SSH gateway for kivel commands

What the SSH gateway does

The SSH gateway runs the same commands as the kivel CLI on the server, so you can use Kivel from any machine with an SSH client and no Node.js. It is an optional component that an operator enables; the Docker setup binds it to localhost:2222 by default and exposing it publicly is an operator decision.

Each connection runs one command. There is no interactive shell, no terminal, no port forwarding, no SCP and no SFTP.

Connect

Log in as user kivel with a workspace API key (kv_...) as the password. Commands must start with kivel. Pipe JSON to memory set, monitor create, approval ask, mock creation and other commands with a body; pipe bytes to upload or run --file. Use -n for read-only commands. The local CLI listen command is not offered over SSH.

# Verify the host fingerprint before the first connection.
printf '{"hello":true}' | ssh -T -p 2222 kivel@your-host kivel run json
ssh -T -n -p 2222 kivel@your-host kivel resources
ssh -T -n -p 2222 kivel@your-host kivel inbox create --visibility public

Session limits

Output is compact JSON on standard output; errors are JSON on standard error with exit status 1. Plan allowances and scopes are the same as for HTTP.

• Authentication: password only, user kivel, up to 4 attempts per connection and 10 per 15 minutes per IP address.
• One command per session; send it within 10 seconds of opening the session.
• Commands stop after 30 seconds; a connection closes after 120 seconds.
• Standard input up to 10 MiB.
• Up to 4 connections per IP address.
• The API key is checked again for every request, so a revoked key stops working immediately.