Features

Everything you operate, in one window.

Cleat is the home base for your infrastructure — SSH and SFTP today, with Kubernetes, Docker, S3, and database consoles on the way. Pick a pillar to see what it does.

Connection management with intent.

Profiles aren't just a hostname and a port. Color-code production red and staging yellow. Group servers into folders. Chain through a bastion. Run a startup command on connect.

  • Color-coded environment tags. Production tabs glow red. You won't rm -rf the wrong server twice.
  • Folders & search. Hundreds of saved connections, filtered by name, tag, or last-seen.
  • Quick-connect bar. Type a hostname, hit Enter. No profile required for one-shots.
  • Jump-host chains. Multi-hop SSH configured visually, by reference to other saved profiles or inline.
  • Import from ~/.ssh/config and the PuTTY registry. Bring your existing world over in seconds.
  • JSON export/import. For backup, sync, or team sharing — credentials excluded by default, optional encrypted include.
  • OS keychain. Passwords and key passphrases live in macOS Keychain, Windows Credential Manager, or Secret Service. Never plaintext on disk.
Connections 42 saved · ⌘K to search
web-01.prod.zimventures.io · ec2-user PROD via bastion-east
db-01.prod.zimventures.io · deploy PROD ● connected
api-02.stage.zimventures.io · deploy STAGE 22 days ago
dev-laptop-vm · rzimmerman DEV today
edge-au.cloudflare · root EDGE 5 days ago
→ Quick connect: ssh user@host:port

A terminal that holds up to real work.

Full xterm-256color, true color, Unicode and CJK via libvterm. Tabs and tmux-style splits inside each tab — no tmux required. Scrollback search, URL detection, configurable everything.

  • True color + 256-color + Unicode/CJK. Render fidelity matches what your tools expect — vim, htop, gh, k9s.
  • Tabs & tmux-style splits. Vertical, horizontal, nested. No tmux config required.
  • Scrollback search with Ctrl+Shift+F. Highlight matches across thousands of lines.
  • URL detection. Ctrl+click to open. Including file:// paths on the remote.
  • Themes. Solarized, Monokai, Nord, Dracula, One Dark bundled, plus a 16-color palette editor.
  • Configurable keybindings for every app action. Bring your muscle memory.
  • Configurable font, size, cursor style, bell behavior. Make it yours.
web-01.prod
db-01.prod ▶
api-02.stage
deploy@db-01:~$ htop
1 ▰▰▰▰▰▱▱▱▱▱ 48.2%
2 ▰▰▰▱▱▱▱▱▱▱ 27.1%
3 ▰▰▰▰▰▰▰▱▱▱ 71.8%
4 ▰▰▰▰▰▰▰▰▰▱ 92.4%
Mem 3.1G/8.0G
Swp 0K/2.0G
deploy@db-01:/var/log$ tail -f postgres.log
2026-05-25 14:02:11 LOG: checkpoint complete
2026-05-25 14:02:14 WARN: slow query 2.4s
2026-05-25 14:02:18 LOG: autovacuum finished
2026-05-25 14:02:21 LOG: replication ok
2026-05-25 14:02:24 LOG: ▮
● connectedsplits: 2Solarized DarkJetBrains Mono 13pt

SFTP that doesn't make you switch apps.

A dual-pane file browser sits one click away from the terminal — local on the left, remote on the right. Drag in either direction. Watch the transfer queue at the bottom of the window.

  • Dual-pane browser. Local ↔ remote, classic layout with a modern UI. Sorted by name, size, modified, type.
  • Drag & drop both ways. From OS to remote, remote to local, or remote to remote between two sessions.
  • Transfer queue. Live progress, speed, ETA. Pause, resume, reorder, retry.
  • Resumable transfers. Wi-fi drops, laptop sleeps, link goes down — pick up where you left off.
  • Concurrent transfers with configurable parallelism. Tune for your link.
  • chmod, rename, mkdir, recursive ops, symlink handling. Everything a file manager should do.
  • Bookmarked directories per connection. Jump to /var/log in one click.
SFTP — db-01.prod.zimventures.io ●●○ 2 of 3 transfers active
Local · ~/projects/site/dist
..
index.html 12.4K
bundle.js 284K
style.css 48K
images/ 38 items
Remote · /var/www/site
..
index.html 12.4K
▼ bundle.js 142K / 284K
style.css 48K
images/ 38 items
▼bundle.js → /var/www/site/4.2 MB/s~ 34s

SSH keys without leaving the app.

Generate Ed25519, RSA, or ECDSA keys with one button. Convert OpenSSH ↔ .ppk without a side tool. Deploy a public key to authorized_keys on any saved connection with a single click.

  • Generate Ed25519, RSA (2048/4096), ECDSA with optional passphrase and OS-keychain storage.
  • OpenSSH ↔ PuTTY .ppk conversion. One button, no command line.
  • One-click deploy public key to ~/.ssh/authorized_keys on any saved connection.
  • Fingerprint viewer with cross-references to the connections that use each key.
  • Per-key audit log — when it was generated, last deployed, last used.
  • Passphrases stay in the OS keychain. Never on disk in plain form.
Key Manager 5 keys
ED
id_ed25519_personal default
SHA256:cR9F2…7q4uv · used by 8 connections
RSA
id_rsa_legacy
SHA256:8mPx0…2nKlj · 4096-bit · used by 2 connections
EC
deploy_ecdsa
SHA256:LMrQv…4eXjk · nistp521 · used by 1 connection

Port forwarding without the syntax.

No more remembering -L, -R, -D. Configure local, remote, and dynamic forwards in a form. Save them per-connection. Auto-start on connect. Watch them in the status bar.

  • Visual local, remote & dynamic forwards. A form, not a flag soup.
  • Reusable tunnel profiles attached to a connection. Auto-start when you connect.
  • Built-in port browser — see what's listening on the remote and tunnel it with one click.
  • Status-bar integration — active tunnels visible at a glance, with traffic indicators.
  • Dynamic SOCKS proxy in one click for safe browsing over a bastion.
Tunnels — db-01.prod 3 active · 12.4 KB/s
IDTypeLocalRemoteState
t1local:5432db-01.prod:5432● active
t2dynamic:1080 (SOCKS)via bastion-east● active
t3remotelocalhost:80800.0.0.0:80● active
t4local:6379redis-01:6379○ stopped
Listening on db-01.prod
5432postgres
6379redis-server
9090prometheus

A plugin system, not a settings menu.

Cleat is built as a host. Extensions are Lua scripts with a real platform API — programmable status-bar segments, live monitoring widgets, custom screensavers, per-connection loadouts. Install from the marketplace, or install from any URL with a capability-scan preview.

  • Lua, not a fork. Extend Cleat without recompiling.
  • Per-connection plugin loadout. Different visualizations for your DB servers vs your edge nodes.
  • Plugin marketplace — browse, install, auto-update from inside the app.
  • Install from any URL with a capability-scan preview before the plugin runs.
  • Real APIs: cleat.kv for storage, cleat:notify() for notifications, streaming SSH meta APIs.
  • Programmable status-bar segments & widget API — line graphs, heatmaps, stat rows, tables.
  • Lua-scriptable screensavers — sandboxed with resource caps, live preview when configuring.
Plugins — Activity
14:01:08[I]cleat:plugininstalled disk-usage@1.2.0 from zimventures.github.io/cleat-plugins
14:01:11[I]cleat:plugininstalled ssh-latency@0.4.1
14:01:13[I]cleat:plugininstalled statusbar-disk@1.0.0
14:01:14[I]cleat:plugininstalled statusbar-memory@1.0.0
14:01:15[I]cleat:plugininstalled statusbar-uptime@1.0.0
14:02:01[D]ssh-latencysampled db-01.prod: 22ms (rolling avg 24ms)
14:02:04[W]statusbar-disk/var on db-01.prod > 80%
●db-01.prod/var 82%mem 3.1G/8Gup 42d22ms

Quality of life, built in.

The small things that compound. A command palette that surfaces every action. Settings that search and reset per-field. Window layouts you can recall. A system-tray quick-connect.

  • Command palette (Ctrl+Shift+P) — every action one search away.
  • Searchable settings with reset-to-default per field.
  • Multiple windows + remembered layouts. Reopen yesterday's workspace exactly.
  • System tray / menu bar quick-connect. Jump to a server without opening the main window.
  • Auto-update notifications via in-app channel — no forced restarts.
  • Multi-execute / broadcast mode (roadmap, issue #44) — run the same command across N sessions.
tunnel ⌘⇧P
New tunnel on current connection⌥T
Open tunnel manager
Stop all active tunnels
Configure tunnel profile on db-01.prod

Trust & posture, on by default.

Cleat is a tool you connect to your most sensitive systems with. We treat that seriously.

  • No telemetry by default. Opt-in only if it ever ships.
  • Credentials never leave your machine outside encrypted SSH/SFTP sessions to the servers you've configured.
  • OS-native credential storage — macOS Keychain, Windows Credential Manager, Linux Secret Service.
  • Open changelog. Every release-notes page is auto-generated from public GitHub Releases.
  • Capability-scan preview before installing any plugin — see what it asks for before it runs.
  • Plugins are sandboxed with resource caps — a screensaver can't read your ~/.ssh.
  • Local-first by architecture. No account required. No "cloud sync" you didn't ask for.
Credentials in the OS keychain
macOS Keychain, Windows Credential Manager, Linux Secret Service. Never plaintext on disk.
No telemetry, ever-by-default
Cleat doesn't phone home. If a future opt-in metrics channel ships, it stays opt-in.
Sandboxed plugins with capability scan
See what a plugin asks for before it runs. Resource-capped Lua sandbox — a screensaver can't read your ~/.ssh.
Hold · Fast.
We’re in private beta — get on the waitlist.
Join the waitlist See pricing