Core Tunnel
SSH tunnels · local, remote and dynamic forwards and that is the scope.
Two tunnel managers in the menu bar.
Core Tunnel is a good tool, and the more complete of the two on plain SSH. Kestro covers fewer SSH options, but also opens what is not SSH (Cloud SQL, Google VMs through IAP, EC2 through Session Manager) and holds your projects, your scripts and the state of your services in the same panel.
macOS 11+ · Windows soon
Two ways of seeing the problem
One does tunnels very well. The other does what is around them.
These are not the same product, and this page exists so you pick the one you actually need.
Kestro
SSH tunnels · local forwards Cloud SQL, Google VMs via IAP, EC2 via SSM Your repositories, their branch, their services Your scripts, started and followed The addresses you watch, alert in the menu bar A command line that composes
Point by point
What each one covers.
| Core Tunnel | Kestro | |
|---|---|---|
| System | macOS 12 and later | macOS 11 and later |
| SSH tunnels | yes | yes |
| Remote (-R) and SOCKS (-D) forwards | yes | no, local forwards only |
| Google Cloud SQL | no | yes, through the official proxy |
| Google VMs through IAP | no | yes, through gcloud |
| EC2 through Session Manager | no | yes, through the aws CLI |
| Beyond tunnels | none | Git projects, scripts, service monitoring |
| Favourites and grouping | yes | yes |
| Configuration import and export | yes | yes |
| Your SSH secrets | kept in the macOS Keychain | none is stored: your agent answers |
| Automatable | AppleScript and Automator | the kestro command, from any shell |
| Free version | yes, limited to one host | 7-day trial, no card |
| Price | $9.99 for one year · $29.99 for three years · $99.99 lifetime | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once, one year of updates included |
Checked on 4 August 2026, from Core Tunnel’s product page and App Store listing. Prices are those shown on that day.
What Kestro does on top
Four things a tunnel manager does not do.
They do not make it a better SSH tool; on that ground Core Tunnel goes further. They make it a tool that covers the rest of the day.
The tunnels that are not SSH
A Cloud SQL database through Google’s official proxy, a VM with no public address through IAP, an EC2 through Session Manager. That is three tools, three syntaxes and three sets of documentation. Here, one list and one switch.
Your repositories
The branch, what has changed, what is left to push, on this Mac and on your remote machines. The dev server and the docker compose services start from the row.
Your services, watched
Sites, APIs, ports: checked continuously from your own machine. The moment one goes down, the menu bar icon changes, and the panel gives the error code and how long it has been that way.
A command that composes
kestro with notes-db -- npm run migrate opens the tunnel, waits until it actually answers, then runs. psql "$(kestro url notes-db)" slots into a sentence no interface will ever write for you.
Kestro1 tunnel open · 1 service isn’t answering
bastion-prodprodSSHshellbastion.kestro.internalclosed
notes-dbstagingPostgreslocalhost:5432pg-staging.eu-west-1.rdsopen
run-eventsprodMongolocalhost:27017mongo-prod.atlasclosed
⌘K palette↑↓ navigate␣ togglecloses if you click elsewhere
run-tracker , zsh
➜
Applying 2 migrations to shop-staging-db…
20240612_add_orders_index ok
done in 1.4s
run-tracker , zsh
# every door, and which ones are open
➜
tunnel notes-db ouvert :5432
tunnel run-events ouvert :27017
tunnel bastion-prod fermé
On your machine
Everything stays with you.
Your connections run from your computer to your servers, never through us.
No account
Nothing to create, no password.
Your keys stay put
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
No usage statistics
We don’t know what you open, or when.
One exception
Your licence renews with us. Nothing else leaves.
What Kestro does not do
Three gaps, and they are real.
Better read here than discovered after paying.
No -R, no -D
Kestro only opens local forwards: a door from your machine to a remote service. A remote forward or a dynamic SOCKS proxy, it does not compose. You can hand it your own command line, but then it is no longer the one writing it.
No AppleScript bridge
Automation goes through the kestro command, from any shell, rather than AppleScript or Automator. Depending on what you already automate, that is a gain or a loss.
The trial stops after 7 days
Seven full days, no card and no account, then you need a licence: {prix} once, one year of updates included. There is no permanent free tier.
Pricing
You pay once. That’s it.
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
€29.99$29.99£25.99CHF 25.90CA$40.99A$45.99€39.99$39.99£34.99CHF 33.90CA$54.99A$61.99 · Launch offer · upcoming price
1 computer · one-time
- Every feature of the app, no tiers, no “Pro” edition
- One year of updates included, then renew if you want to
- The app stays yours, renewed or not
- One key, the same on all your computers
- Switch machines whenever you like, no limit
- No account to create: the key arrives by email
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
I only build SSH tunnels. Which one should I take?
First check whether you need a remote forward or a SOCKS proxy: Core Tunnel composes those, Kestro does not, and that settles it immediately. Otherwise the question becomes one of scope: an SSH tunnel opens the same way on either side, but here it sits in the same list as the Cloud SQL database, the repository that serves it and the address you watch. If you never open anything but local SSH, the gap comes down to price and to what you want in your menu bar.
Can both live side by side?
Yes, as long as they do not open the same local port at the same time. Both run your ssh with your keys, neither stores anything of its own on the server side, and they do not step on each other. Kestro will in fact tell you a port is taken before trying.
Why pay once rather than subscribe?
Because a tool you open forty times a day should not send you a bill every month. The Kestro licence is bought once and includes one year of updates; after that year you renew if you want to, and if you don’t, you keep the version you have: it goes on working, and its security fixes stay free. The same key covers as many computers as you paid for, with no account to create.
Are the prices in this table current?
They were taken on 4 August 2026 from Core Tunnel’s product page and App Store listing, and the date is shown under the table for that reason. Pricing changes without notice: check on their side before deciding, and write to us if you spot a discrepancy; we will correct it.
Does the trial ask for a card?
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.