English | 中文

OpsKat

Your one-stop server operations workbench
SSH and RDP, databases, object storage, Redis, Kafka, Kubernetes… everything ops has to touch, unified in a single cross-platform desktop app. And you can let AI execute supported operations in natural language, with the applicable policy, approval, and audit controls for each path.

Website · Docs · Download

🧭 About

Managing servers usually means juggling a pile of tools — SSH clients, database GUIs, Redis managers, Kafka consoles — and constantly switching between them. OpsKat brings all of those everyday asset operations into a single interface, so one app is enough. On its own, that's already a full ops workbench.

On top of it sits a layer of AI: just say what you need in natural language, and the AI agent can use its registered tools to pull logs, run SQL, check cluster status, and more. Applicable operations use their policy and approval paths, while tool calls carry an audit trail and decision context where available.

If you find it useful, please give us a Star ⭐ — it means a lot!

⬇️ Install

Download

Grab the latest build for your platform — macOS, Windows, or Linux — from the Releases page. No Go/Node toolchain required: download and run. Step-by-step notes are in the installation docs.

First run

1. Add an asset — an SSH/RDP host, database, object-storage account, Redis, and so on — or import from your SSH config / Tabby / WindTerm.
2. Connect — open a terminal or remote desktop, run a query, or browse keys, collections, buckets, and objects.
3. (Optional) Configure an AI provider, then just tell the agent what you need.

📦 Supported Assets

Category	Assets
Servers & terminals
Databases
Middleware
Object storage

More asset types are on the way via the plugin system.

🖥️ A Complete Ops Workbench

Even before you turn on the AI, OpsKat is a full-featured terminal and asset manager:

• Tree-structured grouping for every supported asset type
• Split-pane terminal with customizable themes
• Built-in RDP remote desktop with fit/actual-size views, fullscreen, special-key shortcuts, and text/file clipboard sync
• SFTP file browser
• VNC remote desktop tabs backed by noVNC with session bytes carried over Wails IPC
• Jump host chain connections
• SQL query editor and data browser for MySQL, PostgreSQL, SQL Server, and SQLite
• Redis command execution with key browser
• MongoDB collection browsing and query execution
• Kafka cluster, topic, message, consumer group, ACL, Schema Registry, and Kafka Connect management
• Object-storage browser for buckets, folders, objects, uploads/downloads, copy/move/delete, previews, and presigned URLs
• Port forwarding and SOCKS proxy
• Encrypted credential storage
• Import from SSH config / Tabby / WindTerm

Proxy Chains

SSH and remote data assets can use an ordered proxy chain when direct access is not enough. A chain may combine:

• SSH tunnel layers that reuse an existing SSH asset as the next hop
• SOCKS5 proxy layers with optional username/password authentication
• HTTP script tunnel layers compatible with DBX-style tunnel scripts (URL + token + timeout)

The same chain model is shared by SSH, SQL databases, Redis, MongoDB, Kafka, etcd, Kubernetes, VNC, RDP, and S3-compatible object-storage connections. A Kafka asset applies its chain to brokers, Schema Registry, and every Kafka Connect cluster. Local SQLite stays local; remote SQLite VFS reaches its file through the selected SSH asset, which can have its own proxy chain. Existing single SSH tunnel (sshTunnelId / ssh_asset_id) and SOCKS5 proxy settings are still read and are mapped to a one-layer chain when an asset is edited; once a new chain is saved, proxy_chain takes precedence.

Remote Desktop

VNC and RDP assets use built-in remote desktop capabilities without a separate bridge service. VNC is rendered through noVNC with session bytes carried over Wails IPC. RDP uses OpsKat's embedded RDP client and is rendered directly in an application tab.

• VNC supports target credentials, proxy chains, text clipboard synchronization, and an optional SSH/SFTP file channel.
• RDP supports resolution, domain, text clipboard synchronization, and direct file clipboard transfer through the embedded RDP implementation.

🤖 Let AI Operate for You

Configure an AI provider and you can describe what you need in plain language — the agent connects and does it for you:

• "Show me the recent nginx error logs on web-01" → AI automatically SSHs in, runs the command, and returns the results
• "Count users by status in the db-prod users table" → AI connects to the database via SSH tunnel and executes the SQL query
• "List lagging Kafka consumer groups in kafka-prod" → AI checks Kafka metadata and group lag under policy control
• "Check the health of the k3s cluster" → AI runs kubectl commands and summarizes node and pod status

How the AI works

• Bring your own key — configure any OpenAI- or Anthropic-compatible provider; your API key is encrypted and stored locally.
• Use almost any model — OpenAI, Anthropic (Claude), DeepSeek, Gemini, Qwen, GLM, Kimi, MiniMax… or a self-hosted/local endpoint (e.g. an OpenAI-compatible Ollama).
• Direct connection — OpsKat talks to the model you configure directly; nothing is relayed through our servers, and you are not locked into any vendor.
• You stay in control — the AI only proposes actions; every command runs from your machine against your servers, under the policy and audit controls below.

🛡️ Security & Audit

Giving AI permission to operate on your servers — how do you keep it safe?

• Operation policies — SSH/serial commands, SQL statements, Redis, MongoDB, Kafka, Kubernetes, and etcd operations all support allow/deny lists. SQL is analyzed by a parser that automatically blocks dangerous operations like DELETE/UPDATE without WHERE clauses
• Policy groups — Built-in templates (Linux read-only, dangerous command deny, etc.) plus custom user-defined groups
• Pre-approved permissions — AI or opsctl can request a batch of command patterns upfront. Once approved, matching commands execute automatically without per-command confirmation
• Audit logs — Every operation is automatically recorded: who, when, which server, what command, and the full decision trail

🎥 Demo

https://github.com/user-attachments/assets/2af6e52e-637c-4398-9c8b-8b39b4238b12

https://github.com/user-attachments/assets/035fc0df-230c-456b-87bd-8a4a125feaec

⌨️ opsctl — CLI & AI Coding Tool Integration

For CLI users and AI coding assistants. If you only use the desktop app, you can skip this.

OpsKat ships a standalone CLI tool (opsctl), primarily designed for AI coding assistants like Claude Code, Codex, and Gemini CLI. One-click skill installation from the desktop app teaches these AI assistants to use opsctl — so they can directly manage servers, check logs, query databases, and troubleshoot production issues.

When the desktop app is running, opsctl reuses its connection pool and approval workflow, with all operations subject to the same policy enforcement and audit logging.

You can also use it manually:

opsctl exec web-01 -- tail -n 100 /var/log/nginx/error.log
opsctl sql db-prod "SELECT status, COUNT(*) FROM users GROUP BY status"
opsctl ssh web-01

🛠️ Tech Stack

🔧 Build from Source

For contributors. If you just want to use OpsKat, see Install above.

Prerequisites: Go 1.26+, Node.js 22+ with pnpm, Wails v2 CLI

make install        # Install frontend dependencies
make dev            # Development mode (hot reload)
make build          # Production build
make build-embed    # Production build with embedded opsctl
make build-cli      # Build opsctl CLI only

❓ FAQ

Is it free? Yes — OpsKat is open source under GPLv3.

Which AI models does it support, and do I need an API key? You bring your own key for any OpenAI- or Anthropic-compatible provider (OpenAI, Claude, DeepSeek, Gemini, Qwen, GLM, Kimi, and more). See How the AI works.

Does my data pass through your servers? No. OpsKat connects directly to the model endpoint you configure and to your own servers — nothing is relayed through us, and credentials are encrypted locally.

Can I use it without the AI? Absolutely. It is a complete terminal and asset manager on its own.

Does it work on an intranet or offline? Asset connections are direct, so they work on private networks. For AI features, point it at an internal or self-hosted model endpoint.

🤝 Contributing

We welcome all forms of contribution! Read the Contributing Guide for development setup, commit conventions, and the PR process, then check out the issues or submit a pull request.

📄 License

This project is open-sourced under the GPLv3 license.

🔗 Links

• LINUX DO