SSH-like shell access without port forwarding, VPNs, or third-party routing. Direct encrypted peer-to-peer connections with a single binary.
$ curl -fsSL https://hop.keik.ai/install.sh | bash
Existing tools all have tradeoffs. hop was built to eliminate them.
TLS 1.3 over QUIC. Your traffic is never decrypted by a relay or third-party service. Keys stay on your machines.
Works behind ISP NAT, double NAT, and carrier-grade NAT. No port forwarding or router configuration needed.
One download. No runtime dependencies, no daemon required for basic use, no accounts to create. Just run it.
Share a link or token to grant access. Each invite is single-use and cryptographically verified. No shared passwords.
Run commands without opening a shell. hop server -- cmd executes remotely and returns the output — perfect for scripts and automation.
Let AI agents manage your fleet. hop mcp exposes a sandboxed JavaScript runtime and skill library to tools like Claude Code—run commands, transfer files, and manage roles through natural language.
Copy files with hop cp or sync directories with hop sync. No separate SCP/rsync needed—transfers use the same encrypted P2P connection.
Your shell survives disconnects. If your connection drops, hop reconnects and resumes where you left off — no tmux needed.
Manage dozens to thousands of machines with role-based access, tagging, and aggregate invites. Learn more →
Store API keys and OAuth tokens encrypted at rest. ChaCha20-Poly1305 with keys derived from your Ed25519 identity. Access from CLI, JS runtime, or MCP.
Schedule cron jobs, enable capabilities like health monitoring and email briefings. hop cap enable email-monitor runs daily AI-powered email triage.
Call any HTTP API directly from JS scripts. hop.http() with bearer tokens, JSON bodies, and sandbox-aware networking. No curl needed.
Restrict peers to read-only, no-network, or scoped paths. OS-native enforcement via macOS Seatbelt and Linux Landlock. Use presets (monitor, audit, deploy) or custom policies. Clients can self-restrict for defense-in-depth.
No accounts, no port forwarding, no third-party routing.
Shell access and file transfer in a few commands.
Run hop host on the machine you want to access. It generates an identity and starts listening for connections.
Run hop invite to generate a one-time token. Send it to whoever needs access—it's single-use and time-limited.
The other person runs hop connect <token> and gets a secure shell. Future connections are just hop <name>.
One command to download, verify, and install.
$ curl -fsSL https://hop.keik.ai/install.sh | bash
$ curl -fsSL https://hop.keik.ai/install.sh | bash -s -- --version 0.4.4
$ curl -fsSL https://hop.keik.ai/install.sh | bash -s -- --dir ~/.local/bin
Downloads the binary, verifies the SHA-256 checksum, and installs to /usr/local/bin. Works with curl or wget.
One command to install hop as a persistent system service on macOS or Linux.
The daemon installer detects your platform and sets up hop as a native system service that starts automatically at boot. Ideal for home servers, dev boxes, VPS instances, or any always-on machine.
/usr/local/bin/hophop host automatically at boot$ curl -fsSL https://hop.keik.ai/install-daemon.sh | bash
Detects your platform, installs the binary, sets up the system service, and starts the daemon. Prompts for sudo.
hop mcp turns hop into an MCP server that AI coding tools can use to manage your infrastructure.
Expose fleet management to AI agents through the standard MCP protocol. Claude Code, Cursor, and other compatible tools can orchestrate your infrastructure through natural language.