SEC 00 // SITREP

Your fleet.
One chain of command.

sgt.sh puts every SSH session to every server you own behind one encrypted relay — keys locked in a vault, each session sealed in its own container, every action audited. Connect from your browser, your terminal, or your AI agent: it all flows through the same accountable pipe.

Deploy Now — $9.95/mo Connect Claude via MCP
  • age/X25519 vault
  • Isolated sessions
  • Full audit trail
  • Hosted MCP

SEC 01 // PLATFORM

Standard issue, every plan

No tiers of trust. Every endpoint you register gets the full kit: vaulted keys, isolated relay sessions, recordings, and agent access.

Encrypted Key Vault

SSH keys are sealed with age/X25519 and never leave the backend — not to us, not to your browser, not to the relay edge. Assign keys to endpoints; every unseal is logged with who, what, and when.

Global Relay Fleet

Think VPN, but for SSH. Your sessions ride a distributed relay net with published egress ranges you can allowlist on your firewalls — one rule, and port 22 goes dark to the rest of the internet.

Isolated Sessions

Every session gets a fresh container with egress locked to exactly one target. No lateral movement, no shared state, nothing left behind when you disconnect.

Web Terminal + SFTP

A full terminal and file browser in any browser. SSH from the field, a locked-down laptop, or a tablet — no client install, no key files on disk, ever.

MCP for AI Agents

A hosted MCP server plugs Claude Code, claude.ai, or Cursor straight into your fleet — list endpoints, run commands, move files — under your RBAC, fully audited.

Audit & Recordings

Every session is recorded as asciicast, and every action — human or agent — lands in a tamper-evident audit trail. Replay any session like a debrief tape.

SEC 02 // RELAY NET

A relay between you and everything you own

Nothing connects to your servers directly. Every session — browser, CLI, or AI agent — is brokered through the sgt.sh relay fleet, deployed across regions so the hop stays short wherever you and your servers are.

  • Published egress ranges. Allowlist our CIDR blocks on your firewalls and security groups, and SSH is closed to everyone else on the internet.
  • Dedicated IPs. Need tighter rules of engagement? Buy an egress IP that only your organization uses — one IP, one tenant: you.
  • Per-session lockdown. Each relay container can reach exactly one endpoint. A compromised session is a dead end, not a beachhead.
Register your first endpoint

SEC 03 // MCP + AI CHAT

Give your AI agent a security clearance

Point Claude Code, claude.ai, or Cursor at our hosted MCP server, and your agent can list endpoints, run commands, and move files across your fleet — with your RBAC deciding what it may touch and the audit trail recording every move it makes.

Prefer batteries included? The built-in AI chat lets you bring your own Anthropic, Gemini, xAI, or OpenAI key, and the agent operates your fleet through the exact same audited relay. No side channels, no unlogged shells.

Enable MCP access
.mcp.json 
{
  "mcpServers": {
    "sgt": {
      "type": "http",
      "url": "https://sgt.sh/mcp",
      "headers": {
        "Authorization": "Bearer ${SGT_TOKEN}"
      }
    }
  }
}
tools: endpoints · exec · sftp scoped by your RBAC

SEC 04 // PRICING

Rules of engagement

One plan, everything included. Scale by endpoint, not by seat — teammates and agents ride free.

Base Deployment

Pack

$9.95/mo

  • 10 endpoints included
  • Full relay fleet access
  • Hosted MCP + AI chat
  • Web terminal & SFTP
  • Encrypted key vault
  • Audit trail & recordings
Deploy the Pack

Grows With Your Fleet

Scale

+$1.00/mo per endpoint

  • Beyond the first 10 endpoints
  • Same relay, vault & audit — no tiers
  • Add or retire endpoints anytime
  • Prorated to the day
  • 50 servers ≈ $49.95/mo, all in
Scale Up

Hardened Egress

Dedicated IP

+$4.95/mo each

  • One egress IP, one tenant: you
  • Pin firewall rules to a single address
  • Never shared, never recycled
  • Stack as many as you need
Claim an IP

SEC 05 // ORDERS

Fall in.

Register an endpoint, vault a key, and open your first relayed session in under five minutes.

Deploy Now — $9.95/mo