Database Studio
Looking for an SSH client with a database browser? Studio lives in the same vault as your terminals and tunnels.
Query and browse databases without leaving the SSH manager. Database Studio connects to PostgreSQL, CockroachDB, MySQL, MariaDB, Microsoft SQL Server, Oracle, SQLite, MongoDB, Cassandra, and Redis, often through the same SSH tunnels you already use for Ops. Run SQL or document queries, inspect schemas and collections, and preview results in an editable grid.
Direct table editing lets you insert, update, and delete rows on supported SQL engines and MongoDB when primary keys (or _id) are present. Export with native dump tools when installed (pg_dump, mysqldump, mongodump, and friends), or use a capped safe logical dump for a quick portable snapshot. Studio sessions stay alive when you switch sidebar pages, so you do not lose query state just because you opened Files or Ops.
Encrypted SSH vault
This is the SSH client with an encrypted vault people mean when they refuse plaintext session lists and cloud directories.
The vault is one file at ~/.ilead/vault.bin. Argon2id (RFC 9106) derives the key. AES-256-GCM seals hosts, passwords, SSH keys, snippets, notes, playbooks, and tunnel settings. A locked vault cannot list hosts. This is an encrypted SSH vault, not a plaintext session list. Sessions still speak ordinary OpenSSH-compatible SSH as described in IETF RFC 4251, iLead wraps inventory and secrets, it does not invent a parallel remote-access protocol.
Masked private keys with password-gated reveal
Private key material and key passphrases in the host editor are masked on first paint with a clean visual badge (e.g., "Ed25519 private key · 464 bytes"), preventing casual screen-share leaks and shoulder surfing. Revealing the plaintext requires re-verifying your master password using constant-time comparison against the in-memory session key. Revealed keys automatically re-mask after 30 seconds, or immediately when the editor closes, the window loses focus, or the vault locks. A dedicated Replace action lets you paste a new key or clear the field without ever exposing the old secret on screen.
Visual multi-hop bastion and jump chaining
Configure and visualize multi-hop bastion paths (e.g., Local → Bastion Alpha → DMZ Jump → Internal Production Node) with a fluid visual topology diagram. Reorder hops with interactive controls, remove or add intermediate bastions, and inspect an auto-synthesized OpenSSH ProxyJump command preview with a one-click copy button. The recursive dialer powers interactive SSH terminals, SFTP file browsing, and port-forwarding tunnels across arbitrary bastion chains with cycle detection.
Dynamic tag-based smart groups
Break free from rigid static directory trees with virtual Smart Groups organized around tags (e.g., #production, #database, #eu-central, #pci-dss). Seamlessly toggle between traditional folder hierarchies and dynamic smart groups in the sidebar. Select multiple tags simultaneously to perform intersection filtering (#prod AND #db) and instantly isolate specific machine roles across large fleets without modifying underlying host definitions.
Server display ordering & manual drag reordering
Control exactly how your servers are arranged in the sidebar. Switch between Custom manual order, Name (A–Z), Name (Z–A), Recently used, and Host/address. In Custom mode, drag and drop any host row with an illuminated cyan insertion indicator to place servers precisely where you want them. The arrangement persists directly in the encrypted vault via a dedicated sortOrder field, surviving restarts and syncing across all your authorized devices.
Multi-vault profiles switcher
Switch effortlessly between completely isolated vault files on the same computer, such as Work.bin, Personal.bin, or Client-XYZ.bin. Each profile maintains its own Argon2id derivation salt, master password, bookmarks, snippets, and credentials. Prevent confidential client infrastructure from ever commingling with personal homelab servers.
Cloud host auto-discovery (AWS, Hetzner, DigitalOcean)
Auto-discover and synchronize virtual machines directly from AWS EC2, Hetzner Cloud, and DigitalOcean using read-only API tokens. View live instance states (Running, Stopped, Provisioning) and import instances into your vault bookmarks with a single click, no manual IP copying or repetitive SSH configuration required.
S3 & object storage browser
An SSH manager with an S3 browser next to SFTP, so buckets and servers share one desk.
Manage cloud object storage buckets right alongside your SFTP connections. Connect natively to AWS S3, Wasabi, MinIO, or Cloudflare R2 with folder prefix navigation, presigned downloads, fast multipart uploads, and key deletion. Toggle seamlessly between remote Linux file systems and cloud object stores in one unified dock.
Live tunnel traffic and bandwidth activity monitor
Real-time telemetry for all your active SSH port-forwarding and SOCKS5 tunnels. Watch live rolling throughput speeds (▲ upload / ▼ download), cumulative transfer totals, and active open socket counters displayed directly on each tunnel badge without adding latency to your connection.
Embedded RDP & VNC remote desktop viewer
Connect to Windows workstations (RDP) and Linux/macOS graphical environments (VNC) directly inside your terminal tabs. Features interactive keyboard and mouse capture, live latency metrics, remote resolution telemetry, responsive scaling (fit / 1:1), and instant fullscreen viewing, no external client required.
In-terminal reverse history search (Ctrl+R)
Press Ctrl+R in any active terminal session to trigger a fast fuzzy-search overlay across your executed command history and iLead's encrypted command audit log. Navigate with arrow keys, inspect execution timestamps, and press Enter to insert the command directly into your active prompt.
Server INFO banner on connect
After an SSH session opens, iLead quietly gathers OS, primary IP, uptime, CPU cores, memory, and root disk usage on a side channel and prints a short Server INFO banner into the terminal, without echoing the probe script into your shell history. You get instant context on a fresh box without running five commands by hand.
Local MCP bridge for AI agents
Settings → Agent Access starts a loopback-only Model Context Protocol server. Cursor, Claude Code, VS Code, GitHub Copilot, freebuff, and other HTTP MCP clients can list_hosts you allow and propose run_command calls. SSH credentials stay in the vault; every command needs an Approve once dialog. Full walkthrough: SSH MCP setup.
Auto-reconnect on sleep wake / Wi-Fi switch & auto-healing
Laptops sleep, lids close, and Wi-Fi networks switch between coffee shop, VPN, and home office. iLead listens natively for system wake and online events, immediately pinging remote endpoints and auto-healing interrupted connections without dumping you to an empty terminal or losing your active scrollback buffer. An exponential backoff auto-heal mechanism protects remote servers from connection flooding.
Terminal triggers & regex bell notifications
Register regex pattern triggers against the incoming terminal stream (e.g., "BUILD FINISHED", "panic:", "error:", "Password:"). When a trigger fires, iLead dispatches native desktop notifications, audio chimes, glowing in-app toasts, or tab alert badges. Stream offset tracking guarantees each alert fires exactly once without duplicate triggers on historical buffer output.
Interactive snippet placeholders & parameterized form prompts
Elevate reusable command snippets into full interactive workflows. Placeholders formatted as <param>or {{param}} automatically render an interactive input modal before execution, complete with remembered input history, real-time command syntax preview, and a one-click sudo prefix toggle.
Batch host importer & exporter (CSV, JSON, Ansible Inventory)
Migrate or backup entire fleets in seconds. Import and export server inventories using standard CSV spreadsheets, structured JSON schemas, or native Ansible inventory files (both YAML hosts.yaml and INI hosts.ini). Features automatic column mapping, duplicate host detection, and group tag preservation.
Expanded SSH client migration (NeoServer, Termius, Tabby, PuTTY, MobaXterm)
Move off existing SSH tools with zero retyping. iLead automatically detects local NeoServer iCloud and macOS Group Containers backup bundles, alongside dedicated parsers for Termius, Tabby / Terminus, Remmina, Bitvise, Royal TS, WindTerm, PuTTY, MobaXterm, WinSCP, Xshell, SecureCRT, FileZilla, Cyberduck, SuperPuTTY, and raw ~/.ssh/config. A categorized import menu with format badges and search filtering lets you inspect every host before merging.
Non-destructive Escape key hierarchy & shortcuts reference
Escape in terminal emulators belongs to Vim, Nano, fzf, and CLI tools. iLead features a smart event hierarchy where Escape is passed directly as ASCII 0x1b to remote shells and never exits fullscreen. When modals, drawers, or menus are open, a prioritized Escape stack dismisses only the topmost layer. A dedicated "⌨ Shortcuts" button and first-run hint keep essential shortcuts accessible at all times.
Sync and scheduled backup across your own devices
Point two machines at the same folder you already use, iCloud Drive, Dropbox, OneDrive, Google Drive, or a local NAS, and they merge hosts, keys, snippets, tunnels, and notes automatically. On macOS the iCloud destination gets a real sign-in check through Apple's own API. Separately, a scheduled backup engine writes timestamped, encrypted snapshots with automated retention pruning to keep only the last N copies. There is no relay server and no cloud account in this flow.
Session recording, playback, and presentation-video capture
Turn on recording for a session and replay it later at up to 4x speed, or download it as a plain-text transcript. Record presentation mode goes further: it captures the terminal itself side by side with your webcam, narrated over the microphone, and saves it as a real video for a walkthrough or demo. Separately, a command audit log tracks executed ops commands, log pulls, kills, and container actions while keeping interactive keystrokes strictly private.
Browser companion terminal
Open one live session in a browser on your network with a link that expires after a duration you pick (15 minutes to 24 hours, or never). It talks straight to your machine. No relay server, no cloud account, and the browser can never pick a different host than the one you shared. An explicit opt-in with confirmation is required before the link listens on your local area network.
Fleet SSH, playbooks, host monitoring, and containers
Run one command or a playbook across many hosts and see every result together. Save your own commands as custom playbooks right alongside the built-in ones. Pull a journal or file snapshot, or send a Wake-on-LAN packet to a sleeping host. Watch live CPU, memory, disk, and process metrics for a host and kill a runaway process directly, or list and manage Docker, Podman, and Kubernetes containers, start, stop, restart, and pull logs, without a separate orchestration dashboard.
Split panes and broadcast typing
View 2 or 4 sessions at once in a grid instead of switching tabs, with sessions staying alive when you toggle layouts. Turn on broadcast typing to mirror keystrokes from one focused session into others you pick, useful for running the same command across a small cluster by hand.
SFTP client with inline file editing and SSH tunnels
Browse files over SFTP, drag-and-drop to upload or download, and open a remote file directly in your own system's default text editor, the way Cyberduck's "Open" does it, save it there and the edit uploads back automatically. Set Unix permissions with a real checkbox grid instead of memorizing octal. Start local or remote SSH port forwards, or a SOCKS5 proxy, with one-click presets for Postgres, MySQL, Redis, and MongoDB.
Reusable command snippets and macros
Save a command once, with placeholders for the parts that change, and drop it into any terminal from a dropdown, with an optional confirmation step and a one-click sudo toggle. iLead ships with a curated set of security and maintenance snippets already filled in, correct fail2ban and firewall setup included.
Encrypted notes and SSH keys
Notes sit in the vault, not in a side markdown folder. SSH key records stay sealed, with support for agent forwarding and certificate-based auth per host. Encrypted SSH notes travel with the backup file.
Lockout protection and opt-in local servers
Too many wrong unlock passwords in a row locks the vault with an exponential penalty timer that survives restarts. Optionally capture a webcam photo on a failed attempt, resolved once when enabled. Separately, iLead can stand up a local HTTP file server or an inbound SFTP server for quick file sharing, both default to localhost only, with strict opt-in confirmation required for LAN exposure.
App update available notification
Stay up to date without background telemetry or forced restarts. A lightweight semantic version checker queries the official release manifest and displays a discrete amber update badge adjacent to Settings in the navigation bar. Inspect release notes, review version differences, and download the platform-matched installer with one click, or dismiss the notice with a "Remind me later" preference.
1,000 sarcastic Arcana terminal spells
Because professional dev tools don't have to be sterile. An embedded easter-egg catalog of exactly 1,000 unique, sarcastic tech spells spanning DevOps, Cloud, Databases, Security/Pentest, Networking, AI Hype, Gaming, Crypto, Hardware, and Retro Computing. Features procedural FNV-1a hash-derived multi-particle animations, sound effects, dynamic gradient backdrops, and over 100 witty punchlines.
Self-service licensing: manage every device on your seat
See every device holding a seat on your subscription and free any of them yourself, not just the one you're on, the fix for a broken, lost, or retired machine that can't run iLead itself to give up its seat. No support ticket required.
Native SSH client everywhere
Apple silicon SSH without Rosetta. Intel Mac. Windows SSH client, with RDP and VNC for the hosts that need them. Linux SSH client. A 7-day trial needs no account, Connect works immediately; a yearly seat unlocks Ops, Studio, Snippets, Backup, export, and Arcana. After cancel, unlock and export still work.
By the numbers
- 10 database engines in Database Studio (Postgres, MySQL, MariaDB, SQL Server, Oracle, SQLite, CockroachDB, MongoDB, Cassandra, Redis)
- 4 native desktop targets (macOS Apple silicon, macOS Intel, Windows, Linux amd64)
- 15+ import / migration sources (PuTTY, MobaXterm, WinSCP, SecureCRT, Termius, Tabby, NeoServer, Remmina, Bitvise, Royal TS, WindTerm, CSV, JSON, Ansible YAML/INI,
~/.ssh/config) - 1,000 Arcana terminal spells; 2 local MCP tools (
list_hosts,run_command) - 3 cloud discovery providers (AWS EC2, Hetzner, DigitalOcean) with read-only token sync
Your hosts stay home. Nothing in the cloud. Everything on your machine. A yearly seat unlocks the app; it does not upload your fleet.
See yearly SSH license plans · Local SSH MCP guide · Client comparison