Kestro runs your ssh: your keys, your ~/.ssh/config, your jump hosts. It adds the three options nobody ever types, checks the port is free before trying, and puts the state of every door in the menu bar instead of a tab you no longer dare close.
macOS 11+ · Windows soon
The same connection, twice
The command on the left is the one Kestro runs, options included, and the one it shows you in the tunnel’s settings.
Today
$ ssh -N \ -L 127.0.0.1:5432:pg-staging.internal:5432 \ -i ~/.ssh/id_prod \ -o ServerAliveInterval=30 \ -o ServerAliveCountMax=3 \ -o ExitOnForwardFailure=yes \ [email protected] # and that tab stays open all day client_loop: send disconnect: Broken pipe
With Kestro
One switch, in the menu bar. The three options are already there. The jump host comes from your ~/.ssh/config. Nothing to leave open: no terminal is taken. # and if you would rather keep the keyboard: $ kestro with pg-staging -- npm run migrate
Point by point
| ssh -L by hand | With Kestro | |
|---|---|---|
| The program that opens the tunnel | ssh, the one on your machine | The same one, launched by Kestro |
| Your keys and your configuration | ~/.ssh/config, your keys, your agent | the same, read, never rewritten |
| The options that hold the connection | to know, and to type every time | ServerAlive and ExitOnForwardFailure, set |
| The local port is already taken | without ExitOnForwardFailure, ssh connects anyway: the tunnel does not exist | reported “free” or “taken” before you confirm |
| After the Mac sleeps | relaunch it, or install and configure autossh | comes back on its own, if you ticked it |
| Knowing what is open | lsof, ps, or finding the right tab again | the menu bar icon, and one row per door |
| Ten tunnels at once | ten tabs, or ten ssh -f to keep track of | one list, and “Open all” |
| Remote forwards (-R) and SOCKS (-D) | yes, ssh does those | no, Kestro only opens local forwards |
| In a script, in CI, on a server | yes, that is where ssh belongs | no, Kestro is a desktop app |
| Cost | free, it is already installed | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Checked on 4 August 2026 · OpenSSH 9.x
What Kestro adds
None of them changes how the connection is made: your ssh does the work, with your keys. They are about everything around it.
ServerAliveInterval, ServerAliveCountMax, ExitOnForwardFailure: without them an idle connection dies quietly after a few minutes, and a port already taken lets ssh open anyway. The shell is there, the tunnel is not. Kestro sets them on every tunnel, without asking you to know them.
Is the local port free? The answer comes while you are filling in the form, not when your database client refuses to connect to a tunnel that never existed.
An ssh -L occupies a tab you no longer dare close, or goes to the background with -f and becomes a PID you will have to find again. Kestro holds it alongside, and the state of each door reads from the menu bar.
The SSH bastion, the Cloud SQL database, the Google VM through IAP, the EC2 through Session Manager: four tools and four syntaxes. One list, and the same switch.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
When ssh alone is enough
Better said here than discovered after paying.
Kestro is a desktop app: it needs a session to be open. In a CI job, in a container, in a systemd unit, ssh is what you want, and nothing else.
Kestro only opens local forwards. A remote forward, a dynamic SOCKS proxy, agent forwarding: ssh does them, Kestro does not offer them. You can hand it your own command line, but then it is no longer the one composing it.
Kestro only runs on macOS 11 and later. The Windows version is in the works; there is no Linux version planned.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
No, it runs it. The command executed is an ordinary ssh -N -L, with your options, and it is shown as-is in the tunnel’s settings. There is no reimplemented SSH library, no in-house protocol, no relay: it is your machine’s binary, with your agent and your keys.
No, it is read as it is. Your hosts, your jump hosts, your users and your keys stay the reference, and Kestro never writes to it. If you edit the file, it re-reads it. The day you uninstall Kestro, your ssh works exactly as before.
autossh does what it promises: it restarts a tunnel that drops. You have to install it, wrap it in a script per tunnel, and the state stays invisible unless you go looking. Kestro covers the same need without a script. And above all, recovery is ticked per tunnel, never by default: a door onto production does not reopen unless you asked for it.
No. Kestro reads none, copies none, stores none: it runs ssh the way you would, and your agent answers. Everything opens directly between your machine and your servers. Nothing passes through our infrastructure, and since there is no account, we do not even know that you are opening a tunnel.
Yes: a tunnel’s command can be replaced with yours, and Kestro then runs the line you wrote. That is the way out for a setup of your own: a -R, an exotic ProxyCommand. Everything else keeps working, including the state in the menu bar, except that the displayed port becomes your claim rather than its promise.
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.