Server inventory and SSH management for macOS, Windows and Linux

You know what runs on your servers again.
No agent, no cloud.

Services, containers, certificates, uptime and logs for every host. In one overview your own machine puts together, over SSH.

Try free for 7 days See what's inside

No subscription, no cloud account. The vault is AES-256 encrypted and stays on your machine. Then €39 once.

  • Open a server and see its state, open services, TLS certificates and what has changed.
  • Pull your whole fleet in from twelve cloud providers in one click, instead of typing it up.
  • Let the log triage fetch journalctl, syslog and nginx over SSH and name the probable cause.
  • Keep every credential in a vault only your passphrase opens, with an append-only audit log beside it.

SSH-based · Linux, macOS & Windows targets · SQLCipher-encrypted vault

ServerShelf — Servers
ServerShelf showing a server's overview, health and AI tools

macOS 12+ (signed + notarized) · Windows 11 · Linux AppImage/deb

Your server data is spread across spreadsheets, cloud portals and terminals.

Your inventory is out of date again.

A spreadsheet only shows what was true the last time someone updated it by hand. The containers, services and packages that came up since are already missing.

Every provider shows you one piece of it.

Servers, health, certificates, costs and notes sit in different portals and different tools.

When something fails, the search starts over.

Connect over SSH, find the right unit, pull the logs, compare several sources. On every host, every time.

ServerShelf collects all of that directly over SSH and brings it together locally, in one overview that is actually current.

Try free for 7 days

Your local
server cockpit.

For people who run several servers and want to see, fast: what's running where, what's critical, what changed.

Why ServerShelf exists

It started with a server I shouldn't have reset.

One afternoon I reset a cloud VPS and wiped an n8n instance I'd completely forgotten was running on it. It was quietly powering automation agents for a system people still depended on. Gone, with a single command.

So I did what everyone does: I opened a spreadsheet. Dev, staging, prod: every server, with its databases, web servers and the apps running on each. Finally, an overview.

Within a week the spreadsheet was already out of date. The real problem was never the missing list; it was having to keep it by hand. So I built the thing that fills itself in: connect over SSH, scan, and the inventory is simply there. That became ServerShelf.

— Christof, builder of ServerShelf

Features

Everything in one place.

At the core: a single overview of your fleet, automated import from twelve cloud providers, and AI log triage that points at the probable cause. Everything else builds on that.

🩺

AI log triage

Pick a server, pick a source (journalctl, syslog, auth.log, nginx, Apache, dmesg, Docker). ServerShelf auto-fetches the last N lines via SSH, then sends them to your own AI key. You get a probable root cause, ranked next steps, and a suggested fix, with no copy-paste tour through five Stack Overflow tabs. Manual paste still works for logs from anywhere else.

📥

One-click provider import

Twelve providers in one place: Hetzner, AWS, DigitalOcean, Contabo, Vultr, Linode, Scaleway, IONOS, OVHcloud, Proxmox, Kubernetes, VMware vSphere. Re-sync at any time; your notes, tags and projects stay intact.

🗂

Fleet overview at a glance

Every server, every project, every tag, all in one window. Pending updates, SSL expiry, uptime status, SMART warnings. Click a tile to drill in. Snooze what you can't act on right now.

🔍

Agentless cross-OS scans

One click, plain SSH (key or password). ServerShelf detects the target OS and runs the right probe: Linux reads dpkg/rpm/apk, systemctl, journalctl; macOS uses brew, launchctl, sw_vers; Windows uses PowerShell with Get-CimInstance, Get-Service, Get-NetTCPConnection. About six seconds per server. Nothing is installed, nothing changes on the host.

🌐

Real TLS certificate monitoring

Every six hours, ServerShelf opens an actual TLS handshake to domain:443 and parses the certificate (issuer, SAN list, validity window). It warns 30 days before expiry and handles self-signed, expired, and wildcard SANs.

📦

Software & license vault

Per server: installed packages, versions and install method. Software-license keys (Mailgun, Sentry, Adobe and friends) live in an AES-256-GCM vault with seats, vendor, renewal date and cost. Reveal on demand.

🐳

Remote Docker control

Start, stop, restart, remove and create containers on the host's Docker engine, all over SSH. Stream logs live. Works on any server with docker installed; your laptop doesn't need Docker.

⏱

Uptime, content and log checks

HTTP, TCP, ping, DNS and mail-server checks, plus a script or a log pattern on any of your servers over SSH. Rules on the response: required or forbidden text, a number with min/max, and change detection that tells you when a page changed. Weekly pause windows, a run history with availability over 24 h, 7 d and 30 d, and CSV or HTML reports. Runs while the app is open; a heartbeat to Healthchecks or ntfy covers the rest.

💻

Built-in PTY terminal

A real PTY-backed SSH terminal per server: resize, ANSI colors, scrollback. A snippet library you can run with one click. An SSH-key deployment helper for first-time setup.

🔐

Encrypted backups & cloud sync

Export the full inventory to one AES-256-GCM file (Argon2id KDF, 64 MiB / 3 iter). Cloud sync ships the same blob to your iCloud Drive, S3 bucket or WebDAV folder, end-to-end encrypted, with no one but you holding the key.

⏲

Auto-lock & biometric quick-unlock

A configurable idle timer locks the vault automatically. Optional Touch ID / Windows Hello quick-unlock via the OS keychain; the passphrase never leaves disk and is never reused. Lock manually with one click in the sidebar.

📜

Append-only audit log

Every destructive or credential-touching action (server delete, container kill, snippet on remote, AI prompt) lands in the audit log with timestamp, target, duration and outcome. SQLite triggers block UPDATE and DELETE, so the app cannot quietly edit its own trail.

12 providers, one inventory

Import your whole fleet in one click.

Pull servers in with their IP address, operating system, location and status straight from Hetzner, AWS, Proxmox and nine more providers. Bare-metal servers, homelab systems and Raspberry Pis you can add by hand.

Hetzner
AWS
DigitalOcean
Contabo
Vultr
Linode
Scaleway
IONOS
OVHcloud
Proxmox
Kubernetes
VMware vSphere
Try free for 7 days

AI Cockpit

An AI that
actually knows your fleet.

Ask plain-language questions about any of your servers. Paste a log excerpt and get a probable root cause. Generate shell snippets from a description. Read a daily briefing of what changed across the fleet, spot anomalies in metrics, review nginx, sshd and fail2ban configs, sketch architecture diagrams, plan migrations, forecast capacity. Twenty-plus AI workflows, all reading straight from your local inventory.

  • Chat with your inventory · daily briefing · anomaly detection
  • Log triage · config review · remediation · architecture diagrams
  • Snippet generation · runbooks · migration plans
  • Impact analysis · capacity forecast · cost optimization
  • License & EOL audit · documentation generator · notification digest
  • Cross-pattern detection · naming decoder · compliance checks

Bring your own key. Your prompts never touch our servers; they go directly from your machine to the AI provider you picked.

Supported AI providers

Anthropic Claude · you provide the API key
OpenAI GPT-4 / GPT-5 · you provide the API key
OpenRouter 300+ models · you provide the API key
Mistral EU-hosted · you provide the API key
Groq Fast inference · you provide the API key
Google Gemini Gemini 1.5 / 2 · you provide the API key
Ollama Fully local · no API key, no network

No vendor lock-in. Switch providers in Settings → AI any time.

Security by default

Seven lines of defense, every install.

Server data is sensitive. ServerShelf treats it that way: nothing leaves your devices unless you send it, every secret is encrypted at rest, and every privileged action is logged.

Your SSH keys stay on your machine.

ServerShelf keeps credentials in the encrypted vault on your device and nowhere else. There is no ServerShelf cloud account to sign into, and no sync of your keys to us.

SQLCipher AES-256 database

Your entire inventory lives in one SQLite file, but every page is encrypted with AES-256. The DB cannot be opened with a regular SQLite browser.

Argon2id master passphrase

Your passphrase is stretched through Argon2id (64 MiB, 3 iterations) before it can unlock the DB key. Brute-force becomes economically pointless.

Offline ed25519 license check

Your license is verified locally with an ed25519 signature, so activation works offline. Once a license is stored, the app asks our server at startup whether it has been revoked. That request carries only a hash of the license email, and the app stays usable when the request fails. No telemetry.

Append-only audit log

Every destructive or credential-touching action is logged. SQLite triggers block UPDATE and DELETE on the log, so the app cannot quietly edit its own trail.

No usage tracking. Ever.

No analytics SDK, no usage metrics, no picture of how you work. What does reach our servers is the short list in the FAQ: a revocation check once a licence is stored, an update check you can switch off, and whatever you send us yourself. Crash reports are opt-in and only go to Sentry if you enter your own DSN.

No cloud account required

You buy the app and it runs. No sign-up, no account, no email verification. Cloud sync is optional and ships an encrypted blob to a bucket you own.

Try free for 7 days

Local-first by design

Your data goes where you send it. Nowhere else.

🗄 SQLCipher-encrypted database

Your entire inventory lives in a single file in your app-data directory, page-level AES-256 encrypted via SQLCipher. The database key is sealed with your master passphrase (Argon2id) plus a one-time recovery code. Even physical access to the file is useless without one of the two.

🔐 End-to-end encrypted sync

Cloud sync derives an Argon2id key from your passphrase, then AES-256-GCM-encrypts the snapshot. Apple, Hetzner, or whoever runs your Nextcloud sees only an opaque blob.

🚫 No usage telemetry

No analytics SDK, no usage metrics, no “anonymous statistics”. The calls that do reach our servers are the licence and update checks the FAQ lists in full. Crash reports are opt-in and only route through Sentry if you provide your own DSN.

🔑 Bring your own AI keys

Your AI provider keys stay on your machine. Prompts go directly from your app to your chosen provider. We never see them, and we host no model of our own.

Pricing

Buy once. Own forever.

Introductory pricing: early-adopter discount, prices rise after launch

Pay once. No subscription. iOS & Android companion apps included when they ship. AI works with your own provider key, at no extra cost, with no monthly bill and no vendor lock-in.

Before you buy: ServerShelf is an SSH-based tool. It scans and manages servers you can reach via SSH: Linux, macOS and Windows (with OpenSSH Server installed) all work. Hardened jump-hosts without SSH and pure SaaS platforms are not supported.

Personal

€39 once

For solo developers, freelancers, homelabs and side projects.

  • ✓ Unlimited servers & projects
  • ✓ All 12 cloud-provider imports
  • ✓ AI Cockpit (bring your own key)
  • ✓ iOS & Android companion included
  • ✓ 1 user, install on as many of your own devices as you like
  • ✓ 1 year of updates, yours to keep forever
  • ✓ 7-day free trial, no credit card required
Buy now for €39 Download free 7-day trial
Best value

Shelf Bundle

€89 once

ServerShelf + DeviceShelf, once, incl. VAT.

The local infrastructure bundle: manage your servers and map the network they live in.

For homelabs and small teams that own both the machines and the LAN they run on.

  • ✓ ServerShelf: SSH inventory, updates, Docker, TLS/Uptime and AI log triage
  • ✓ DeviceShelf: LAN devices, ports, topology and security report
  • ✓ Local-first apps: no account, no telemetry, no subscription
  • ✓ 1 registered user, bound to the checkout email, for both apps
  • ✓ 7-day free trials for both apps
Get the bundle for €89 See DeviceShelf ↗

Honest expectations

What ServerShelf is and isn't.

Please read this before you buy. It saves both of us a refund.

✓ What it is

  • An SSH-based inventory tool that catalogs your servers and what runs on them.
  • A read-only scanner that runs shell commands (dpkg, systemctl, docker ps, …) and parses the output.
  • A local dashboard for SSL expiry, uptime checks, SMART warnings and license tracking.
  • An AI assistant that turns inventory data plus your prompts into answers (chat, briefings, log triage, snippets).
  • A Docker controller for start, stop, restart, logs and create on remote engines.
  • A connection manager with built-in PTY terminal, snippets and key-deployment helpers.

✗ What it isn't

  • Not a monitoring platform like Prometheus or Datadog: uptime and SSL checks are poll-based, not a 24/7 stream.
  • Not a configuration manager like Ansible or Puppet: it scans, it doesn't push state.
  • Not a log-aggregation platform: it tails docker / journal logs on demand, it doesn't store them.
  • Not an agent-based system: pure SSH, so anything SSH can't reach won't be scanned.
  • Not a collaboration tool: cloud sync is async, last-writer-wins, not real-time multi-user editing.
  • Not compliance-certified: we make privacy claims and document them, but we don't yet have a SOC2 or ISO 27001 audit.

⚙ Requirements

  • Server side: SSH access (key or password) with a user who can run dpkg/rpm/apk, systemctl, docker ps. Most distros work out of the box.
  • Client side: macOS 12+, Windows 11 or Linux. ~200 MB disk, <200 MB RAM idle.
  • AI features: bring an API key from Anthropic, OpenAI, OpenRouter, Mistral, Groq or Gemini, or run Ollama locally. No key means no AI, but everything else still works.
  • Mobile: iOS 17+ / Android 8.0+. Cloud sync needs an iCloud Drive, S3 bucket or WebDAV server you provide.
  • Cloud import: an API token for each provider you want to import from.

Frequently asked

Questions, answered.

Where is my data stored?

In one SQLite file in your OS app-data directory, AES-256 page-encrypted with SQLCipher. Optional cloud sync uploads an opaque, end-to-end-encrypted blob to your own iCloud Drive, S3 bucket or WebDAV folder, and we never see it.

What does ServerShelf send over the network?

SSH connections to the servers you add. HTTPS to the AI provider you picked, only when you trigger an AI action. HTTPS to your cloud providers when you run an import, and to your own bucket if you use cloud sync. Four things reach our own servers: a revocation check at startup once a license is stored (a hash of your license email), a version check at launch and once a day if you allowed it at first start (or when you click “Check for updates”), the feedback form when you send it, and, if you pair the mobile app, alert notifications relayed through our push service to Apple or Google, which carry the server name or check target in their text. No analytics, no usage telemetry.

Do I need an agent on each server?

No. ServerShelf uses plain SSH with your existing key pair (or password). Scans are read-only commands: uname, dpkg, systemctl, docker ps and friends. Nothing is installed on the host.

Can I bring my own AI key?

Yes, and it's the only way. Drop in your Anthropic / OpenAI / OpenRouter / Mistral / Groq / Gemini key, or run Ollama locally for fully offline AI. We don't host any model; your prompts always go directly from your machine to your chosen provider.

Which AI providers are supported?

All seven, side by side: Anthropic (Claude), OpenAI (GPT-4 / GPT-5), OpenRouter (gateway to 300+ models), Mistral (EU-hosted), Groq (fast inference), Google Gemini, and Ollama (fully local, no API key, no network). Switch any time in Settings → AI.

How many devices can I install on?

Personal: 1 user, unlimited devices. Team: 6 users, unlimited devices each. The license is per user, not per machine.

What happens after 1 year of updates?

You keep the version you have, forever. No bricking, no nag screens, no offline-mode penalty. To get further updates, renew at 50 % of the then-current price.

Refund policy?

14 days, money-back, no questions asked. Email hello@servershelf.app from the address you bought with.

Linux / Windows support?

Yes. ServerShelf ships desktop builds for macOS 12+ (Apple Silicon, signed + notarized), Windows 11 and Linux (AppImage/deb). The app scans Linux, macOS and Windows targets over SSH.

Weighing your options? Compare ServerShelf with Termius, XPipe, Royal TSX & Simon →

Out now

iOS & Android companion.

A small, read-mostly companion to the desktop app. Glance at your fleet from the couch, get a push notification when uptime drops, triage from the train. Free on the App Store, and a direct download on Android.

iOS & Android companion

Your fleet, in your pocket.

Native iOS and Android apps that read your inventory directly from iCloud Drive, S3 or WebDAV — end-to-end encrypted. Works without your desktop running. Works on cellular. Works on a plane.

  • Read-only inventory view
  • Triage alerts (SSL expiring, uptime down)
  • Server detail, search, tags
  • Pair via QR (LAN) or iCloud folder picker
Download on the App Store Direct download Get the Android app

A direct download, and that's how we ship it. We're not putting ServerShelf on Google Play: for a local-first tool, the store's review hurdles and Google's grip on Android aren't a trade worth making. It's the same signed app as on iOS: free, it pairs with your desktop.

Free on the App Store, iOS 15 and up. On Android it is the same signed app, straight from us.

How to install
  1. Tap Download. Your browser asks once to allow installing apps. Tap Allow.
  2. Open the downloaded ServerShelf .apk file.
  3. Tap Install. That's it.

Talk to us

Bug, feature wish, or sales question?

We read every message and usually reply within a working day. For technical bugs the in-app Help → Send feedback dialog ships extra context automatically. Otherwise, this form:

Or email hello@servershelf.app directly.
DeviceShelf

From the same workshop

Map your network too, with DeviceShelf

DeviceShelf is our local-first network scanner: discover every device on your LAN, see open ports and a security report, and get presence alerts. Same principles: one-time purchase, no cloud account, no telemetry.

Discover DeviceShelf ↗