Launch Tempest from URLs and External Tools

Launch Tempest from external tools, browsers, scripts, and bastion clients using Tempest deep links or SSH URLs on macOS, Windows, and Linux.

Tempest can be opened by other applications through OS-level links and command-line URLs. This is useful for internal portals, bastion clients, password managers, scripts, and compatibility shims that want to open a new SSH tab in Tempest.

Registered Tempest URL scheme

Tempest registers the tempest:// URL scheme with the operating system.

Today, the stable public tempest:// route is used for collaboration links:

tempest://collaborate/<room-id>#<link-fragment>

Opening that URL brings Tempest to the foreground and joins the collaboration room.

Launch an SSH tab

Desktop builds also support launching an ephemeral SSH connection by passing an SSH URL to Tempest:

ssh://user:password@host:22

Examples:

Tempest.exe --url ssh://alice:secret@127.0.0.1:2222
open -a Tempest --args --url 'ssh://alice:secret@127.0.0.1:2222'
tempest-desktop --url 'ssh://alice:secret@127.0.0.1:2222'

Tempest parses:

Field	Source
Host	URL hostname
Port	URL port, default 22
Username	URL username
Password	URL password

The connection is created as an ephemeral SSH tab. It is not saved to your encrypted vault unless you explicitly save it later.

Compatibility with bastion clients

Some bastion systems launch a known SSH client such as Xshell, PuTTY, SecureCRT, or MobaXterm instead of a generic URL handler. In that case, use a small compatibility shim that accepts the third-party client's command-line format and forwards a normalized SSH URL to Tempest.

For example, an Xshell-style launch:

Xshell.exe -url ssh://user:password@127.0.0.1:2222 -newtab server-name

Can be converted by the shim into:

Tempest.exe --url ssh://user:password@127.0.0.1:2222

Common formats to normalize:

Client	Typical SSH launch format
Xshell	-url ssh://user:password@host:port -newtab title
PuTTY	-ssh -l user -pw password -P port host
SecureCRT	/SSH2 /AUTH password /L user /PASSWORD password /P port host

Tempest itself should receive the normalized SSH URL through --url.

Security notes

Putting passwords in URLs or command-line arguments can expose them to shell history, process listings, crash logs, and other local tooling. Prefer short-lived bastion credentials or one-time passwords when integrating through URLs.

For long-lived credentials, save the host in Tempest and store secrets in the encrypted vault or operating-system credential store instead.

See also

• Where Tempest Stores Your Credentials

• End-to-End Encryption

• SSH Jump Host & Bastion Chaining