Reach any machine in your fleet from your browser, your terminal, or your AI agent — without ever handing out an SSH key. Grant a teammate access in a click and cut it off just as fast. Every session runs sealed off on its own, and nothing happens that you can't replay later.
$ssh via sgtrelay-us-east-1 ▸web-01[sgt] vault key prod-deploy unsealed ✓ use logged
[sgt] container c-9b41 up · egress locked to web-01:22web-01:~$ uptime
14:02:11 up 212 days, 4 users, load 0.08 0.11 0.09
web-01:~$ systemctl is-active nginx
activeweb-01:~$▊
recordedisolated containeregress 198.51.100.7
// SGT.SH · OPERATIONAL OVERVIEW · DISTRIBUTION UNLIMITED //
SEC 01 // PLATFORM
Everything included, every plan
No locked features, no upsells. Every server you add gets the whole thing: safe keys, isolated sessions, full recordings, and AI-agent access.
Never hand out another SSH key
Your keys are encrypted and stay locked away — no one ever sees them, not your team, not your browser, not even us. Assign a key to a server once, then give people access by name and take it back in a click. Every use is logged.
Close port 22 to the internet
Think VPN, but for SSH. Every connection comes through us from a short list of published IPs — allowlist those on your firewall and SSH goes dark to everyone else on the planet. One rule, and your servers stop answering strangers.
A break-in can't spread
Every session runs in its own throwaway sandbox that can reach exactly one server — nothing else. If something ever goes wrong, it's a dead end: no hopping sideways into the rest of your fleet, no shared state, nothing left behind when you disconnect.
SSH from any browser — even your phone
A full terminal and drag-and-drop file transfer, right in the browser. Nothing to install, no key files sitting on your laptop. Jump on a server from a borrowed machine, a locked-down work laptop, or a tablet on the train.
Let Claude run your servers — safely
Connect Claude Code, claude.ai, or Cursor and your AI agent can work your fleet — list servers, run commands, move files — under the same permissions and the same audit trail as a person. It only touches what you allow, and every move it makes is on the record.
See everything, replay anything
Every session — person or AI — is recorded start to finish and written to a tamper-evident log. Prove who did what and when for your auditors, settle "who changed that?" in seconds, and play any session back like a tape.
// RELAY NET · EGRESS 198.51.100.0/24 · 203.0.113.0/24 //
SEC 02 // RELAY NET
Your servers stop answering strangers
Nothing connects to your machines directly anymore. Every session — browser, terminal, or AI agent — comes through sgt.sh, with relays across regions so the connection stays fast wherever you and your servers are.
A short list of IPs to allowlist. Add our addresses to your firewall and security groups, and SSH is closed to everyone else on the internet.
Want your own IP? Buy a dedicated address only your team uses, and pin your firewall rules to that one line — never shared, never recycled.
One session, one server. Each session can reach exactly the machine you opened and nothing else, so a bad actor has nowhere to go.
Point Claude Code, claude.ai, or Cursor at our hosted MCP server and your agent can list servers, run commands, and move files across your fleet — limited to exactly the machines you've granted it, with every move it makes written to the audit trail.
Prefer batteries included? The built-in AI chat lets you bring your own Anthropic, Gemini, xAI, or OpenAI key, and the agent works your fleet through the exact same recorded, locked-down path — no side channels, no unlogged shells.