now being fixed
### v1.2.8
#### New Features
* Mobile users can long press and drag to copy & paste into the terminal
* Switch between multiple vaults on the Desktop. Please be aware that this feature is in the very alpha phase, and subject to drastic change, which means your data in additional vaults may be lost without prior notification. The multiple vaults function is now accessible for all users but will be available only in the Team plan when it rolls into the stable phase.
* Generate ed25519 private key in Keychain screen on Tempest Desktop, and you can get public key once you've saved the keychain entry.
#### Improvements
* Tempest Monitoring is now stable, we've removed the Preview tag for it and added a help button beside the switch for users to understand how it works under the hood, and its security model.
* Added Help button on Kubernetes screen.
### v1.2.7
#### New Features
* Always show control keys for mobile. If you're using a split soft keyboard, or floating and other soft keyboard that Tempest cannot detect, this option will let Tempest always show the control keys
#### Optimizations
* Optimized database size
* Optimized desktop new tab and settings speed
#### Fixes
* In rare cases, tab bar on the desktop may behave incorrectly
### v1.2.6
#### New Features
* Read Keychain entries on Tempest Mobile
* Tempest can now remember connection history. You can access it in Tools -> History on Tempest Mobile
* Brand new design of edit and settings UI on Tempest Mobile
#### Removal
* Temporarily remove keep the connection in the background feature for iOS
### v1.2.5
#### Critical
We have identified a bug that may cause data loss. To prevent data loss, users have to upgrade to v1.2.5 to continue to use cloud features.
Users will be required to re-enter their password
#### Enhancement
* Upgraded Tempest security model. Tempest is now safer
### v1.2.4
#### New Features
* Tempest Autocomplete will suggest useful command autocomplete information when you type in the compose box. It is still in the alpha phrase, and subject to limitations.
* Added syntax highlighting for the compose box. Currently only supports shell scripts.
* You can now edit multiple lines simultaneously just like vs code in compose box
#### Optimize
* For the compose box, will not ask AI if a shebang is detected
* For SFTP, use list as default view
### v1.2.3
#### New Features
* Users can now move, select, and download multiple files at one time in the SFTP manager
* Brand new SFTP manager UI
* SFTP now has breadcrumb navigation
#### Optimization
* Added cancel button to welcome page
#### Fixes
* The auto theme on light systems may have a strange background
### v1.2.2
#### Optimizations
* Tempest Mobile can join the collaboration now
* In-App Purchase works for yearly and monthly billing mode
#### Fixes
* Users may not be able to open SFTP sessions
### v1.2.0
#### New Features
* Tempest AI and compose box (Pro only)
* Collaboration Dialog
* New Tab Bar Appearance
#### Fixes
* Memory leak of monitoring
* Ubuntu icon
* Updated app home
### v1.1.13
#### New Features
* feat: monitor disk space and network speed
* feat: pick emoji in edit form
#### Fixes
* fix: delete and edit dialog bugs
* fix: windows control button color
* fix: conditional ssh-agent warning
### v1.1.12
fix: the user may not be able to create a new vault
### v1.1.11
feat: monitoring(you need to enable monitoring in edit form)
fix: auto system theme
feat: change vault password
fix: emoji may load slow
feat: new themes(November, Dracula, Manhattan, Homebrew, and Tempest Default)
fix: theme select ui
fix: theme settings may not open
### v1.1.10
feat: Notorized macOS app
### v1.1.9
fix: search bar
fix: pane resizing
chore: code optimization
feat: ai compose box(preview)
feat: collaborate(preview)
feat: broadcast
feat: device limit exceeded instructions
### v1.1.6
fix: fixed ERR\_E2E\_PASSWORD\_WRONG
fix: app hangs at Syncing
### v1.1.4
feature: default font on desktop
### v1.1.3
feature: supports the adaptive terminal theme
feature: ssh host sort
feature: ssh last connection time
feature(mobile): display arrow keys when using gesture
feature(mobile): more control keys
fix(mobile): theme problems