MobaRust / open alternative
Read the
receipts.
A compact guide to the free, open-source MobaXterm alternative: what MobaRust does today, where the native boundary lives, and which capabilities still need real platform evidence.
Make the handshake legible.
MobaRust keeps SSH connection work inside the Rust/native boundary. The session model separates connection configuration from secret material and exposes typed state to the UI.
| Surface | Current focus | Status |
|---|---|---|
| SSH | Host-key verification, auth paths, PTY, cancellation, timeout, reconnect state | evidenced |
| Local shell | Native PTY lifecycle, resize, output batching, and explicit child cleanup on close | evidenced |
| Telnet | Legacy connectivity, explicitly identified as unencrypted | foundation |
| Serial | Device settings, disconnect handling, refresh, terminal view | matrix open |
Files belong beside the shell.
SFTP and SCP operations use bounded, cancellable pipelines. Remote editing is designed around a temporary local representation, conflict detection where possible, and an atomic upload path.
The useful details
- Recursive transfers report progress without spawning uncontrolled work.
- Remote filenames are treated as untrusted input and normalized before local use.
- Failed uploads remain visible instead of becoming silent partial writes.
- Remote edits warn before overwriting a file changed since it was opened.
See the source decisions for transfers and remote editing ↗.
Context is an operator feature.
Saved sessions, groups, tags, snippets, tunnels, diagnostics, monitoring, and visible transfer state are designed as one operating surface. The goal is fewer hidden states, not more panels.
Built to stay responsive
Search and storage are structured for large session collections. Every network operation has an operation-specific timeout and a cooperative cancellation path. Native RDP/VNC helper-pipe writes also have a dedicated deadline; failed writers become stable redacted crash diagnostics, reader exits trigger bounded helper cleanup/reaping, and reconnect uses bounded retries and backoff instead of an infinite loop.
Local-first does not mean careless.
The repository's validation path is deliberately defensive. It uses isolated `HOME` and XDG directories, strips credential-related environment variables, and runs protocol fixtures only on loopback addresses.
- Personal `~/.ssh`, GitHub keys, SSH agents, Keychain, and real remote hosts are out of scope for tests.
- Passwords, private key material, tokens, and sensitive environment variables are redacted from logs.
- Frontend IPC is typed and narrow; there is no unrestricted `execute_anything(command)` bridge.
- Terminal output is untrusted content and is not promoted to arbitrary HTML.
Read the full safe testing policy ↗, threat model ↗, and dependency audit ↗.
What still needs proving.
The project is approximately 89.6% through its current engineering checklist. The local implementation layer is further along than the release matrix; the remaining work is not hidden behind a vague “coming soon” label.
| Area | What remains | Status |
|---|---|---|
| RDP | The isolated native candidate exists; mature-engine/FreeRDP integration, Windows evidence, gateway, audio, clipboard, resize, and multi-monitor proof remain | local candidate |
| VNC | The real helper and loopback fixtures exist; cross-platform interoperability and manual evidence beyond local fixtures remain | local fixture |
| PTY / platforms | Target-aware PTY, WSL code, and explicit child reaping on close exist; real Windows/Linux/macOS runtime, WSL, hardware, multi-monitor matrix, and clipboard evidence remain | matrix open |
| Release | Unsigned macOS packaging, target-aware layout fixtures, and an explicit artifact verifier exist; signed portable packages, notarization, and clean-install evidence remain | open |
That distinction matters. A local fixture proves lifecycle logic; it does not prove production interoperability on every desktop.