I spend a lot of time SSHing into different hosts — prod, staging, dev boxes, database servers. Over time the friction adds up: remembering hostnames, retyping [email protected], losing sessions to flaky networks, accidentally running something on prod when you meant staging.
I looked for a tool that fixed this and didn't find one that felt complete, so I built oken.
What it is
oken is a thin wrapper around your system ssh. Every flag and argument passes through unchanged — so anything that works with ssh works with oken. You can even alias ssh=oken and forget about it.
On top of that it adds a few things ssh has never had.
Fuzzy host picker
Run oken with no arguments and you get an interactive picker over all your saved hosts, sorted by recency. Type to filter. Hit Enter to connect.
Search: █ 6 / 6 hosts
─────────────────────────────────────────────────────────────
prod
> prod-web [email protected] [prod] 2h ago
prod-db [email protected] [prod, db] 3d ago
staging
staging-web [email protected] [staging] 1w ago
dev
dev-laptop [email protected] [dev]
Prefix your search with # to filter exclusively by tag:
Search: #prod█ 2 / 6 hosts
Or from the command line:
oken --tag prod # opens picker pre-filtered to prod hosts
This is the main thing I built it for. Tag-based filtering across a lot of hosts is genuinely useful when you're juggling prod/staging/dev environments.
Everything else
Auto-reconnect. On exit code 255 (SSH connection error), oken retries automatically with a countdown. Disable per-session with --no-reconnect.
Production warnings. Tag a host prod and oken prompts before connecting. Skip with --yes for scripting.
Named tunnel profiles. Save a tunnel once, start it with one word:
oken tunnel add db -L 5432:localhost:5432 prod-db
oken tunnel start db
oken tunnel stop db
Audit log. Every session logged with duration and exit code. oken audit to view.
Shell completions. oken completions sets everything up automatically — detects your shell, finds the right directory, patches your .zshrc if needed.
It's not trying to replace fzf or ssh config
A few people have pointed out that fzf can do fuzzy host picking with a one-liner. True — but that one-liner reads ~/.ssh/config and stops there. No tags, no recency sorting, no reconnect, no tunnel management. oken is the assembled thing, not a building block.
It also reads your existing ~/.ssh/config automatically, so there's nothing to migrate.
Try it
# macOS / Linux
curl -LsSf https://github.com/linkwithjoydeep/oken/releases/latest/download/oken-installer.sh | sh
Written in Rust. Binary is under 2.5MB. No daemon, no background process, no config required.
GitHub: https://github.com/linkwithjoydeep/oken
Feedback and issues welcome — especially if something doesn't work on your setup.