Host web-01 #tag: production,web,eu HostName 203.0.113.10 User deploy IdentityFile ~/.ssh/prod_ed25519

Host db-primary #tag: production,database HostName 203.0.113.20 ProxyJump web-01

Then use those tags as filters:

SSM supports full Include recursion, globs, #tagorder, and cycle detection.

Cloud provider sync
Discover running servers and write them into your SSH config with zero manual work:

- Each provider gets its own file under ~/.ssh/config.d/50-ssm-{provider}
Include config.d/* is added to your main config automatically

Hosts are tagged with the provider name so you can filter with ssm aws

Supported providers and credentials:
Hetzner: HCLOUD_TOKEN

AWS: standard SDK chain (AWS_PROFILE, env vars, IAM role)

GCP: GCP_PROJECT + Application Default Credentials

Azure: AZURE_SUBSCRIPTION_ID + Azure auth chain

Key bindings (TUI)

| Key          | Action                              |
|--------------|-------------------------------------|
| Enter      | Connect (SSH or Mosh)               |
| Tab        | Toggle SSH ↔ Mosh                   |
| p          | Ping selected host                  |
| P          | Ping all visible hosts              |
| y / Y    | Copy host name to clipboard         |
| /          | Fuzzy search / filter               |
| q or Ctrl+c | Quit                             |
| Ctrl+e     | Edit ~/.ssh/config in $EDITOR   |
| Ctrl+r     | Run command on selected host        |
| Ctrl+s     | Open SFTP file browser              |
| Ctrl+v     | Toggle parsed config inspector      |
| Ctrl+y     | Open cloud sync panel               |
| Esc        | Clear filter / close panels         |

Emacs navigation (Ctrl+p/n/b/f) also works.

CLI flags & batch usage

env var also works: SSM_BACKEND=mosh ssm

The -r / --command flag (and the newer ssm exec subcommand) are fully scriptable and exit non-zero if any host fails. Use ssm exec --help for the current options including --delay, --threads, and jitter control.
Note: --backend / SSM_BACKEND (and the Tab toggle) only affect direct Enter connections in the TUI. Batch execution, the legacy -r path, and the Ctrl+r "run command" submodel always use ssh.

Security & hardening
SSM is built for production infrastructure teams:
Zero software is ever installed on remote hosts
Every SSH, mosh, and SFTP invocation uses the -- delimiter to prevent flag injection

BatchMode=yes + RequestTTY=no for all non-interactive operations

Sensitive keys (IdentityFile, ProxyCommand, etc.) are filtered from the config viewer

SSH config file permissions are checked (warns if not 0600)
All remote output is sanitized (ANSI stripped, stderr truncated)
Ping uses ordinary TCP connects — no raw sockets or elevated privileges

See SECURITY.md for the full model.
Installation
Fastest:

Package managers:

| Platform       | Command |
|----------------|---------|
| Go             | go install github.com/lfaoro/ssm@latest |
| macOS          | brew install lfaoro/tap/ssm |
| Arch Linux     | yay -S ssm-bin (AUR) |
| Nix            | nix profile install github:lfaoro/ssm |
| Nix (run)      | nix run github:lfaoro/ssm |
| Debian         | sudo apt install ./ssm__linux_.deb download from Releases |
| RPM            | sudo rpm -i ssm__linux_.rpm download from Releases |

Pre-built static binaries for Linux, macOS, FreeBSD, and OpenBSD (amd64 + arm64) are available on the releases page.
From source:

requires Go

Development

See CONTRIBUTING.md.

The project follows a strict “never commit unless explicitly told” policy for AI agents and careful humans. Full rules are in AGENTS.md.

Release process is documented in DEPLOY.md.

Sponsorship

SSM is developed in the open.