Secure AI-Assisted Development
Termpolis
where Claude, Codex, Gemini, and Qwen work as a team — under a security perimeter you control
- 🛡 Local-first app · no Termpolis backend · no telemetry
- 🔒 No browser/IDE extension
- 🔎 Auto-scan every prompt (70+ patterns)
- 📜 Auditable outbound log
- ⛔ Strict Mode: Gemini paid-tier only
Describe your task. A dedicated Claude Code conductor breaks it into subtasks and
dispatches up to five agents in parallel, each picked by capability scores across ten
skill categories, with a token-cost forecast you see before anything runs.
Agents share a memory store with semantic search, message each other for handoffs, and
stream every tool call into a live activity feed. Pause, cancel, or steer any agent
mid-run without losing progress. When the swarm finishes, review the diff hunk-by-hunk,
run the tests, and accept or reject each change before it lands. The built-in
AI Security Center applies defense in depth around hosted models:
every prompt is scanned against 70+ secret patterns, oversize code or
.env pastes are flagged, every Gemini launch is checked for
paid-tier credentials, and every outbound launch + endpoint lands in a local
JSONL audit log so you can see what actually went out.
Free forever Termpolis is free and open source, and will always remain free. If it's useful to you, consider sponsoring the project.
- AI Security Center: auto-scan every AI prompt against 70+ secret patterns, Gemini paid-tier enforcement, JSONL audit log — every check runs locally
- Smart routing: up to 5 agents in parallel, auto-assigned by capability scores across 10 skill categories
- Intervene mid-run: pause, cancel, or redirect any agent. Shared memory keeps context intact
- Share-ready output: copy any terminal output as a code block, plain text, or PNG image — paste straight into Slack, Teams, or a PR
- Hunk-by-hunk review with test gates before anything commits
⚖ How Termpolis compares
Termpolis vs other AI terminals
We won't fabricate competitor features — every cell below is sourced from each tool's own public documentation as of May 2026. If a vendor ships a feature we missed, file an issue and we'll update. Marks: ✅ ships in product, ⚠ partial / opt-in / 3rd-party, ❌ not available, — unknown.
| Capability | Termpolis | Warp | Wave Terminal | Air (JetBrains) | Tabby |
|---|---|---|---|---|---|
| Open source & self-hostable Source available, you can audit/fork |
✅ Apache 2.0 | ✅ AGPL v3 client (Apr 2026) | ✅ Apache 2.0 | ❌ Closed source (JetBrains) | ✅ MIT |
| No required cloud account Works the day you install it, no signup |
✅ No Termpolis account | ⚠ Account required (free tier exists) | ✅ Optional sign-in for AI | ⚠ JetBrains Account for AI features | ✅ No account |
| Multi-agent swarm (parallel agents w/ live conductor) Runs Claude + Codex + Gemini + Qwen together |
✅ Up to 5, local conductor | ⚠ Oz orchestration (cloud) | ⚠ AI block per workspace | ⚠ Codex / Claude / Gemini / Junie, one at a time | ❌ Terminal only — agents via MCP plugin |
| Pre-send secret scanner (70+ patterns) Redacts AWS keys, GitHub PATs, etc. before they hit the AI provider |
✅ Local, every prompt | ❌ | ❌ | ❌ | ❌ |
| Sensitive-file-read alert (.env, *.pem, ~/.aws/*) Banner + audit when an agent autonomously reads a high-risk file |
✅ v1.11.53+ | ❌ | ❌ | ❌ | ❌ |
| Per-agent egress audit (netstat / ss / lsof) Records every remote host the AI agent talks to |
✅ v1.11.52+ | ❌ | ❌ | ❌ | ❌ |
| Provider ToS drift watcher Weekly check on Anthropic / OpenAI / Google / Alibaba terms |
✅ v1.11.52+ (GitHub Action) | ❌ | ❌ | ❌ | ❌ |
| Local JSONL audit log Every redaction, block, and egress entry stays on disk |
✅ Rotated, on-disk only | ⚠ Cloud history | ⚠ Local history (chat blocks) | ⚠ JetBrains AI history (cloud) | ⚠ Shell history |
| Cross-AI context handoff Resume a Claude session inside Codex / Gemini / Qwen |
✅ One click, bracketed-paste safe | ❌ | ❌ | ⚠ Same IDE, no auto-digest | ❌ |
| Hunk-by-hunk swarm review w/ test gate Accept/reject each diff hunk before commit |
✅ Built-in review | ⚠ Diff preview | ⚠ AI block edits | ⚠ JetBrains diff viewer | ⚠ Via git add -p |
| Termpolis-side telemetry on you Lower is better — what the tool itself collects |
✅ None by default · opt-in crash reports only | ⚠ Product analytics | ⚠ Anonymized telemetry (opt-out) | ⚠ JetBrains EAP / product analytics | ✅ None |
| Price for the editor itself Provider API costs are separate |
✅ Free forever | ⚠ Free tier · paid Pro/Team | ✅ Free | ⚠ Free preview (macOS) · pricing TBD | ✅ Free |
How to read this table. A ✅ in the Termpolis column does not mean the other tools are bad — they're optimised for different threat models and use cases. Warp ships the cleanest UI; Wave ships workspace blocks; Air ships an agent-first JetBrains IDE; Tabby ships a fast self-hostable terminal with an MCP plugin. Termpolis trades all of that polish for security primitives that hosted-model users currently have to build by hand: secret redaction, egress audit, ToS drift, sensitive-file alerts, and parallel multi-agent orchestration with a local conductor. Pick the one that maps to your threat model. If something here is wrong, please file a GitHub issue and we'll fix it.
Sourcing notes (May 2026). Warp open-sourced their client on April 28, 2026 (github.com/warpdotdev/warp) under AGPL v3 (UI crates MIT). Their cloud orchestration product (Oz / build.warp.dev) and managed agent backend remain SaaS — the table reflects the open-source client's stated capabilities. Air is the JetBrains agentic IDE built on the abandoned Fleet codebase; the macOS preview launched March 2026 and supports Codex, Claude Agent, Gemini CLI, and Junie via JetBrains Account (jetbrains.com/air). Tabby is the open-source terminal at github.com/Eugeny/tabby; AI agents reach it via the Tabby MCP server plugin (terminal sessions are not orchestrated end-to-end the way a Termpolis swarm is).
🛡 AI Security Center
Defense in depth for the hosted-model path
The honest framing: any tool that lets you talk to a hosted model is, by definition, sending your prompt to that provider. Termpolis cannot air-gap a prompt you choose to send, cannot guarantee a provider's stated retention policy is enforced server-side, and cannot stop a provider from later changing their terms. If your threat model requires those guarantees, run a local model — but accept the quality and hardware trade-off.
What Termpolis can do is make the hosted path substantially safer than typing into a stock terminal, a browser, or a VS Code plug-in. Every check below runs locally, every log stays on the machine, and every limit is named.
Pre-send secret scanner
Once you launch claude, codex, gemini, or
qwen, every Enter and every paste-sized chunk is matched against
70+ regex rules in main-process memory before it reaches the
PTY. Hits are redacted in place and a banner names the rules that fired.
Coverage: AWS, GitHub PATs, Azure, GCP service accounts, Stripe, Slack, Twilio,
Sentry DSN, JWT, PEM, .env-style URLs, and 60+ more.
Limit: regex-shaped secrets only — a custom token nobody publishes
a pattern for can still slip through.
Sensitive-file-read alert (v1.11.53)
The pre-send scanner can only see what you type. When the agent
autonomously decides to read .env, id_rsa,
~/.aws/credentials, a *.pem, or any of 17 other
high-risk patterns, Termpolis subscribes to the agent's tool-call stream and
fires a banner + audit entry naming the file and the agent. The bytes already
went to the provider, so the alert is after-the-fact — but you now know to
add the path to .claudeignore (or rotate the secret) before the
next session.
Limit: watches the agent's own tool runtime — files exfiltrated
via spawned subprocesses (e.g. python -c 'open(".env").read()') only
show up if the wrapping Bash command parses to a known reader.
Code-chunk + env-dump heuristics (v1.11.52)
Prompts over 2 KB are inspected for code-shaped structure (indentation +
braces + keywords + module declarations) or 5+ KEY=value lines
suggestive of a pasted .env. Detections are surfaced in the UI
and written to the audit log so you notice when an entire source file or
env file is on its way out.
Limit: heuristic — false negatives possible on minified or
unusual shapes. The prompt isn't blocked; you decide.
Weekly ToS drift watcher (v1.11.52)
A scheduled GitHub Action fetches the four provider pages we cite (Anthropic commercial terms, OpenAI enterprise privacy, Google Gemini API terms, Alibaba Model Studio agreement), normalises the HTML, hashes it, and opens a tracking issue when the hash changes — so what the app advertises stays aligned with what providers actually publish. Limit: detects rendered-text changes, not legal intent. A human still reads the diff.
Per-agent egress audit (v1.11.52)
netstat (Windows), ss (Linux), or lsof
(macOS) is polled once a minute for the AI agent's PID. Every unique remote
host:port goes to the audit log, so you can answer "did Claude
talk to anything other than api.anthropic.com today?".
Limit: polling, not packet capture — sub-minute bursts can be
missed; no DNS reverse lookup; no payload inspection.
Gemini account-mode auto-detect
Reads GEMINI_API_KEY, GOOGLE_API_KEY,
GOOGLE_GENAI_USE_GCA, and
GOOGLE_APPLICATION_CREDENTIALS+GOOGLE_CLOUD_PROJECT
to classify the active Gemini session as paid (training-excluded) or free
(Google may use prompts for product improvement). Strict Mode
intercepts gemini launches that look free-tier and refuses to
forward them; blocked launches are audited.
Limit: env-var heuristic — credentials shipped some other
way can't be classified.
Local JSONL audit log
Every AI terminal open/close, every redaction hit, every code-chunk or
env-dump detection, every Strict-Mode block writes to
ai-security-audit.jsonl in your userData directory. 10 MB
rotated, append-only, on disk only, wipeable.
Limit: local. We don't ship it anywhere. If your machine is
compromised, so is the log.
Tampering-surface minimisation
No browser extension, no IDE plug-in, no Termpolis cloud sync. The MCP server
binds to 127.0.0.1 with a 256-bit token rotated every launch.
No Termpolis telemetry, no Termpolis accounts, optional crash reporting that
redacts user-folder paths.
Limit: Termpolis is itself an Electron app — same caveats
apply as any local desktop process running with your privileges.
Built-in legal disclaimer
Apache 2.0 "AS IS". Settings → Security and TERMS.md ship
the full liability disclaimer covering provider ToS changes, the limits of
regex-based redaction, and the scope of Strict Mode interception. Vetted,
transparent, auditable.
What this is and isn't. Termpolis is defense in depth for the hosted-model path — it raises the cost of accidental disclosure and gives you a record to audit. It is not a guarantee that source code cannot reach a provider; only not running the agent at all gives you that. The honest answer to "can a hosted model leak my code?" is "yes, if you send it; the question is whether the controls catch the obvious accidents and whether you trust the provider's terms for the rest."
🔁 Cross-AI context handoff
Move a Claude session to Codex, Gemini, or Qwen — without re-explaining
Open Past AI Sessions from the sidebar. Termpolis indexes every
~/.claude/projects/**/*.jsonl transcript on your machine, shows
them with project label, age, message count, and size, and lets you continue
the work in any of the four supported agents — without manually copy-pasting
anything.
Resume natively
Spawns a new terminal at the original cwd and runs
claude --resume <session-id>. Or, if you already have a
plain shell focused, "Resume in active shell" runs the resume command in
the focused terminal — no new tab.
Continue in another AI
Pick Codex, Gemini, or Qwen from the Continue ▾ menu. Termpolis spawns a fresh
terminal at the same cwd, boots the chosen agent, and pastes a synthesised
CONTEXT HANDOFF prompt summarising what's been done so the
new agent picks up exactly where the old one left off.
Inject into the focused AI
Already have an AI shell open? "Inject context into active shell" pastes the handoff prompt straight into that agent's input box. The button is disabled for plain shells (where it would just splat into the command line) and the tooltip explains why.
Pasted as one blob, not a stream of commands
The handoff prompt is wrapped in xterm bracketed-paste markers
(ESC[200~ … ESC[201~) so the receiving agent treats it as a
single paste rather than dispatching one keypress / submit per embedded
newline. Result: the agent sees one coherent context block, not what looks
like a flurry of random commands.
AI-native features
Built from the ground up for AI coding workflows
Termpolis isn't just a terminal that runs AI tools. It's designed around them. Launch agents with one click, orchestrate swarms, track costs, record sessions, search conversations, and let AI agents control your workspace through MCP.
AI agent profiles
One-click launch for Claude Code, Codex, Gemini CLI, and Qwen Code. Add custom profiles for any AI tool. Each gets its own terminal with the right shell, color, and startup command.
MCP server
Built-in HTTP/SSE server on localhost:9315 with 17 tools. AI agents create terminals, run commands, read output, manage your workspace, and persist memory across sessions. Auto-registers with Claude Code, Codex, Gemini, and Qwen-Code.
Context handoff
When an AI agent runs out of context, an amber banner offers to switch to another agent. Your task, git state, recent commands, and diff summary transfer automatically.
Command palette
Ctrl+K opens a natural language command bar. Type "new terminal", "launch claude", "split right". 17 commands, all local pattern matching, no API keys needed.
Prompt templates
Save reusable prompts (Fix Tests, Code Review, Refactor) and insert them into any terminal with Ctrl+Shift+P. Create custom templates for your workflows.
Workflow templates
Pre-built multi-terminal layouts: "Claude + Shell" (2 panes), "Full Stack Dev" (4 panes), "Code Review" (2 panes). One click launches the full split-pane setup.
Agent detection & cost tracking
Automatically detects Claude Code, Codex, Gemini, or Qwen Code running in a terminal. Shows a colored badge with token usage and estimated cost in the status bar.
Session recording
Record AI coding sessions with timestamps. Export as shareable text logs for documentation, review, or auditing what an agent did.
Output pinning
Pin important output to a persistent panel at the top of the terminal. Stays visible as the terminal scrolls, so AI-generated code stays in view while you test it.
Smart context panel
Ctrl+Shift+E opens a side panel showing file tree, git status, and recent commits. See what the AI agent sees. Refreshes every 5 seconds.
Diff viewer
Detects git diff output and renders it with syntax highlighting: green for additions, red for deletions, file headers, line numbers. Built right in.
Conversation search
Ctrl+Shift+I searches across all AI conversations indexed from terminal output. Find when Claude suggested that migration or Codex wrote that function.
Git panel
Built-in git panel accessible from the sidebar. Stage, unstage, commit, pull, push, view inline diffs, all without leaving Termpolis. Auto-detects repos or pick any folder. Like VS Code's source control but built into your terminal.
Multi-agent swarm
The conductor that knows who plays what
No AI company has built a tool that brings together competing models to work as a team, because it helps their competitors. Termpolis does it anyway, because it moves AI forward. Claude, Codex, Gemini, and Qwen working in harmony on the same project, directed by a live AI conductor.
AI Conductor
A dedicated Claude Code instance runs as the swarm orchestrator. It reads every agent's output in real time, decides what to delegate next, and issues instructions using live AI reasoning, not hard-coded keyword matching. The conductor thinks; the agents execute.
Smart task routing
The orchestrator analyzes your task, breaks it into subtasks (refactoring, testing, docs, review), and assigns each to the best agent based on a customizable capability matrix. Scores are transparent (0-100) with reasons. Token-heavy work routed to cheaper agents. Every assignment can be overridden.
Customizable agent ratings
4 agents scored across 10 categories. Default ratings are estimates based on general model capabilities. Customize them in Settings > Agent Capability Ratings based on your experience. The AI conductor uses ratings as hints but makes its own judgment calls.
Token budget estimates
Before launching, see estimated tokens and cost per agent. Expensive models handle complex work. Free/cheap models handle volume. Total estimated cost shown upfront.
5-step swarm wizard
Pick agents → describe task → review smart-routed assignments → launch → conductor initializes (~30s) and begins delegating. Each agent gets a split pane with their optimized task prompt. The conductor monitors and adapts as work progresses.
Swarm Complete dialog
When the conductor determines all work is done, a summary dialog appears: tasks completed, tasks failed, per-agent results, and a full message log. No manual polling. The conductor signals completion automatically.
Interactive Agent Mode
Gemini runs in interactive mode so it has full tool access during swarm execution, not just output parsing. Each agent runs in its own terminal pane with real shell access.
MCP-native communication
Claude Code, Codex, Gemini CLI, and Qwen Code all connect to Termpolis via MCP natively. 6 swarm tools for inter-agent messaging, task management, and coordination. No terminal-output bridges or parser glue.
Open-weight Qwen option
Qwen Code is Alibaba's MCP-native CLI for the Qwen3-Coder family. Cloud API by default, drop-in alternative when you want a non-Anthropic, non-Google option in the swarm.
Swarm dashboard
Real-time view: agents with health status, tasks in kanban columns (Pending → In Progress → Completed), and a chronological message log. Ctrl+Shift+S to open.
Context handoff
When an agent hits its token limit, seamlessly switch to another with your full working context. Task, git state, modified files, and diff summary transfer automatically.
Download and code
Install the app or inspect the source
Available for Windows, macOS, and Linux. Apache 2.0 licensed, open source, free.
github.com/codedev-david/termpolis
Explore the codebase, track releases, and contribute.
Browse the repoWindows
NSIS installer with bundled jq, yq, and nano.
Code Signed (SSL.com) Download for Windows* Windows SmartScreen may show a warning for new software. Click "More info" then "Run anyway" to proceed. Termpolis is digitally signed and safe to install.
macOS
DMG with full Unicode support and built-in tools.
Signed & Notarized (Apple) Download for Mac (Apple Silicon) Download for Mac (Intel)Linux
.deb for Debian/Ubuntu, AppImage for everyone else.
Download .deb (Debian/Ubuntu)
Then in the Downloads folder, run:
(Use
AppImage (other distros)
dpkg, not apt install — apt’s sandboxed _apt user can’t read files in your home dir on Ubuntu 22.04+, which causes a “Permission denied” error. The Termpolis postinst auto-resolves missing deps, refreshes the icon cache, and bakes --no-sandbox --disable-gpu into the .desktop launcher, so the dock icon Just Works.)
AI observability
See what every agent is doing, in real time
Run five agents at once and the usual problem shows up fast: two of them are doing the same work, one is about to run out of context, and another is quietly burning tokens. Termpolis ships a local observability layer that watches every agent on your machine. No cloud, no external dashboard, bounded memory, 90%+ test coverage.
Activity feed
Ctrl+Shift+A opens a live stream of every agent event: messages, tool calls, tool results, token updates, compaction events, errors, and MCP audit entries. Filter by agent (Claude/Codex/Gemini/Qwen Code), by kind, or search full text. Newest first.
Context pins
Pin any snippet to the current project: a migration rule, a test policy, an API contract. Pins are re-injected on agent handoff so the next agent doesn't lose the plot. Per-project storage with full CRUD.
Redundancy detector
Ctrl+Shift+D surfaces duplicate work across terminals. Two agents running npm test at the same
time? Both editing the same file? A severity-ranked finding shows up immediately.
Efficiency panel
Ctrl+Shift+Y aggregates per-agent stats: token totals, cost, error rate, average tool-call duration. Spot when one agent is burning budget while another is cruising.
Event bus
In-process bounded ring buffer (10K events) with rate limiting (500/sec burst) to prevent DoS from a runaway agent. Persisted to JSONL with automatic rotation. 64KB payload cap. Subscriber callbacks are sandboxed so a bad listener can't kill the bus.
Transcript watchers
Native JSONL readers for Claude Code, Codex, and Gemini transcripts. Tail-with-rotation: if the agent rotates its log mid-run, the watcher follows. Path traversal is blocked at the watcher boundary.
Swarm dashboard
Live token burn per agent, tasks in kanban columns, and the full conductor message log. Every panel streams from the same event bus. No polling lag, no duplicated state.
Terminal features
Everything you need in a modern terminal
Split panes
Split any terminal horizontally or vertically with draggable dividers. Nest splits recursively.
7 themes
Dark, Light, Solarized Dark/Light, Monokai, Dracula, Nord. Per-terminal with live preview.
Command autocomplete
VS Code-style dropdown for 20+ tools. Commands, subcommands, flags with descriptions.
AI command suggestions
Type natural language in any terminal, get instant shell commands.
"find large files" becomes find . -type f -size +100M.
"undo last commit" becomes git reset --soft HEAD~1.
29 patterns, zero latency, no API calls. Tab to accept.
Command auto-fix
Mistype a command? Green banner suggests the correction. Enter to run, Esc to ignore.
Configurable keybindings
18 keyboard shortcuts, all customizable with a recording UI in Settings.
Status bar
Shell type, directory, git branch, AI agent badge, cost tracking. Updates live.
Built-in tools
jq, yq, and nano bundled. Available in every terminal, even if not installed on your system.
Export & drag-drop
Export scrollback to text files. Drag files onto terminals to paste paths. Clickable URLs.
MCP integration
AI agents control your terminal
Termpolis runs an MCP server on localhost:9315 with 17 tools. Claude Code, Codex, Gemini, and Qwen-Code all auto-discover it. Secured with a 256-bit auth token, localhost only, no plugins.
17 MCP tools
Terminal management (list, create, run, read, close, write) + file tree + git status + 6 swarm coordination tools + 3 memory tools (write, search, list).
Auto-registers with every agent
On launch, Termpolis adds itself to Claude Code, Codex, Gemini CLI, and Qwen-Code config files. Zero configuration needed.
CLI tool included
termpolis-cli lets you control Termpolis from any terminal: list, create, run, read, close.
Security hardened
256-bit auth token, localhost only, CORS restricted, no plugins, no telemetry. Atomic file writes.
In action
See Termpolis in action
Workspaces
Save and restore terminal sets
- Save all terminals with names, shells, themes, fonts, colors, and working directories
- Terminals reopen in the same directory they were in when saved
- Session persistence brings everything back on restart
- Single-instance lock prevents session corruption
Claude + Tests
Claude Code on the left, test runner on the right.
Dev Environment
Frontend, backend, database, and AI agent in 4 panes.
Multi-Agent
Claude, Codex, and Gemini collaborating on a task.
Shortcuts
18 keyboard shortcuts, all customizable
Performance & security
Enterprise-grade reliability
3,240 automated tests
2,723 unit tests across 129 files (Vitest, 90%+ coverage) + 517 E2E tests across 35 files (Playwright) with automated screenshots. CI/CD on every release.
Output throttling
64KB per-frame rate limit. 10,000-line scrollback cap. Viewport-aware rendering in split view.
No plugins, by design
Third-party plugins are a security risk. Every feature is built-in, auditable, and ships with the app.
Crash recovery
React ErrorBoundary catches render crashes. Optional Sentry integration. Terminals survive UI errors.
Supported shells
Auto-detects your installed shells
PowerShell 7
Windows, macOS, Linux
Windows PowerShell 5
Windows
Command Prompt
Windows
Git Bash
Windows
Bash (WSL)
Windows
Bash
macOS, Linux
Zsh
macOS, Linux
Support the project
Sponsor Termpolis
Termpolis is free, open source, and Apache 2.0 licensed. Building it (including AI token costs for development) takes time and resources. If you find it useful, please consider sponsoring.
Screenshots
The interface up close