A desktop app for managing the servers you reach over SSH, in one window
Nothing gets installed on the server
English · 한국어
Download · Features · Security · MCP · What's verified · Contributing
One connection covers files, the editor, services, processes, containers, the network, sessions, monitoring and a terminal.
Nothing was installed on the server.
Connect to a server over SSH once, and all of this is in the same window.
| Files | Browse, upload, download, transfer whole folders. An interrupted transfer resumes |
| Editing | A syntax-highlighting editor that shows you the difference from what is on the server before it saves |
| Services · processes · containers | systemd units and Windows services, a task-manager-style process table, Docker and Podman containers and Compose projects |
| Monitoring | CPU, memory, disk, network and NVIDIA GPUs, with trends over time and system events |
| Security · sessions | Firewall and fail2ban status, who is connected right now, a summary of failed logins |
| Terminal | A built-in terminal with tabs, splits, themes and your choice of font. Commands that open a file, like vi nginx.conf, open it in the app's editor instead |
| AI work | What MCP clients did on your servers through LiteDeck, as a graph per session — and the file changes, ready to put back |
| Settings sync v2.3.0 | Export your host list and approval policies as one encrypted file and take it to another machine |
The full list, with the detail, is in the feature document.
The app speaks English and Korean. It starts in your operating system's language, and EN / KO
at the bottom of the sidebar switches it. Every document linked from here has an English version,
except the contributing guide.
- Nothing to install on the server. No agent, daemon or package — it works over the SSH port you already have open. What is left on the server is whatever you asked it to do
- It shows you the commands it ran. Everything you do on screen is recorded in the Command Log as the actual command. When something needs administrator rights (sudo), it asks first rather than adding it on its own
- No account to sign up for. Nothing about your use is collected, and the whole source is public
- Lightweight. Not Electron. About a 6 MB download and 17 MB installed on Windows, and it starts in under a second (sizes measured on v2.4.0; the macOS build is an Intel/Apple Silicon universal binary, so 12 MB and 30 MB there)
An agent edits an nginx config and restarts nginx. Each call becomes a node as it happens;
the change is shown as a diff and put back with one click.
Let AI work freely on your servers. What it did shows up as a graph, and changed files can be put back.
MCP clients such as Claude Code and Codex read and change your servers through LiteDeck — over the same SSH connection as the screen, recorded in the same Command Log, with nothing installed on the server.
- See what it did. The AI work screen draws each session as a graph: a band per host, time left to right, a file change linked to the restart of the service it belongs to. Give each client its own token and the graph says which one did what
- Put files back. Before an AI overwrites or deletes a file, the previous contents are kept on this machine — 7 days by default. Undo one change, or every file change in a session, newest first; a file something else changed since is skipped and listed
- The controls you already had stay as they were. File changes are confirmed with a diff by default; per server you can confirm everything, or stop asking for a few hours. Running commands and deleting files are separate switches, off by default. None of it can be changed from the AI client's side
- What it cannot see or undo. Only work that went through LiteDeck is in the graph — not what an AI did over SSH by itself, and not what you typed in a terminal. Undo restores file contents only; restarts, killed processes and commands stay done
claude mcp add --transport http litedeck http://127.0.0.1:<port>/mcp \
--header "Authorization: Bearer <token>"→ MCP integration — the 18 tools, the approval modes, the graph and its limits
Grab a build from the releases page.
| File | For |
|---|---|
litedeck-desktop-macos.zip |
macOS (universal, Intel and Apple Silicon) |
litedeck-desktop-windows-amd64.zip |
Windows 10/11 (amd64). Unzip to a single litedeck.exe, no installer |
litedeck-desktop-linux-amd64.tar.gz |
Linux (amd64). Ubuntu 24.04 or newer — it needs libwebkit2gtk-4.1. On 22.04, build from source |
Warning
These builds are not code-signed. Signing and notarisation both cost money, so early releases ship unsigned, and the SHA256 checksums published alongside them are not a substitute for a signature. If you need that assurance, build from source.
That is also why the first launch trips macOS Gatekeeper and Windows SmartScreen. How to get past both is in Install and server setup.
First connection
- Open the app and press + Add at the top left. If you use
~/.ssh/config, Import brings those hosts in at once - Enter the address, the user and how to log in (SSH agent, key file or password)
- The first time you connect to a server, you are asked to confirm its host key fingerprint. Confirm it and the server's tabs open
On the server side. Linux needs nothing if you can already SSH into it. Windows needs the OpenSSH server switched on. To reach a machine at home from outside, a mesh VPN beats opening a port on your router — preparing the server · reaching it over Tailscale
Use it from a web browser — server mode. Instead of the desktop app, you can put LiteDeck on one
server and open it in a web browser — litedeck-server-linux-amd64.tar.gz ·
litedeck-server-linux-arm64.tar.gz. In that case LiteDeck runs as a web server and has a login
page. Running it, exposing it and setting up the login are covered in
server mode.
Note
Runs on macOS, Windows and Ubuntu — all three confirmed by opening it there. What was tested where is written down in What is and is not verified. Try the irreversible actions — deleting files, killing processes — on a throwaway server first.
- Servers it manages: Linux with systemd (Ubuntu, Debian, Raspberry Pi and so on) and Windows (with the OpenSSH server). Windows servers get the sessions and security tabs; the events tab is not there yet
- Machines it runs on: macOS, Windows 10/11, Linux (Ubuntu 24.04 or newer)
When this is the right tool
- You run somewhere between two and six servers yourself. You read logs, restart services and fix config files on them
- You do not want to install anything else on those servers. SSH is already open, and you would like that to be enough
- You want a GUI, but you still want to see what it ran
- You are not giving up your terminal. You just want the frequent things to be a click
If you need dozens of servers at once, declarative state, or a real remote development environment, something else is better. Which cases those are is written down in when it is not.
| Security | Host key verification, authentication, credential storage, sudo, the MCP endpoint. What it cannot do comes first |
| What is and is not verified | What was checked where, and what was not. Plus when this is not the right tool, and the non-goals |
| MCP integration | 18 tools, the approval policy, the AI work graph, undo, the safeguards |
| Features in detail | The full feature list, plus the Command Log, the editor, transfers, Compose, the sshd check and ProxyJump |
| Install and server setup | Getting past the first-launch warning, enabling OpenSSH on Windows |
| Reaching a machine over Tailscale | Your home machine without port forwarding. Tailscale SSH, MCP, subnet routers, and doing it without an account |
| Build from source | Building and testing |
See CONTRIBUTING.md (Korean). The design goal is that supporting a new server OS means writing one adapter, which is how Windows support landed. OpenRC (Alpine), launchd (macOS) and FreeBSD are all open.
Please open pull requests against the dev branch — main only receives releases.
Found a vulnerability? Please email cpprhtn@naver.com rather than opening a public issue.