hoploom

Hoploom

> A local-first secure server access layer for humans and AI agents.

Manage SSH hosts, credentials, remote access, and host-specific agent context from one deterministic interface — without putting secrets in config files, shell history, or an AI model's context.

[Website](https://xiayh0107.github.io/hoploom/) · [Documentation](ssh-server-manager/docs/) · [Product README](ssh-server-manager/README.md) · [简体中文](ssh-server-manager/README.zh-CN.md)

Previously SSH Server Manager / servers-connect. Existing serverctl

commands remain compatible; follow the [upgrade guide](ssh-server-manager/docs/migration.md)

to migrate an existing installation without changing its data or vault entries.

---

Why Hoploom?

OpenSSH is excellent at transport. The hard part is everything around it:

• remembering which hostname, user, port, bastion, or credential belongs to which machine;
• keeping passwords and key passphrases out of dotfiles, scripts, environment variables, and shell history;
• letting coding agents operate remote machines without exposing credentials to the model;
• keeping environment-specific procedures attached to the hosts where they actually apply;
• providing one consistent interface across macOS, Linux, and Windows.

Hoploom puts a small local control layer around OpenSSH.

                  Human
                    │
            CLI / Local Web UI
                    │
                    ▼
        ┌───────────────────────┐
        │        hoploom        │
        │                       │
        │  Host inventory       │
        │  Credential routing   │
        │  Context routing      │
        │  Test / Exec / Files  │
        └───────────┬───────────┘
                    │
              OpenSSH / SFTP
                    │
                    ▼
             Remote Servers
                    ▲
                    │
                AI Agent
                    │
              Agent Skill

The core idea is simple:

> Humans and agents can use a server without needing to know or expose its secret.

---

What it manages

A managed server is more than an IP address.

| Layer | What Hoploom knows |

|---|---|

| Identity | alias, hostname, port, username, tags, notes, ProxyJump chain |

| Credential | password, private-key reference, key passphrase, ssh-agent/OpenSSH defaults |

| Context | working paths, host notes, host-bound Agent Skills |

| Action | test, connect, execute commands, browse and transfer files |

That turns this:

ssh -J user@bastion.example.com deploy@10.0.2.7

into this:

hoploom connect db1

And for an AI agent:

hoploom exec db1 --json -- uptime