How to let an AI agent deploy to your server — without handing it your SSH keys Termalin, an SSH client with a built-in MCP server, lets AI agents deploy to servers without exposing SSH keys or other standing credentials. The agent receives tools like ssh_exec and persistent sessions, while authentication is handled by Termalin's key custodian, which signs on the agent's behalf without the key ever touching disk. Agent sessions are observable via live terminal tabs and audit logs, addressing the irreversibility and observability problems of sharing credentials with agents. The coding part is mostly solved. An agent can branch, patch, write the tests, open the PR. Then the change has to land on an actual server — a service restarted, a migration run, an nginx config edited — and the autonomy stops cold. Deploying needs SSH, SSH needs credentials, and nobody in their right mind wants to paste a private key into an agent's environment. That hesitation is correct, and it's worth being precise about why. An SSH private key is a bearer credential: whoever holds the bytes is you. Sharing it with an agent is not like sharing it with a colleague, because you can't take it back. Once a key has passed through an agent's context — an env var, a mounted file, a config blob — you can no longer prove it didn't end up in a log, a transcript, or a tool call you never read. The only honest answer to "did the model see my key?" is to rotate the key, on every host that trusts it. That's the irreversibility problem, and it's why "just give the agent a key" feels wrong even to people who can't articulate the threat model. Paste the raw key. The direct route: drop id ed25519 into the agent's config or environment and let it run ssh itself. Beyond the irreversibility above, an SSH key has no scope and no expiry — the key that deploys to staging can usually also read the production database credentials two hops away. And revocation means rotation, which means touching authorized keys on every box, which means you'll put it off. Mint a long-lived token. A deploy token, a PAT, an "automation" credential that expires never. It feels more hygienic than a key, but it's the same bearer problem with extra steps. The rule of thumb: if revoking a credential requires remembering it exists , it will outlive the experiment it was created for. Give the agent its own root account. This one at least shows the right instinct — a separate identity you can revoke separately. But done the usual way drop a public key into authorized keys for a deploy-bot user, walk away , it ships with no audit trail. Nothing distinguishes the agent's commands from anyone else's, nothing records what it actually did, and when something breaks at 2 a.m. you're reconstructing an agent's session from bash history and vibes. The common thread: in all three, the agent holds a standing credential, and observability is an afterthought. Flip the model. The agent should never hold the credential at all. None of this is exotic — it's roughly how certificate-based SSH already works at companies with real infrastructure teams. The catch has always been that wiring it up yourself is a project, so most people skip straight to one of the bad options above. Termalin is an SSH client with a built-in MCP server https://termal.in/mcp/ . Your agent — Claude, or anything that speaks the Model Context Protocol — gets tools like hosts list , ssh exec , SFTP reads and writes, and persistent sessions. Termalin does the authenticating. On your machine. Register the bundled local server with your agent: claude mcp add termalin --