sshDCommander

Persistent SSH daemon for AI agents and DevOps automation.

sshDCommander bridges AI agents to remote servers with persistent SSH sessions, SHA-256 verified file transfers, deploy manifests, and certificate-based authentication.

Why sshDCommander?

• Persistent sessions — daemon maintains long-lived SSH connections across tool calls, eliminating reconnect overhead
• AI-agent ready — built for Claude Code, Cursor, GitHub Copilot, Aider, Cline, Windsurf, Codex CLI, and any agent with shell access
• SHA-256 integrity — every file transfer is checksum-verified; deploy manifests record and verify deployment state
• Certificate auth — built-in Ed25519 CA for certificate-based authentication without password or key sprawl
• OS keyring — credentials stored in the OS keyring (DPAPI on Windows, libsecret on Linux), never in config files

CLI Tools

Quick Start

pip install sshdcommander
sshdctl start-daemon
sshdctl server add --name prod --host <your-server-ip> --user deploy
sshdcmd --client-id my-agent "uptime" --server prod --connect

Key Features

• Multi-server session pool (10+ concurrent sessions)
• Auto-reconnect with exponential backoff
• Deploy manifests for deployment integrity verification
• Reverse integrity auditing (drift detection)
• Log streaming (sshdcmd --follow) — tail remote logs persistently
• Docker management (sshdctl docker) — 9 subcommands for container lifecycle
• Systemd management (sshdctl service) — 8 subcommands for service control
• Directory sync (sshdcp sync) — bidirectional with SHA-256 checksums
• Fleet management (--servers, --group) — parallel execution across multiple hosts
• OpenSSH config import (sshdctl server import-ssh-config)
• EOL conversion (--eol=on|off|auto) for cross-platform text transfers
• Data portability export (sshdctl export) — ZIP with OpenSSH config
• Connection quality metrics (RTT, jitter, reconnect tracking)
• Remote OS detection (automatic Windows/Linux command adaptation)
• Script mode for complex multi-step workflows
• Multi-locale sudo support
• SSH agent forwarding
• Mandatory --client-id audit trail
• Resume interrupted uploads
• MSYS/Git Bash path demangling (automatic, zero config)

Enterprise Features

Available with an Enterprise license:

• Policy Engine — command/path filtering, rate limiting, time restrictions, auto-rollback
• Encrypted Config — AES-256-GCM encrypted policy files with key management
• Session Recording — full transcripts with HMAC integrity seals
• SIEM Integration — syslog, webhook, and file event exporters
• SSO/IDP Integration — OIDC Device Authorization Grant with JWKS verification
• External Secrets Manager — HashiCorp Vault, AWS, Azure, GCP backends
• Ephemeral Credentials — short-lived SSH certificates via built-in CA
• RBAC — role-based access control for team environments

Installation with --target (isolated installs)

When using pip install --target ./lib sshdcommander, the CLI entry points (sshdcmd, sshdcp, sshdctl) are not registered as executables. Two options:

Option A — Use the included wrapper scripts (recommended):

python ./lib/run_sshcmd.py --client-id my-agent "uptime" --server prod --connect
python ./lib/run_sshcp.py --client-id my-agent upload ./file.txt /opt/app/ --server prod
python ./lib/run_sshctl.py start-daemon

The wrappers handle the Python path automatically — no configuration needed.

Option B — Set PYTHONPATH and use -m:

export PYTHONPATH=/path/to/lib:$PYTHONPATH
python -m sshcmd --client-id my-agent "uptime" --server prod --connect
python -m sshcp --client-id my-agent upload ./file.txt /opt/app/ --server prod
python -m sshctl status

For standard usage, pip install sshdcommander registers CLI tools in your PATH automatically.

Links

• Website: sshdcommander.com
• Documentation: sshdcommander.com/docs
• AI Instructions: sshdcommander.com/docs/ai-instructions
• Changelog: CHANGELOG.md