I built a small SSH wrapper to reduce daily friction

Joydeep Bhattacharya — Sat, 28 Feb 2026 17:28:59 +0000

I spend a lot of time SSHing into different hosts — prod, staging, dev boxes, database servers. Over time the friction adds up: remembering hostnames, retyping user@10.0.1.something, losing sessions to flaky networks, accidentally running something on prod when you meant staging.

I looked for a tool that fixed this and didn't find one that felt complete, so I built oken.

What it is

oken is a thin wrapper around your system ssh. Every flag and argument passes through unchanged — so anything that works with ssh works with oken. You can even alias ssh=oken and forget about it.

On top of that it adds a few things ssh has never had.

Fuzzy host picker

Run oken with no arguments and you get an interactive picker over all your saved hosts, sorted by recency. Type to filter. Hit Enter to connect.

  Search: █                                        6 / 6 hosts
 ─────────────────────────────────────────────────────────────
  prod
> prod-web         ubuntu@10.0.1.50       [prod]      2h ago
  prod-db          deploy@10.0.1.51       [prod, db]  3d ago
  staging
  staging-web      ubuntu@10.0.2.10       [staging]   1w ago
  dev
  dev-laptop       joy@192.168.1.5        [dev]

Prefix your search with # to filter exclusively by tag:

  Search: #prod█                                   2 / 6 hosts

Or from the command line:

oken --tag prod   # opens picker pre-filtered to prod hosts

This is the main thing I built it for. Tag-based filtering across a lot of hosts is genuinely useful when you're juggling prod/staging/dev environments.

Everything else

Auto-reconnect. On exit code 255 (SSH connection error), oken retries automatically with a countdown. Disable per-session with --no-reconnect.

Production warnings. Tag a host prod and oken prompts before connecting. Skip with --yes for scripting.

Named tunnel profiles. Save a tunnel once, start it with one word:

oken tunnel add db -L 5432:localhost:5432 prod-db
oken tunnel start db
oken tunnel stop db

Audit log. Every session logged with duration and exit code. oken audit to view.

Shell completions. oken completions sets everything up automatically — detects your shell, finds the right directory, patches your .zshrc if needed.

It's not trying to replace fzf or ssh config

A few people have pointed out that fzf can do fuzzy host picking with a one-liner. True — but that one-liner reads ~/.ssh/config and stops there. No tags, no recency sorting, no reconnect, no tunnel management. oken is the assembled thing, not a building block.

It also reads your existing ~/.ssh/config automatically, so there's nothing to migrate.

Try it

# macOS / Linux
curl -LsSf https://github.com/linkwithjoydeep/oken/releases/latest/download/oken-installer.sh | sh

Written in Rust. Binary is under 2.5MB. No daemon, no background process, no config required.

GitHub: https://github.com/linkwithjoydeep/oken