OneCRTQuick connect, four auth methods
Protocol, host, port and username on one screen. Public key, keyboard-interactive, password and GSSAPI are tried in your order, and a failure names the method that did not pass.
Every server,
in one window
Session tree, tabs, command library and SFTP in one window. SecureCRT and WinSCP configs come across whole, nothing lost. Tauri 2 + Rust, 3.7 MB, no Electron - plus an MCP server for agents.
FEATURES
All built in,
All built in,
nothing to switch to
The layout follows the Session Manager / Quick Connect / Command Manager arrangement; the keyboard and the context menus both reach every action.
Four workflows below: connect, migrate, hand it to an agent, pick a colour scheme.
Sessions, one double-click awayFolders · filter · full context menu
Sessions sit in a folder tree; double-click connects. Cut, copy, paste, rename and properties live in the context menu. The tree is persisted as JSON and comes back exactly as you left it.
- A real SSH PTY - several sessions at once, sized to the window
- Connection state on the tab itself; idle keepalive runs at the SSH layer
- Toolbar and status bar on one screen: user, host and port at a glance
Bring your SecureCRT / WinSCP setupSession XML and WinSCP.ini
File - Import from Another Client reads a SecureCRT session export or WinSCP.ini and appends the sessions with their folder hierarchy, so nothing has to be rebuilt host by host.
- Both formats keep their folder hierarchy
- Neither config carries a usable plaintext password - credentials are added on first connect
- Import only appends; it never overwrites existing sessions
Hand sessions to an agentSix tools · Bearer auth · loopback only
Turn it on and OneCRT serves Streamable HTTP MCP on this machine, exposing saved sessions as tools: list, exec, send, read and close. The agent works in a real terminal.
- exec reuses one shell per session, so cd and export survive between calls
- Output caps at 64 KB per call, with an offset for read to continue from
- Off by default, per-request auth, and the agent never sees a password
Two themes, terminal includedUI and ANSI palette switch together
Colour tokens live in one place; the interface and the terminal read the same variables. Switching moves foreground, background, cursor, selection and the ANSI palette together - the frame is not the only thing that changes.
- Light frame, pure white content: still readable on a projector
- ANSI red, yellow and green tuned separately, so Chinese errors stay legible on dark
- Your choice is remembered locally and used on the next launch
Command library and broadcast
The display name is stored separately from the text that is sent, multi-line included. Double-click sends to the current terminal, or broadcast to every ready session or only the visible one.
SFTP file panel
Local and remote panes side by side, with progress and a transfer list. Files move over the SSH session you already have, so there is no second client to keep open.
Disconnects say so
A disconnect gives one clear message; press Enter to reconnect. No guessing games with silent auto-retry - idle timeouts are held off by SSH keepalive.
In-app updates
Check for updates under Help - About. Windows and Linux AppImage upgrade themselves; macOS needs a signed build, so download the dmg and replace.
One pipeline, three targets
Windows x64, macOS Apple Silicon and Linux x86_64 are built by the same GitHub Actions workflow, with matching versions, update feed and checksums.
INTERFACE
Light or dark,
Light or dark,
both set well
The palette comes from the two greens in the app icon; body and interface colours are checked against WCAG AA.
The terminal's ANSI red, yellow and green were tuned separately so Chinese error output stays readable on dark.
PRIVACY & SECURITY
Credentials stay local,
Credentials stay local,
never in a cloud
No account system and no server. Sessions and passwords are written only to the app data directory on this machine.
MCP is off by default, binds 127.0.0.1 only, and checks a token on every request.
Passwords encrypted at rest
On Windows, passwords go through the system DPAPI before they hit disk. Other platforms have no portable system key store - keep the data directory on an encrypted volume.
Loopback only
The MCP server binds 127.0.0.1 on a configurable port. Every request must carry Authorization: Bearer <token>, and the token can be rotated.
Agents never see passwords
An agent can only use credentials you already saved - it never receives or sees them. Turning the switch off also tears down any shell the agent left behind.
No analytics, no telemetry
Apart from SSH connections you start and latest.json when checking for updates, nothing leaves the app. This page is static and loads no tracking scripts either.
MODEL CONTEXT PROTOCOL
Let an agent
Let an agent
run your SSH
File - MCP Server... once enabled, OneCRT serves Streamable HTTP MCP at
127.0.0.1:39117/mcp (port configurable) and exposes saved sessions as six
tools.
Copy the config from the dialog straight into Qoder, Claude Desktop or Cursor.
Six tools, all scoped to sessions you saved
-
sessions_list,terminals_list,exec,send,read,close - A command has a completion signal. exec reuses one shell per session, so cd and export survive between calls; an appended echo sentinel marks the end, and the reply carries the exit code.
- Output is capped, and can be resumed. 64 KB per reply; anything beyond that comes back as an offset for read.
- Off by default, loopback only, per-request auth. The dialog refreshes every two seconds and lists running sessions with their last command.
The copy button hands you a config you can paste straight into a client:
{
"mcpServers": {
"onecrt": {
"type": "http",
"url": "http://127.0.0.1:39117/mcp",
"headers": { "Authorization": "Bearer <your token>" }
}
}
}
INTEROP
Connects to what you already use
The migration path at the SSH layer is kept: configs come across, and agents call tools on the same sessions.
SecureCRT import XML
WinSCP import ini
Qoder MCP client
Claude Desktop MCP client
Cursor MCP client
DOWNLOAD
Current version v0.2.0
Installers and checksums live on GitHub Releases - download directly, no account, no feature limits.
Windows and Linux AppImage update in place; macOS needs a manual dmg for now.
Windows
This deviceWindows 10 / 11 · x64
shellx-0.2.0-windows-x64-setup.exe
about 3.7 MB · NSIS installer
Download for WindowsmacOS
This devicemacOS 12 or later · Apple Silicon
shellx-0.2.0-macos-arm64.dmg
about 4.9 MB · unsigned, right-click → Open the first time
Download for macOSLinux
This devicex86_64 distributions
shellx-0.2.0-linux-x64.deb · shellx-0.2.0-linux-x64.AppImage
deb about 6.2 MB · AppImage about 84.6 MB
Installer file names still use the shellx prefix, which is also the local data directory name; the app calls itself OneCRT. Windows and Linux (AppImage) support in-app updates; macOS needs a Developer ID signature for Tauri's updater, so download the dmg for now. All artifacts and SHA256
FAQ
Asked before the first connect
Does OneCRT cost anything? Do I need an account?
No and no. Installers come straight from GitHub Releases, every feature is included, and there is no trial period or paid tier.
Which SSH authentication methods are supported?
Password, public key (OpenSSH private keys, with ~ expansion), keyboard-interactive and GSSAPI. A session can hold several methods tried in order, and a failure reports the specific reason rather than a generic "cannot connect".
Where are hosts and passwords stored?
Only in the app data directory on your machine; nothing is uploaded. On Windows passwords are encrypted with the system DPAPI before they hit disk. Other platforms have no portable system key store, so passwords are stored in plaintext in the same session file - keep that directory on an encrypted volume.
Help - About OneCRT... shows the exact path, with an Open button that takes you there.
Can I migrate from SecureCRT or WinSCP?
Yes. File - Import from Another Client reads a SecureCRT session export (XML) or WinSCP.ini, and appends the parsed sessions together with their folder hierarchy.
Neither config format carries a usable plaintext password, so imported sessions ask for credentials on first connect. SecureCRT and WinSCP are trademarks and products of their respective owners; OneCRT is not affiliated with them.
Which operating systems and architectures are supported?
Windows x64 (NSIS installer), macOS 12 or later on Apple Silicon (dmg), and Linux x86_64 (deb and AppImage). All three come off the same GitHub Actions pipeline.
macOS says the app cannot be opened because it is from an unidentified developer
The macOS build is not signed with a Developer ID certificate or notarised. Right-click the app in Finder and choose Open the first time, or allow it under System Settings - Privacy & Security.
What is the MCP server and is it safe?
When enabled, OneCRT serves Streamable HTTP MCP on 127.0.0.1 and exposes your saved sessions as tools to agents such as Qoder, Claude Desktop and Cursor.
It is off by default, binds to loopback only, and every request must carry a Bearer token. Agents can only use credentials you already saved - they never receive or see the passwords themselves.
Does OneCRT send usage data anywhere?
There is no analytics or telemetry. Apart from SSH connections you start, the only network traffic is reading latest.json from GitHub Releases when you check for updates. This website is static and loads no tracking scripts either.
Install it, reach the first host in a minute
A 3.7 MB installer, next-next-finish. No sign-up and no online activation.