ShellExec gives Claude, Cursor, and any AI agent secure SSH access to your infrastructure — via MCP or REST API. No keys uploaded. No trust required. You hold the kill switch.
Access exists only while your agent runs. Stop the process — access is gone.
Security model
Most SSH tools ask you to upload your private key and trust their encryption. We designed something different — a model where each layer limits the blast radius of a breach on its own.
Your agent dials out to us over a WebSocket — we never dial in. Your SSH key stays on your machine, is never transmitted, and is never stored. ShellExec cannot see it, even if we wanted to.
Zero-trust tunnelSet allowlists per server — right down to which URLs curl can hit, which systemctl verbs are permitted, and which flags are blocked. Commands are validated by the agent before execution. The cloud cannot override it.
Agent-enforced allowlistsThe tunnel only exists while your agent process runs. Stop the daemon and access is gone instantly — no credentials to revoke, no support ticket to raise, no firewall rules to update. It's connection-existence-gated access.
Full audit trail — command, output, timestamp, which agent, which server, which token. Not just what ran, but what was blocked and why. You see the full picture, including what your AI agent tried and wasn't allowed to do.
Semantic audit logHow it works
One command installs the agent. One config line points your AI at it. Everything else is just telling your agent what to do.
One command on your server. The agent connects out to ShellExec over a secure WebSocket — no inbound ports, no firewall rules, no SSH keys to paste anywhere.
Your agent registers with a label you choose — prod-web-01, staging, homelab. ShellExec assigns a unique ID. If you clone a VM, the new instance gets a new identity automatically.
Define exactly what commands are permitted on each server. Regex patterns, glob matching, URL domain rules for curl. The agent enforces this locally — the cloud cannot override it.
Point your MCP client at your ShellExec endpoint. That's the entire setup. Your AI agent can now address any of your registered servers by name.
"Check disk space on prod." "Restart nginx on staging." "Pull the last 50 error logs." Your agent calls ShellExec, which routes the command down the tunnel and returns the output.
Full audit trail with the command, output, timestamp, server, and agent. Blocked commands are logged too — so you can see what your AI tried and wasn't permitted to do.
Command allowlists
Restrict what any AI agent can do — by server, by command pattern, right down to which domains curl is allowed to hit. Read-only on prod. Full access on staging. You decide.
vs self-hosting
Open-source SSH MCP servers exist. But they run locally, need manual setup, and only work from your machine. ShellExec is the version you don't have to maintain.
| Self-hosted | ShellExec ↗ | |
|---|---|---|
| Setup | Clone repo, install Node, configure SSH paths | One install command per server — done |
| SSH key storage | Credentials in a local config file | Keys never stored — tunnel model, zero uploads |
| Works from | Your machine only | Anywhere — shared across your whole team |
| Command allowlists | None out of the box | Per-server, agent-enforced, URL-aware |
| Audit log | None out of the box | Every execution + every blocked attempt |
| Kill switch | Delete config file manually | Stop the daemon — access gone instantly |
| Updates | You manage it when it breaks | We handle updates and uptime |
Why I built this
“I kept copy-pasting commands from Claude into my terminal, then pasting the output back. It was insane. ShellExec is what I wished existed: my AI agent gets temporary, audited, allowlisted shell access to my servers — and zero keys ever leave the box. I run it on my own infra.”
Pricing
Prices shown in GBP. Auto-converted to USD, EUR, AUD, CAD or JPY on signup.
Free tier includes 5 servers and 500 executions a month. No credit card.
No credit card · Cancel any time