Everything you operate, in one window.

Connection management with intent.

Profiles aren't just a hostname and a port. Color-code production red and staging yellow. Group servers into folders. Chain through a bastion. Run a startup command on connect.

• Color-coded environment tags. Production tabs glow red. You won't rm -rf the wrong server twice.
• Folders & search. Hundreds of saved connections, filtered by name, tag, or last-seen.
• Quick-connect bar. Type a hostname, hit Enter. No profile required for one-shots.
• Jump-host chains. Multi-hop SSH configured visually, by reference to other saved profiles or inline.
• Import from ~/.ssh/config and the PuTTY registry. Bring your existing world over in seconds.
• JSON export/import. For backup, sync, or team sharing — credentials excluded by default, optional encrypted include.
• OS keychain. Passwords and key passphrases live in macOS Keychain, Windows Credential Manager, or Secret Service. Never plaintext on disk.

A terminal that holds up to real work.

Full xterm-256color, true color, Unicode and CJK via libvterm. Tabs and tmux-style splits inside each tab — no tmux required. Scrollback search, URL detection, configurable everything.

• True color + 256-color + Unicode/CJK. Render fidelity matches what your tools expect — vim, htop, gh, k9s.
• Tabs & tmux-style splits. Vertical, horizontal, nested. No tmux config required.
• Scrollback search with Ctrl+Shift+F. Highlight matches across thousands of lines.
• URL detection. Ctrl+click to open. Including file:// paths on the remote.
• Themes. Solarized, Monokai, Nord, Dracula, One Dark bundled, plus a 16-color palette editor.
• Configurable keybindings for every app action. Bring your muscle memory.
• Configurable font, size, cursor style, bell behavior. Make it yours.

SFTP that doesn't make you switch apps.

A remote file browser sits one click away from the terminal — in its own tab, or split beside a terminal in the same one. Transfers run in a queue in the sidebar while you keep working.

• A tab or a split. Open a server's files in their own tab, or beside a terminal in the same one. Several sessions at once.
• Sort and navigate. By name, size, modified or permissions. A breadcrumb path, hidden files on demand, symlinks shown with their targets.
• Preview without downloading. Text and images open in a built-in viewer. Any file can be handed to your own editor as a local copy.
• Upload and download. Files either way, and whole folders down. Modification times are kept if you want them.
• Transfer queue. Live progress for every transfer, in one panel shared with object storage. Cancel one, retry a failed one.
• Concurrent transfers with configurable parallelism. Tune for your link.
• Permissions, rename, new folder, delete. Permissions as checkboxes or octal. Deleting a folder takes what is inside it.

Your buckets, next to your servers.

S3-compatible object storage opens in a tab beside your terminals and SFTP browsers. Save a connection once — endpoint, region, keys — and it lives in the same list as your servers, grouped and colour-coded the same way.

• Any S3-compatible store. Presets for AWS S3, Linode, DigitalOcean Spaces, Backblaze B2, Cloudflare R2 and MinIO — anything else by endpoint URL.
• Folders that behave like folders. Browse by prefix, sort, select several at once. Big folders load as you scroll.
• Upload and download through the transfer queue you already use for SFTP. Files or whole folders, large files in parts, each one cancellable.
• Preview without downloading. Text, images, and a listing of what's inside a .zip or .tar.gz — nothing is extracted.
• Delete, new folder, rename a file. Deleting a folder says it takes everything beneath it. Renaming a file asks before it replaces anything.
• Empty Bucket that really empties it. Every older version, delete marker and unfinished upload in a versioned bucket — after you type the bucket's name.
• Self-hosted friendly. A custom CA bundle, path-style or virtual-hosted addressing, and a Test Connection button before you save.
• Secret keys in the OS keychain. The same place your SSH passwords live. Never in the connection database.

SSH keys without leaving the app.

Generate Ed25519, RSA, or ECDSA keys with one button. Convert OpenSSH ↔ .ppk without a side tool. Deploy a public key to authorized_keys on any saved connection with a single click.

• Generate Ed25519, RSA (2048/4096), ECDSA with optional passphrase and OS-keychain storage.
• OpenSSH ↔ PuTTY .ppk conversion. One button, no command line.
• One-click deploy public key to ~/.ssh/authorized_keys on any saved connection.
• Fingerprint viewer with cross-references to the connections that use each key.
• Per-key audit log — when it was generated, last deployed, last used.
• Passphrases stay in the OS keychain. Never on disk in plain form.

Port forwarding without the syntax.

No more remembering -L, -R, -D. Configure local, remote, and dynamic forwards in a form. Save them per-connection. Auto-start on connect. Watch them in the status bar.

• Visual local, remote & dynamic forwards. A form, not a flag soup.
• Reusable tunnel profiles attached to a connection. Auto-start when you connect.
• Built-in port browser — see what's listening on the remote and tunnel it with one click.
• Status-bar integration — active tunnels visible at a glance, with traffic indicators.
• Dynamic SOCKS proxy in one click for safe browsing over a bastion.

A plugin system, not a settings menu.

Cleat is built as a host. Extensions are Lua scripts with a real platform API — custom screensavers, per-connection loadouts, notifications, and storage of their own. Install from the marketplace, or install from any URL with a capability-scan preview.

• Lua, not a fork. Extend Cleat without recompiling.
• Per-connection plugin loadout. Different visualizations for your DB servers vs your edge nodes.
• Plugin marketplace — browse, install, auto-update from inside the app.
• Install from any URL with a capability-scan preview before the plugin runs.
• Real APIs: cleat.kv for storage, cleat:notify() for notifications, streaming SSH meta APIs.
• Lua-scriptable screensavers — sandboxed with resource caps, live preview when configuring.

Your Docker Swarm, watched.

Point Cleat at a Swarm manager and it polls the cluster over the SSH connection you already have. Services, nodes, tasks and events in one pane — and an alert engine that catches the failures docker service ls renders as healthy.

• Services, nodes, tasks, events, alerts and an audit trail — six views over one cluster, no extra agent to install.
• Catches the deploy that looks fine. A rolling update paused on failure still renders as 2/2 in plain Docker. Cleat raises it.
• Seeded alert rules for replicas, paused and rolled-back updates, rejected tasks, restart storms, image drift and downed nodes — editable, with per-rule severity.
• Webhooks and local commands on alert, so a page or a script can run without you watching the pane.
• Blast-radius confirmation. Every cluster-changing action shows the verbatim docker command and what it touches, and the destructive ones make you type the name.
• Read-only until you say otherwise — control is opt-in per cluster, and every action lands in the audit tab.

See the whole Swarm view →

Quality of life, built in.

The small things that compound. A command palette that surfaces every action. Settings that search and reset per-field. Window layouts you can recall.

• Command palette (Ctrl+Shift+P) — every action one search away.
• Searchable settings with reset-to-default per field.
• Remembered layouts. Tabs, splits and pane sizes come back exactly as you left them.
• Auto-update notifications via in-app channel — no forced restarts.
• Multi-execute / broadcast mode — type once, send it to every connected session.

Trust & posture, on by default.

Cleat is a tool you connect to your most sensitive systems with. We treat that seriously.

• No telemetry by default. Opt-in only if it ever ships.
• Credentials never leave your machine outside encrypted SSH/SFTP sessions to the servers you've configured.
• OS-native credential storage — macOS Keychain, Windows Credential Manager, Linux Secret Service.
• Open changelog. Every release-notes page is auto-generated from public GitHub Releases.
• Capability-scan preview before installing any plugin — see what it asks for before it runs.
• Plugins are sandboxed with resource caps — a screensaver can't read your ~/.ssh.
• Local-first by architecture. No account required. No "cloud sync" you didn't ask for.