Passkey-only auth
WebAuthn for UI login, agent enrollment, and SSH itself — via OpenSSH's
webauthn-sk-ecdsa-sha2-nistp256. No passwords, anywhere.
SHELLWATCH SHELLWATCH Passkey-Backed SSH for Humans and Agents.
WebAuthn for UI login, agent enrollment, and SSH itself — via OpenSSH's
webauthn-sk-ecdsa-sha2-nistp256. No passwords, anywhere.
MCP agents request, humans approve. Realtime Web Push + in-UI toasts; sensitive actions can require per-action consent.
Your passkey-backed SSH agent is forwarded into every session. Hop further,
or gate
sudo behind
a passkey via
pam-ssh-agent-webauthn.
Local ssh,
scp,
git reach
a passkey via ShellWatch with explicit browser approval per signature. Direct
transport, mediated signing — trustless.
Web UI for humans, MCP for agents, native ssh/scp/git from your workstation via the
shellwatch-agent daemon. The challenge that reaches your browser is the one the remote is waiting
on. Use ShellWatch as a personal browser SSH client, or put a human gate
in front of an AI agent — ShellWatch holds the session and you can
watch or take over live. Or run your local ssh directly to the target: ShellWatch never sees a session byte, only
mediates the signature. Every signing request and session event lands
in a tamper-evident audit log.
Open ShellWatch in any browser, on any device, on any network. Click an endpoint and a WebAuthn challenge signs the SSH handshake end-to-end — you get a full xterm.js terminal in the tab. No ssh client to install, no key files to carry, no passwords to lose.
The workspace and the authenticator can be different devices. The challenge fans out to every signed-in browser tab and (with Web Push) to your phone. Drive the terminal on a borrowed laptop, approve on your phone — the assertion flows back and the session opens. The borrowed machine only ever sees the terminal stream; the assertion is produced on your phone, and your credential stays on the authenticator that signed it. The demo on the right shows the all-in-one PWA path; the same WebAuthn flow runs cross-device.
An agent calls
shellwatch_create_session over MCP. ShellWatch dispatches a WebAuthn challenge back to your browser;
your passkey signs the SSH handshake to the target end-to-end.
The session is held by ShellWatch, so you can observe or take over the live terminal at any time.
shellwatch_create_session over MCP → passkey sheet appears with
full context → approve → live terminal opens with a "take over" affordance.
During an active session,
sudo on the target reaches back through the forwarded
auth-agent@openssh.com channel to ShellWatch.
The PAM challenge is surfaced to you with a tail of the live terminal so you can see exactly what is being escalated — your passkey signs it end-to-end.
sudo on the target reaches back through the forwarded agent socket. The challenge
surfaces with a tail of the live terminal so you see exactly what's being
escalated.
Same forwarded-agent channel, but the target now runs ssh to a downstream host. That host's challenge comes back to your browser
with the same terminal-tail context; your passkey signs it end-to-end.
The private key never leaves the signer.
ssh to a downstream host. Its challenge comes back
to your browser with the same tail context — the private key never leaves
the signer.
ssh — signed by ShellWatch, never seen by it.
Run the
shellwatch-agent thin client on any host — workstation, dev box, the box where your AI
coding agent's shell runs, a CI runner — and point
SSH_AUTH_SOCK at it.
Your ssh,
scp,
git, or an embedded shell tool talks directly to the target.
ShellWatch sees only the signature ceremony — never input, output, file
transfers, or port forwards. Even a fully compromised broker cannot read or alter the session.
Every connection still requires a human passkey tap, so an AI agent on your host cannot SSH anywhere without you.
ssh prod → sw-agent asks
ShellWatch for a signature → passkey signs → SSH session goes directly from workstation to target. ShellWatch never sees a session byte.