About Stenvakt

Stenvakt is a Mac app that secures and patches the Linux servers you run yourself. It works over SSH, shows every change before it runs, and keeps a way back in if a firewall or SSH change goes wrong.

What it does

Review reads a server and lists what is risky: open ports, exposed databases, weak SSH settings, missing updates, known security holes. Preview shows each fix line by line before anything changes. You apply the fixes you want, and Stenvakt checks that they worked.

With safe mode on, firewall and SSH steps arm a rollback timer on the server itself. The app then tries a brand-new login. If that login fails, the server puts the old config back, even if your Mac went to sleep.

Beyond that, Watch shows what reaches a server and which logins worked, Tools updates the software it runs one piece at a time, and AI agents such as Claude Code, Codex and Cursor can connect over MCP, with every change waiting for your approval.

How it is built

• A native macOS app for Apple silicon and macOS 14 or newer. Built and tested on Ubuntu and Debian servers.
• No agent on the server. Stenvakt logs in with the SSH keys you already use, and nothing new listens for connections.
• Your keys, servers and history stay on your Mac. An account is only needed for Pro, alerts and update emails.
• Shared servers are respected: mark one as shared and Stenvakt never changes SSH access on it.

What it promises

Stenvakt is free, with no limit on servers. Safe mode, rollback, Preview and Review will never move to a paid plan, and updates are free for everyone. Pro adds monitoring, alerts, backups and more for people who want them.

Who makes it

Stenvakt is made by Matija Mikulinec at Cenner in Zagreb, Croatia. Notes on how it is going are on the blog, and every release is in the changelog. Questions, bugs or a team plan: contact or [email protected].