A fast, secure SSH client for humans and AI agents
Manage your servers by chatting with AI.
Connect your servers to Claude, ChatGPT or another compatible AI tool with K2Shell. Investigate issues, deploy updates and review security through plain-language requests—without manually typing terminal commands for supported workflows.
Start with an account, an SSH-accessible Linux server and an AI tool that supports remote MCP. Enrollment requires a one-time server setup. Pricing and trial details.
Choose which servers and actions your agent can access. Understand permissions and credentials.
Illustrative conversation, not a live server session.
From a plain-language request to real server work
Your AI tool interprets the request and chooses its tools. K2Shell is the server-access layer: it authenticates SSH connections and checks permissions before carrying out tool calls.
Investigate downtime and slow websites
Ask: “Find out why my website is down and help me fix it.” Or: “Investigate what is making this server slow.” Your agent can inspect services, resource use and logs, then make permitted changes.
Diagnose application errors
Inspect logs and configuration through SSH and file tools. Ask your agent to explain the evidence and proposed fix before changing production settings.
Deploy and verify updates
Ask: “Deploy the latest version of my app and check that it is healthy.” Your agent needs repository access, deployment commands and suitable permissions.
Develop and roll out features
Use your connected coding tool to implement and test features, then roll them out through K2Shell where the repository and server workflow support it.
Review server security
Ask: “Review this server’s security configuration and explain the recommended changes.” Review recommendations and grant only the access needed to apply them.
Handle routine maintenance
Check disk use, inspect services, run configured backups and perform permitted maintenance. Changes still need a suitable plan and verification.
Built for the way you work
Developers
Move from debugging to deployment within an AI conversation. Keep browser terminals and an SFTP editor close when you need direct control. Explore the SSH workspace.
Nontechnical users
Describe the outcome you need without learning terminal commands for supported tasks. Get help with initial setup and decisions that need technical judgment.
DevOps teams
Investigate incidents, maintain infrastructure and automate routine work through conversational requests, scoped access and command activity. Explore agent access.
Set up once. Then describe what you need.
Connect a server, choose your AI tool, and turn a conversation into your next completed task.
- 01 YOUR SERVER
Give your server a connection.
Create an account, add Keyless SSH in Hosts, and run the enrollment script on your Linux server. Choose the login user and access policy.
Requires permission to configure SSH trust and a reachable SSH port. Password SSH is also available for browser use.
- 02 YOUR AI TOOL
Bring the AI you work with.
Add your K2Shell MCP URL to a compatible client. Connect with OAuth or a scoped API key, then choose which enrolled servers it can reach.
Your AI tool may require account or workspace permission to connect a custom MCP server.
- 03 YOUR NEXT TASK
Describe it. Review. Verify.
Ask for what you need. Review proposed actions where your tool supports approval, let the agent do permitted work, and ask it to verify the result.
Inspect commands in Activity and follow interactive terminals in Live sessions.
Bring your preferred supported AI tool
K2Shell exposes remote MCP over Streamable HTTP, authenticated with OAuth or a bearer API key.
Claude
Use a custom connector or configure Claude Code with an API key. Claude setup · Claude Code setup
ChatGPT
Use a custom remote MCP server where your account and workspace permit it. Requirements and setup.
Coding agents and other clients
Setup guidance is available for Cursor and Codex. Other clients need compatible remote MCP support. MCP details.
Two ways to connect
| Connection | Setup and authentication | Everyday use |
|---|---|---|
| Keyless SSH | Run the enrollment script on your Linux server, using root/sudo or the supported per-user setup. Verify the host key. Your account's certificate authority authenticates the chosen login user. | Browser workspace and AI agents. No server password to enter; fresh SSH certificates normally expire in five minutes. |
| Password-based SSH | Add an SSH host and unlock your encrypted vault. The server must accept password authentication. Private-key SSH is also available. | Browser terminal and files. Plaintext passwords are processed in memory, not persisted on K2Shell's servers. Saved vault passwords are stored as encrypted ciphertext. Agents use enrolled servers instead. |
SSH must be reachable from K2Shell. Password-based credentials travel over HTTPS to K2Shell for authentication. Read the security model before connecting.
Security you can explain to your team.
Understand what is encrypted, how server access is authenticated, and which protections you can enable.
Encrypted vault
Saved hosts, passwords and private keys are encrypted in your browser with AES-256-GCM. Your vault master password stays in the browser. SSH credentials are decrypted and sent over HTTPS to K2Shell when needed for a browser connection.
Keyless authentication
Enrolled servers trust your account’s SSH certificate authority for the chosen login user. K2Shell uses fresh keys and short-lived certificates, with pinned server host keys. Your AI tool does not receive the SSH credentials.
Account protection
Account passwords are hashed with Argon2id. Add passkeys or TOTP two-factor authentication, review signed-in devices and sign out sessions you no longer need.
Real access, with boundaries you choose
Agents can change or delete data within their permissions. Choose the narrowest server scope, connection policy and remote login privileges that fit the task.
Permissions
Both server and app/key policies must allow an action. Full access enables shell and file work; allowlists restrict diagnostic commands; read-only blocks shell execution.
Visibility
Command Activity records the target, command and result. Interactive terminals appear in Live sessions. Recording is configurable; retained command output is optional.
Control
Change scope or disconnect an app under Account, API keys & MCP. Revocation blocks future authenticated calls; stop running work separately. Approval prompts depend on your AI client.
Security and revocation details → · Privacy · Get setup help
All your sessions on one screen.
Chat with your AI to get server work done. Open K2Shell to follow interactive sessions, inspect server health and take a closer look when you need to.
$ tail -f access.log 200 GET /api/health 200 GET /
$ journalctl --vacuum-time=7d Vacuuming done, freed 6.2G
$ psql -c 'select 1'
?column?
1$ htop
Follow your agent’s live terminal
See open terminal sessions together, with agent-driven sessions highlighted. Live sessions shows interactive terminal activity; command results are also available in Activity.
Check the health behind the conversation
With monitoring enabled, review CPU, memory, disks and other server metrics. Your agent can use monitoring tools to support its investigation, while you inspect the charts.
$ apt list --upgradable nginx/stable 1.26.2 [upgradable] $ sudo apt-get install -y nginx Setting up nginx (1.26.2) ...
Revisit recorded sessions
Enable session recording to replay terminal output with timing and command markers. Recordings are encrypted at rest; replay is available for sessions captured while recording is enabled.
- 📄 default2.1 KB
- 📄 api.conf1.4 KB
- 📄 app.conf3.0 KB
server { listen 443 ssl; server_name api.example.com; }
Work with files when you need direct control
Browse server folders, transfer files and edit configuration through the browser workspace. Compatible agents can use K2Shell’s file tools on enrolled servers when both policies allow full access.
Illustrative workspace previews, not live server data. Visibility and recording do not replace the permissions and approval controls described above.
Explore Live sessions → · Monitoring · Session replay · Files and editor
Fast access to the tools you need
Run a command across up to 50 servers with bounded parallelism, start background jobs, and keep terminal tabs open while moving between workspace pages.
Questions about managing servers through chat
What is K2Shell?
K2Shell is an SSH client for humans and AI agents. It combines a browser workspace with an MCP server that gives compatible AI tools controlled access to enrolled servers.
Can I manage my server through ChatGPT or Claude?
Yes, with a compatible remote MCP connection and an enrolled server. K2Shell provides OAuth and API-key authentication. ChatGPT access depends on your account and workspace allowing custom MCP servers. Claude uses a custom connector or Claude Code configuration.
Which AI tools does K2Shell support?
K2Shell provides setup guidance for Claude, Claude Code, ChatGPT, Cursor and Codex. Clients must support remote MCP over Streamable HTTP with OAuth or bearer authentication. Availability and approval controls depend on the client.
Do I need to know terminal commands?
For supported everyday tasks, describe your outcome in chat without manually typing commands, opening a terminal or navigating cPanel or another hosting control panel. Initial enrollment requires running a setup script on the server. Some tasks still need technical judgment, approval or manual intervention.
Can K2Shell help investigate and fix server issues?
Your AI tool can use K2Shell to inspect logs, configuration and metrics, run permitted commands and make changes. K2Shell supplies server access; the AI tool interprets your request. Results depend on permissions, server software and the agent's work.
Can I deploy updates or develop new features through chat?
A connected agent can edit files, run deployment commands and check application health when its tools, repository access and server permissions support the workflow. K2Shell supplies SSH and file access, not a built-in development or deployment pipeline.
What does keyless connection mean?
You do not enter a server password in K2Shell. First run an enrollment script on a server you control. It configures trust for your account's SSH certificate authority and chosen login user. K2Shell then authenticates with fresh keys and short-lived certificates; keyless does not mean unauthenticated.
Does K2Shell store SSH passwords?
K2Shell does not persist plaintext SSH passwords on its servers. Saved passwords are encrypted in your browser vault; the server stores ciphertext. To connect, your browser sends the decrypted credential over HTTPS to K2Shell, which processes it in memory for SSH authentication. This is not end-to-end encryption between your browser and target server.
What access does my AI agent have?
Only enrolled servers in its scope, within both server and connection policies and the remote login user's permissions. Full access permits commands, terminals and files; an allowlist permits restricted diagnostics; read-only permits listings and monitoring data, not shell commands. Agents perform real operations. Per-action approval depends on your AI tool; K2Shell does not provide a universal approval gate.
How can I revoke access?
In Account, API keys & MCP, delete the key or disconnect the app to refuse subsequent authenticated calls. This does not undo changes or guarantee running jobs and sessions stop. Close active sessions and stop jobs separately. To remove certificate trust entirely, remove the enrollment trust configuration on the remote server, with administrator help where needed.