Facts before
features.

01 / Install

Choose your desktop.

Mac v0.1.31 and Windows/Linux v0.1.12 are desktop previews without publisher signing. Choose an installer below. GitHub's autogenerated source archives are not installers.

Checksum files help detect download corruption. They do not verify who published an installer.

02 / Workflows

Built for the SSH workday.

03 / Security

Clear edges, deliberate actions.

• SSH host-key verification rejects unknown keys until the operator chooses a trust source.
• Session configuration is separate from passwords and private keys. Native code resolves saved credential references. Interactive SSH answers pass from the dialog to their original challenge and are not saved in profiles.
• Secrets are excluded from ordinary profile data, logs, and helper process arguments.
• There is no unrestricted shell command bridge from the renderer.
• Multiline shell paste is confirmed. Multi-exec shows selected targets and an emergency disable path.
• Network jobs use bounded input/output, timeouts, cancellation, and cleanup.
• Repository tests use disposable state and loopback fixtures. They do not inspect personal SSH files or connect to real hosts.

Read the full threat model, safe testing policy, and dependency audit.

04 / Known limits

Preview means work remains.

• Mac v0.1.31 installers were built and checked locally. The GitHub Actions release workflow is disabled.
• Known v0.1.31 issue: Files can retain a busy error after a successful Refresh and show that directory error on Monitor. A source correction and native receipt track recovery; corrected native acceptance and a new installer remain pending.
• The installers lack publisher signatures. Mac packages have ad hoc signatures but are not notarized.
• Build success does not prove full GUI clean-install behavior or remote-server interoperability.
• v0.1.31 fixes live and stopped tunnel totals across local, SOCKS5 and remote forwarding. The ARM64 installer copy passed counter, SSH-tab Close and normal Quit checks with eight byte-matched clients and owned fixture cleanup. See the native receipt and limits. Larger transfer lists, finite-action saturation/Retry and sustained workloads remain pending. Earlier v0.1.30 checks cover 21 live controls and shared 32-job refusal/recovery; those packages retain the counter defect. Uncertain forwarding attempts still close their SSH transport and end other work on that connection.
• The v0.1.29 ARM64 installer copy passed Escape before connection, approved startup, interruption and replacement startup timeout. No third connection appeared for 63.59 seconds while the fixture remained live. Normal Quit released the app/local PTY; the fixture removed private state and released its loopback port. Native acceptance of other startup-write failures and broader output ordering remains open.
• The v0.1.27 preview adds explicit UTF-8/Windows-1252 Open while retaining strict UTF-8 defaults and bounded SFTP listings. The ARM64 installer copy passed legacy Open/Save/reopen, UTF-8 conversion/reopen, exact bytes/modes and normal Quit. Warning/recovery focus, native listing-limit refusals, queued expiry/overflow and sustained GUI workloads remain pending.
• RDP/VNC remain experiments. RDP is not packaged; VNC remote TCP has no transport encryption.
• Windows/Linux hardware, WSL, clipboard, serial devices, and broader platform behavior need target-environment evidence.

MobaRust is independent and is not affiliated with Mobatek or MobaXterm. There is no claim of feature-for-feature parity. The roadmap has 57 of 76 checked items (75%), a checklist measure rather than a production-readiness score. Next: sustained failure/recovery, transfer-control acceptance, aligned Windows/Linux installers and signing. Wider SSH recovery/authentication and platform evidence remain open.

05 / Build from source

Run the local path.

Requirements: Rust 1.90 or newer, Node.js 22, pnpm, and the Tauri prerequisites for your operating system.

git clone https://github.com/OthmaneBlial/MobaRust.git
cd MobaRust
pnpm install --dir apps/desktop --frozen-lockfile
cargo xtask check
pnpm --dir apps/desktop tauri dev

The validation path uses isolated home directories, disposable fixtures, and loopback networking. It does not need personal SSH files, Keychain, GitHub keys, SSH agents, real hosts, or attached hardware.

06 / Evidence

Check the current receipts.

Quality checks run locally with cargo xtask check. GitHub Actions release builds are disabled.

The v0.1.31 Mac release contains locally built ARM and Intel DMGs with SHA-256 files. Their disk images, package layout, architectures, ad hoc signatures and CLI version checks passed; all four published files were downloaded and compared byte for byte. Package inventory checks found no private lab state or environment metadata. Intel CLI execution used Rosetta on Apple Silicon with a 60-second process deadline. Windows and Linux v0.1.12 remain available. These receipts do not replace native GUI, clean-install or hardware evidence.

The current source passes the complete local check, including 114 desktop tests, four remote-forwarding cases, five private SDK tests, 22 public in-memory SFTP boundary cases and 15 editor/transfer fault cases. Coverage also includes 25 OpenSSH cases and both encrypted SFTP channel paths. The loopback OpenSSH lab also checks 16 MiB interrupted SFTP/SCP copies and full retries, plus byte-matched 8 MiB PTY/SFTP streams through two IPv6 bastions with ordinary and frequent-rekey settings. See the v0.1.31 validation receipt for commands and limits.

Report bugs with the operating system, architecture, and reproduction steps in GitHub Issues. Remove credentials, hostnames, IP addresses, and private connection details first.