Terminal, files, databases, tunnels and secrets in one window. One workspace per client, one vault for every key. No more “which laptop has the prod key” energy.
No account. No telemetry. No paid tier. No cap.
Every server, database, tunnel, vault entry and agent session belongs to a workspace. Switch, and the whole app switches with you — so a production box is not one keystroke away while you are working on staging.
The consolidation arc
The four windows you keep open, the four you keep putting off, and one encrypted credential store under all of them. Nothing gets pasted between apps.
Servers, databases, tunnels, vault entries and agent sessions all belong to a workspace. Give one a password and it is locked rather than hidden — and an AI agent scoped to it cannot see a thing outside it.
A GPU-rendered xterm with split panes and search, and an SFTP browser riding the same session. Two-factor is a code you type once, not once per tab.
Query and shell into each one, through a bastion when that is the only route.
AES-256-GCM store for logins, API keys and free-form pairs. No MCP tool can read it.
Local and remote forwards, a SOCKS5 proxy, userspace WireGuard that needs no administrator rights, and a proxy that shows the HTTPS a machine is really making.
Per context, with conflict detection and export or import.
Fleet operations
Twenty-odd operations across every server you have added. The four that write — patching, a command run everywhere, jobs and revoking a key — stay off until you flip them on, and a new one added in a later version never flips itself.
Inventory
OS, version, what is pending, last seen
Configuration drift
what changed since you last looked
Capacity trends
where disk and memory are heading
Security posture
ssh config, sudo rules, ports, firewall
Access and keys
which key opens which server, and whose
Fleet search
search what is collected, touching nothing
Patching in waves
stops at the first server that comes back unhealthy
Run one command everywhere
named in a confirmation, survives the app closing
Cron
read the crontabs and timers; changing one is a job, planned then approved
Rules
when this fires, run that — with the same approval
Backups
scheduled dumps, restore verified by restoring
Change log
who approved what, when, and what it did
Docker
honest per-item sizes, reclaim by id, never a blind prune
Compose
services, state, and drift from the file on disk
Kubernetes
workloads, cordon, drain and exec
Databases, operated
replication lag, slow queries, table sizes
Log tailing
follow one file across many servers, in one pane
Runbooks
what was run the last three times this alert fired
Drain refuses seven ways, and treats a read that did not answer as a refusal in itself. Paranoid? On purpose.
Pick your character
An alert fires on CPU, memory or a dead systemd unit. The fleet monitor shows which server, the runbook shows what was run the last three times, and the terminal is one click away.
One workspace per client, each optionally password-protected, each with its own servers and secrets. The whole lot exports to a single passphrase-protected file that opens on your other machine.
Patch in waves that stop on the first unhealthy server, watch drift since last week, and read the security posture as it actually is on the box rather than as documented.
Give Claude Code a read-only group on staging and an ASK group on production. It works on its own until something matters, then it waits for you.
MCP
An agent asks for a server by the friendly name you gave it. OpsMaxx looks the real connection up in your OS keychain, checks the access group, runs the command over normal SSH, and strips secrets out of the output before the agent sees any of it.
Agent asks
execute_command on "Nginx Prod"
Policy check
access group says ALLOW, ASK or DENY
You approve
ASK waits in Approvals; the agent waits too
OpsMaxx connects
real host and key read from the OS keychain
Output redacted
secrets and secret-shaped strings stripped
Written down
agent, server, action and result in the audit log
Servers
Files
Containers
Databases
Network
Fleet
Each one is governed separately — ALLOW, ASK or DENY — and file paths can be overridden on top of that.
The bridge listens on 127.0.0.1. Escalation shells — sudo -i, su, sudo bash — are refused for every group, with no setting that turns them back on.
Connect Claude Code:
opsmaxx claudeAccess groups are not a single yes/no switch. Every capability is ALLOW, ASK or DENY, and you can override individual file paths on top of that.
Getting started
Three steps, and only Windows still needs the middle one.
No account, no licence key, no “contact sales”.
OpsMaxx-0.58.1-arm64.dmg · 160 MB
Apple Silicon, M1 and later
OpsMaxx-0.58.1-x64.dmgIntel Macs · 169 MBAll files and checksumsOr use a package manager
brew install --cask opsmaxx/tap/opsmaxxRun brew trust opsmaxx/tap first — Homebrew will not load a third-party tap until you do.
Only Windows still warns, and unsigned is not the same as unsafe.
No warning on macOS.
Since 0.30.1 the macOS build is signed with an Apple Developer ID, notarized by Apple and has the ticket stapled into the app, so it opens normally — offline included. Nothing to click through and nothing to run.
Or let your agent do the data entry.
Import what you already have
OpsMaxx reads ~/.ssh/config, ProxyJump entries included, so the servers you already reach by name are there on first run.
Connect Claude Code
AI & MCP → Overview → Connect Claude Code copies a ready command with the token already in it. One paste in a terminal and the bridge is live.
opsmaxx claudeThere is a CLI too, though the macOS installer does not put opsmaxx on your PATH — call the launcher inside the app bundle, or use the button above.
Every installer is scanned before release, and every file's SHA-256 is published in the release notes.
Optional: check the hash against the release page
shasum -a 256 OpsMaxx-0.58.1-arm64.dmgmacOS does not warn any more: since 0.30.1 that build is signed with an Apple Developer ID and notarized by Apple, with the ticket stapled in, so it opens normally even offline. Windows still warns, because that build carries no signature — a certificate there is $200–$400 a year. The warning means Windows cannot confirm who published the app, not that the file is unsafe. Every installer is scanned with ClamAV, the Windows one with Defender, and the .exe and .dmg with VirusTotal's 70+ engines — and every SHA-256 is in the release notes for you to check.
MIT licensed, with no paid tier, no session limit and no subscription. The whole source is public, so a future paywall is something you could fork your way around.
No account, no telemetry, no analytics. Every connection the app makes is one you configured, apart from the update check you can switch off.
Only within the access group you set. Escalation shells — sudo -i, su, sudo bash — are refused for every group with no setting that reverses it, anything set to ASK waits for your approval, and every action lands in the audit log. Individual privileged reads do use sudo -n, which you can turn off.
No. OpsMaxx imports ~/.ssh/config including ProxyJump entries, and runs perfectly happily beside whatever you use today.
Server credentials go in your operating system keychain, read only by the main process. The vault is separate: AES-256-GCM under a master password that is never stored, derived with scrypt. Neither leaves your machine, and no MCP tool can read the vault at all.
One download, three platforms, no account to create.