Shellit – Open-source SSH client with self-hosted E2EE sync and MCP Developer kobaltgit released Shellit, an open-source cross-platform SSH client, SFTP manager, and server hub built with Flutter and Dart, completing the project from an empty folder to version 0.7.3 in under 24 hours (~19 hours of active work with autonomous AI agents). Shellit ships self-hosted zero-knowledge end-to-end encrypted sync using Argon2id and AES-256-GCM, a Model Context Protocol (MCP) server for Cursor, Claude, and Windsurf, and a built-in Gemini AI snippets assistant, with 133+ passing tests and 0 analyzer errors across 34 completed stages. The client adds live RTT host telemetry, PROD/STAGE/DEV environment badges with destructive-command confirmation, and an Omni-Bar command palette on Windows, macOS, Linux, Android, and iOS. A modern, secure, and cross-platform SSH client, SFTP manager, and next-generation server hub built with Flutter & Dart. English | Русский https://github.com/kobaltgit/Shellit/blob/main/README.ru.md Shellit combines the ergonomics of premier infrastructure management tools with uncompromising security. Engineered as an independent developer and sysadmin power tool, it emphasizes blazing-fast performance, strict architectural isolation, and transparent connection control. Unlike traditional terminal emulators, Shellit delivers live server telemetry before connecting, built-in protection against accidental destructive commands in production, and an open, extensible plugin ecosystem. Shellit was designed, engineered, and tested from scratch in under 24 hours ~19 hours of active vibe-coding with autonomous AI agents : from an empty folder to a production-grade cross-platform application with self-hosted E2EE sync, an MCP AI Gateway, and a Gemini assistant. ⏱️ View Development Timeline & Milestone Breakdown | Elapsed Time | Milestone | Key Deliverables | |---|---|---| | 0h 00m | Inception | Concept, monorepo architecture, package isolation, agent contracts | | +1h 40m | Core Foundation | 4 isolated packages core , vault , network , plugins , 105 tests | | +2h 00m | Terminal UI | Obsidian Dark theme, live RTT ping dot, 126 unit & widget tests | | +5h 17m | v0.1.0 | Matrix 2x2 splits, tabs, two-pane SFTP, Windows Inno Setup installer | | +6h 03m | v0.2.0 | Self-hosted E2EE cloud sync on VPS, zero-knowledge Go relay server | | +7h 46m | v0.3.0 | Keychain manager, Ed25519/RSA key generator, integrated ssh-copy-id | | +9h 11m | v0.4.0 | Desktop Plugin SDK, sandboxed WebView2 IPC, Docker Monitor plugin | | +11h 31m | v0.5.0 | 100% i18n-ready Zero Hardcoded Strings & official Russian language pack | | +14h 35m | v0.6.0 | Mobile-first Android client with touch accessory bar & haptic feedback | | +20h 52m | v0.7.0 | Model Context Protocol MCP server for Cursor, Claude & Windsurf | | +24h 15m | v0.7.3 | Built-in Gemini AI snippets assistant, dynamic models, pop-out log windows | | +24h 45m | Phase 14 | 1-click ConPTY local terminal with shell discovery PowerShell, WSL, cmd | ⏱️ Total Active Time: ~19 hours including a 4-hour night rest . 🛡️ Quality Metrics: 34 completed stages, 24 reported & resolved bugs, 133+ passing tests, 0 analyzer errors. 📖 Read the unfiltered developer log: docs/CHRONICLE.en.md https://github.com/kobaltgit/Shellit/blob/main/docs/CHRONICLE.en.md . - 🔄 Self-Hosted Zero-Knowledge E2EE Sync: Seamlessly synchronize hosts, SSH keys, command snippets, and folders across all your devices Windows, macOS, Linux, Android, iOS using your own ultra-lightweight VPS relay server. All data is end-to-end encrypted client-side using Argon2id and AES-256-GCM . The server never sees your passwords, private keys, or host metadata. Supports plain HTTP ideal for WireGuard, Tailscale, or LANs without domain/SSL hassles as well as HTTPS including self-signed certificates . - 🟢 Live Host Telemetry Real-time Ping : Instant RTT latency indicator displayed directly on host cards <50ms green, <200ms yellow, offline grey . Inspect server reachability and response times before opening a connection. - 🛡️ Environment Protection & PROD Guard: Distinct color badges for every server PROD alert red, STAGE cautionary yellow, DEV calm blue . On servers marked with the PROD tag, a glowing red border activates around the terminal, and potentially destructive commands rm -rf , DROP , reboot , fork bombs trigger an interactive confirmation modal. - ⚡ Omni-Bar Ctrl+K / Cmd+K : Universal command palette inspired by Raycast and Spotlight: lightning-fast fuzzy search across hosts, one-key snippet execution, instant theme switching, and split management without taking your hands off the keyboard. - 🪟 Matrix Tiling Splits & Drag & Drop: Flexible terminal workspace layouts horizontal, vertical, 2x2 grid within tabs. Drag and drop open session tabs into empty split slots, or use Broadcast Input to send keystrokes simultaneously to all active panes. - 📂 Two-Pane SFTP Manager: Full-featured file manager integrated right into the session tab: local filesystem on the left, remote server on the right, drag-and-drop transfers, context menus, interactive visual chmod permissions editor, and background transfer queue. - 📜 Asciinema Session Recording & Audit: Built-in terminal session recording following the asciinema v2 .cast standard and raw text logs .log . Automatic recording policy for PROD servers, live ● REC timer badge in the toolbar, and a two-tab audit log inspector. - ⚡ Command Snippets: Curated library of frequently used shell commands with tag search, 1-click execution into the active shell, and instant lookup via Omni-Bar Ctrl+K . - 🗂️ Multi-View Catalog: Instantly switch between catalog view modes: responsive tile Grid, dense high-capacity List for 50+ servers , and hierarchical Folder Tree. - 🔐 Zero Credentials Leakage & SQLCipher Vault: Local database encrypted with AES-256 SQLCipher . Master password secured with Argon2id key derivation. Strict memory hygiene Zeroize clears plaintext secrets upon session closure, coupled with comprehensive log sanitization. - 🤖 Model Context Protocol MCP Server Plugin : Built-in MCP Gateway specification 2024-11-05, Server-Sent Events / SSE to securely connect modern AI assistants Cursor, Claude Desktop, Windsurf, Antigravity directly to your servers and terminal sessions. Exposes standardized tools to run commands, fetch terminal buffers, and inspect remote SFTP files under PROD Guard protection with a dedicated AI audit trail. - 🧩 Open Desktop Plugin SDK: Extend the application's capabilities with custom sandboxed plugins .shellit communicating via an isolated WebView IPC bridge on desktop platforms. - 🌐 Community Language Packs: 100% internationalization-ready UI Zero Hardcoded Strings . English is the native default, with an official Russian language pack readily available: Download russian lang pack.shellit https://github.com/kobaltgit/Shellit/blob/main/plugins/russian lang pack.shellit . Shellit supports dynamic installation of custom plugins and language packages .shellit on the fly without restarting the application. - 🤖 MCP Server Plugin plugins/mcp server.shellit https://github.com/kobaltgit/Shellit/blob/main/plugins/mcp server.shellit — built-in AI Gateway for Cursor, Claude, and Windsurf with PROD Guard security gate bundled out of the box . - 🐳 Docker Monitor plugins/docker monitor.shellit https://github.com/kobaltgit/Shellit/blob/main/plugins/docker monitor.shellit — real-time container management and log inspector bundled out of the box . - 🌐 Russian Language Pack plugins/russian lang pack.shellit https://github.com/kobaltgit/Shellit/blob/main/plugins/russian lang pack.shellit — 100% Russian translation of the user interface 527+ keys . 1. Download the desired .shellit package from the plugins/ https://github.com/kobaltgit/Shellit/blob/main/plugins directory. 2. In the Shellit application, open the Plugins sidebar. 3. Click the Install .shellit button in the top-right corner and select the file. 4. For language packs: navigate to Settings → Language & Localization and select your preferred language Learn more about the plugin ecosystem: plugins/README.md https://github.com/kobaltgit/Shellit/blob/main/plugins/README.md . Translation authoring guide: docs/LOCALIZATION AND I18N GUIDE.md https://github.com/kobaltgit/Shellit/blob/main/docs/LOCALIZATION AND I18N GUIDE.md . The project is structured as a modular monorepo following contract-first design and strict package isolation: Shellit/ ├── apps/ │ └── shellit/ Main Flutter application DI, Riverpod, Routing, Run ├── packages/ │ ├── core foundation/ Domain entities, Result/Failure, interfaces/contracts │ ├── storage vault/ Encrypted storage Drift + SQLCipher, Argon2id, SyncCrypto │ ├── ssh network core/ Network core dartssh2, PTY streams, SFTP client, tunnels, recorder │ ├── terminal ui/ Terminal emulator xterm.dart, tabs, matrix splits, mobile panel │ └── desktop plugin sdk/ Plugin manifest specs, validator, and IPC sandbox ├── plugins/ Bundled plugins and language packs .shellit ├── servers/ │ └── sync server/ Lightweight sync relay server Dart + SQLite, Docker, <20MB RAM └── docs/ Central coordination and documentation hub Isolation Rule: Feature packages depend strictly on abstractions from packages/core foundation/ . Direct cross-dependencies between feature packages are prohibited. - Flutter SDK : = 3.12.0 - Dart SDK : = 3.12.0 - Supported desktop environments: Windows 10/11, macOS 12+ , Linux Ubuntu 22.04+ / Debian / Fedora Clone the repository git clone https://github.com/kobaltgit/Shellit.git cd Shellit Fetch dependencies for the main app cd apps/shellit flutter pub get Windows flutter run -d windows macOS flutter run -d macos Linux flutter run -d linux Analyze code across all packages flutter analyze Run unit and widget tests flutter test Shellit frees you from expensive proprietary clouds. You can deploy your own lightweight synchronization relay server on any home server or VPS in under 60 seconds. - Client-Side Encryption: All hosts, private keys, snippets, and folders are encrypted using AES-256-GCM . Encryption keys are derived client-side from your Passphrase via Argon2id . - Blind Server: The server only receives blind authentication tokens authHash and encrypted binary payloads. The server owner cannot read hostnames or any metadata. - Tombstones & LWW: Deletions are tracked via tombstones, and conflicts are resolved via Last-Write-Wins Pull-Then-Push . - Transport Freedom: Works over plain http:// inside WireGuard, Tailscale, or private LANs without domain or certificate overhead as well as https:// including self-signed certificates . 1. Copy the server directory or create docker-compose.yml on your VPS: version: "3.8" services: shellit-sync: build: ./servers/sync server container name: shellit-sync restart: unless-stopped ports: - "8080:8080" volumes: - ./data:/data environment: - PORT=8080 - HOST=0.0.0.0 - DATA PATH=/data/shellit-sync.db - REGISTRATION TOKEN=super-secret-invite-token Optional: protect against unauthorized registrations 1. Start the service: docker compose up -d 1. Open Settings → Sync & Cloud . 2. Configure: - Server URL: http://