Let Claude Code run your servers — without handing it a root shell.
Nexus Shell is an MCP server. Your own agent — Claude Code,
Codex, anything that speaks the Model Context Protocol — drives your SSH
connections, terminals, SFTP and keys through the app. Secrets never cross
the boundary. Every command lands in a terminal tab you can watch.
Shipped in v1.5.9 · Updated
Agent Bridge is off by default. It is available in the direct-download and
Homebrew builds; it is compiled out of any Mac App Store variant.
The problem with giving an agent SSH
The usual way to let an AI agent touch a server is to give it credentials:
a private key path in a JSON config file, an environment variable, or a
raw shell it can type anything into. That works right up until it doesn't
— and you find out from the audit log, if you kept one.
Agent Bridge inverts it. The agent gets capabilities, never
secrets. It asks Nexus Shell to run something on connection
abc123; Nexus Shell holds the key, opens a visible tab, runs
it, and hands back the output. The agent never learns the credential, and
you are looking at a GUI the whole time.
How it's locked down
No network port. The bridge listens on a Unix domain socket at ~/Library/Application Support/NexusShell/agent-bridge.sock, chmod 0600. At the filesystem layer, only your user can reach it.
Same-uid enforcement. After accept, getpeereid must report the caller's uid matches the app's own — otherwise the connection is dropped before any protocol logic runs.
The app derives the agent's identity itself — LOCAL_PEERPID → parent pid → proc_pidpath. Whatever the client claims about itself is treated as spoofable and used only for display. Consent is keyed on the path the app resolved.
Per-agent consent. The first tool call from a given agent raises an approval dialog inside Nexus Shell. Revocable whenever you like.
Secrets never cross the boundary. No tool can read a stored password or private key. Connections are referenced by connection_id.
Everything is audited. One JSONL record per tool call and connection event. password, passphrase, content, content_base64 and data are replaced with a redaction marker; command and text truncate at 200 characters. Rotates at 5 MB, written 0600. It's a forensic trail, not a second copy of your data.
You can watch and take over. Terminals the agent opens are real tabs, badged as agent-opened. Grab the keyboard at any point.
Private keys are never returned — only referenced by id.
Observability
list_monitors, list_session_logs
Read-only. Log listing returns metadata only, never recorded terminal content.
What it deliberately can't do
No create, edit or delete tools for monitors.
No settings-mutation tools of any kind — an agent cannot reconfigure the app, and cannot turn off its own audit trail.
list_session_logs returns metadata only: server, title, time, duration, size. Never the recorded terminal content.
Setup is one paste
Turn on Settings → Agent Bridge. The panel shows a short
instruction. Paste it into your agent and the agent registers the MCP
server and links the skill folder itself — no hand-editing JSON, no
copying socket paths.
Then talk to your agent the way you already do: "check why nginx is
failing on the staging box", "pull the last 200 lines of the app
log", "switch that host from password auth to a new ed25519
key".
Requirements
macOS 14.2 or later on Apple Silicon. The direct-download or Homebrew
build — brew install --cask viewer12/tap/nexus-shell. Any MCP
client; we test against Claude Code and Codex.
Questions people actually ask
Does the agent get my SSH passwords or private keys?
No. Secrets stay inside Nexus Shell and are never returned over the protocol. Your agent references a server by its connection_id and never sees the credential behind it. This is enforced in the tool layer, not by convention.
Is there a network port open?
No. It's a Unix domain socket with mode 0600, so only local processes running as you can connect — and the same-uid check happens before any protocol parsing. Nothing is relayed through nexusshell.app; the bridge is local IPC between two processes on your Mac.
Is this just a chatbot bolted onto a terminal?
The opposite. Nexus Shell is the server; you bring the agent. There's no model, no prompt and no vendor lock-in in this feature — if you switch from Claude Code to something else next month, the bridge doesn't care. (Nexus Shell does also have a separate built-in AI assistant on ⌘L / ⌘K that uses your own API key. Different feature.)
What happens if the agent does something dumb?
You see it happen in a real terminal tab and can take over mid-command. Afterwards the JSONL audit log tells you which agent called what, when, and what came back — with secrets redacted. Agent Bridge reduces blast radius and makes actions reviewable; it does not make an agent correct, so point it at staging before you point it at production.
Is it stable?
It ships marked experimental. The security boundary is the part we're most confident in; the ergonomics are still moving. If something behaves badly we want to hear about it — [email protected].
Try it on your own Mac
Free tier is free forever. Register and you get a 7-day full-feature Pro
trial — no card, nothing charged when it ends. Pro is
$12.88 once, not per month.
