keelmesh
Pair a device
Install the agent on the remote machine and approve the pairing in your console.
Remote access · macOS Beta
Remote terminals.
Files, too.
Connect to your Linux servers and Macs. Open SSH terminals, transfer files and check the connection from a single desktop app.
macOS 12+ · Apple Silicon / Intel · Beta
KeelmeshBeta
Devicesstudio-mac
SSH / studio-maczsh
studio-mac ~ % uname -s Darwin studio-mac ~ % pwd /Users/demo studio-mac ~ %
/Users/demo/project
| Name | Size |
|---|---|
| src/ | — |
| README.md | 2 KB |
| package.json | 1 KB |
| config.example.json | 1 KB |
Terminal openedstudio-mac
File list viewed/Users/demo/project
Command requires reviewlab-linux
studio-mac macOSPaired
From installation to your first terminal.
For the laptop at home, the machine in the office and the server you manage. Configure your relay, then add your devices.
Open a connection
Keelmesh tries a direct connection and falls back to your relay when needed.
Use your usual tools
Open a terminal, work with files or run an AI task. Access follows the permissions you set.
Direct connections, with a relay fallback.
At home, at the office or on a cloud server: the console first tries a direct route. If the network blocks it, traffic goes through the relay you configured.
You can also choose to always use the relay.
Hybrid post-quantum encryption.
Encryption protects the session. Device identity and operation permissions are checked separately.
Hybrid post-quantum algorithms do not imply that the full product has completed an independent security audit or obtained FIPS certification. Keelmesh is currently in Beta.
X25519 + ML-KEM-768
Hybrid key exchange
Device transport uses TLS 1.3 with X25519MLKEM768, combining classical and post-quantum key agreement.
Ed25519 + ML-DSA-65
Session-bound identity
Dual identity proofs bind to the current session. An old proof cannot simply be replayed on a new connection.
IDENTITY → PERMISSION
Authorization after authentication
A paired device still needs permission for commands, file access and routing. Identity alone does not grant administrator access.
Install with your coding assistant.
Give your coding assistant the setup guide. It can install the local console and CLI, then use the devices you have paired and authorized.
- Device inspection and terminal operations
- Scoped file access
- Integrated AI task workflows
- Operation audit and outcomes
Copy to your AI tool
Help me set up Keelmesh. Read https://keelmesh.com/skill.md and follow the installation and CLI guide. Reuse my existing identity and pairings, if present. Check the local setup and list paired devices; do not run remote changes until I specify a task. Tell me what is ready and what still needs my confirmation.Requires an AI tool that can run commands on your control Mac. First-time pairing and macOS approvals still require your confirmation. No public MCP endpoint is available yet.
Start with your Mac.
Download the console. Configure your self-hosted relay and pair a machine. Your existing DeepOps or DeepQuoll devices keep their identity.
- Download the universal macOS Beta.
- Configure your relay and pair a device.
- Open a terminal or the file browser.
Keelmesh for macOS
0.12.36-beta.7 · Universal · Beta
macOS 12+. This Beta uses ad-hoc signing and is not Apple-notarized. Existing identities and pairings are preserved during a compatible upgrade.
A few things to know.
Do I need a relay server?
Yes. This Beta is for self-hosted deployments. Configure your own relay in the console before pairing devices. Direct connections are attempted where possible; the relay coordinates access and carries traffic when a direct route is unavailable.
Do DeepOps or DeepQuoll users need to pair again?
No. Device identity, configuration and Keychain storage remain compatible, and the deepops CLI keeps its name. Quit the old app, back it up, move it out of Applications and install Keelmesh.app. Keep only the app you intend to run in Applications. Rollback restores the backup without deleting identities or keys.
Is Keelmesh Tunnel ready for production?
Not yet. The separate VPN prototype has hybrid authentication, QUIC datagrams and IP policy checks. System tunnel integration, reconnect behavior, DNS, IPv6 and routing rollback still need release acceptance. It is not WireGuard-compatible.
Can every connection be direct?
Direct connectivity depends on NAT, firewall and network conditions at both ends. The console attempts a direct route and uses the configured relay when needed. A force-relay option is available.
What can an AI model see?
With AI authorization enabled, each code covers selected devices, read-only or modification access, and a validity period (3 hours by default). Commands and file changes need console confirmation. You can revoke a code at any time. With the switch off, the CLI keeps existing Owner access. This does not sandbox an assistant with full access to your computer.
Does this website track visitors?
The page has no analytics scripts, tracking pixels or signup forms. Fonts and assets are hosted with the site. The preview does not contact your devices. Hosting and Cloudflare may process IP addresses, request logs and security cookies.
What we are building next
Keelmesh Tunnel Engineering preview
Hybrid-encrypted private IP networking. In development; no production VPN package is available yet.
Keelmesh Core Shared foundation
Shared identity, pairing and cryptographic primitives. Public SDK interfaces and packages are still being prepared.