Index / tool

Orchestrator

Category: Developer Tools
Rank: No. 3715Tools index
Previous survey · No. 3475 · 18 October 2026
Pricing: Open Source
Type: TOOL
Use case: Coding
Interfaces: Desktop · Mobile
GitHub: 1 stars
Latest release: desktop-v0.1.1
Date: Published Sep 10, 2026

About

A self-hosted system that lets you run Claude Code terminal sessions on your own laptop and control them remotely from a phone app (Orc Terminal), using a relay that only pins your machine's TLS certificate without decrypting traffic. It provides a real terminal with full key support (Esc, Ctrl-C, Tab, arrows), surfaces sessions waiting on input, and requires no port forwarding, VPN, or cloud execution since sessions persist on the local machine.

What it does

A background service written in Go spawns Claude Code inside pseudo-terminals, keeps one megabyte of scrollback per session, and records status from Claude Code's own hooks. A Flutter client for iOS and Android pairs once by scanning a code, then signs every later login with a per-device key. Traffic leaves the computer through an outbound connection to a forwarding server that routes on the requested hostname and passes the encrypted stream through untouched. A desktop tray app wraps setup on Linux, with an untested macOS build.

Why it's ranked here

The security writing is the strongest argument for it. The threat model states plainly that a paired device can run any command as the user, with no sandbox or allowlist, then documents the defenses with numbers: pairing codes that live five minutes and die after five wrong guesses in total, an IP lockout of ten minutes after five failures, and a relay that holds no key able to read sessions. MIT licensed, with a checksum-verifying installer. It is a one-person side project, and the README says so.

What's good

The relay design avoids a whole class of bugs: one stream per phone, fixed 32 KiB buffers, no queues, so a noisy terminal cannot balloon its memory. The phone signs a challenge that includes the server's certificate fingerprint, so a captured signature cannot be replayed against another host. On iOS the device key is kept out of backups, so restoring a backup onto another phone does not carry the pairing with it. The Linux installer refuses to proceed on a missing or mismatched checksum, and can require signed build provenance.

Tradeoffs

The hosted relay is on by default, so anyone holding your host id can reach the login surface from the internet, and the relay operator sees when you are online and how many bytes flow. Every session crosses the relay even on the same Wi-Fi, which the design notes admit costs latency. Certificate pinning has no rotation path: lose the key and every phone must pair again. Windows hosts are unsupported, macOS has not run on real hardware, and every paired device sees every session's output, including secrets Claude Code prints.

How to use it well

Best for one developer who already runs Claude Code daily on a Linux machine and wants to check on and answer long sessions away from the desk. Revoke old devices, since a device key stays valid until revoked. If metadata exposure matters, run your own relay or switch it off and stay on your local network or Tailscale. Never leave debug mode on, because it skips authentication for local connections. It is not a multi-user or sandboxed setup: one daemon serves one account.

Technical notes+

daemon/cmd/orchestrator/main.go wires the PTY core, an admin unix socket, and an optional relay client whose virtual listener feeds the same HTTP server as the TCP port; a bad relay config is logged and disabled rather than fatal. daemon/internal/relay/server/server.go peeks the ClientHello (5 s deadline, 16 KiB cap), terminates TLS only for the apex domain, and maps hostid subdomains to a control socket, with defaults of 8 pending dials and 16 streams per host and 30 connections per minute per IP. app/lib/protocol/challenge.dart builds the signed bytes as orch-auth-v1 plus both nonces, fingerprint and device id. app/lib/services/keys.dart stores Ed25519 seeds with first_unlock_this_device. app/lib/net/host_connection.dart backs off from 1 s to about 30 s with jitter and gives up for 5 minutes on an auth failure or fingerprint mismatch. scripts/install.sh fails closed on SHA256SUMS.

Observed

License: MIT
Language: Go host daemon and relay; Dart and Flutter for the mobile and desktop apps
Host platforms: Linux supported; macOS build untested on real hardware; Windows unsupported (no ConPTY)
Install surface: Shell installer choosing a .deb or AppImage, plus a .dmg for macOS; daemon-only install on arm64
Interfaces: Mobile app, desktop tray app, and a CLI for headless machines
Transport security: TLS 1.3 with a self-signed P-256 certificate pinned by the phone; relay passes encrypted bytes through
Device authentication: Ed25519 per-device keys signing a nonce-bound challenge
Session isolation: None by design; a paired device runs commands with the daemon user's full privileges
Release verification: SHA256SUMS checked by the installer; optional Sigstore provenance check

Read from README.md, LICENSE, SECURITY.md, docs/RELAY.md, MVP.md, daemon/go.mod, daemon/cmd/orchestrator/main.go, daemon/internal/relay/server/server.go, app/pubspec.yaml, app/lib/protocol/challenge.dart, app/lib/protocol/frames.dart, app/lib/net/host_connection.dart, app/lib/services/keys.dart, scripts/install.sh.

What it can do

Remotely control Claude Code terminal sessions running on a local machine from a phone app
Phone app commands → Terminal session control
Relay terminal traffic through TLS-pinned connection without decrypting it
Terminal session data → Encrypted relayed traffic
Provide full terminal key support (Esc, Ctrl-C, Tab, arrows) for remote sessions
Key input from phone → Terminal keystroke signals

Intel on Orchestrator

Comments (0)

No comments yet

Editorially curated, with community endorsements as a secondary signal. Corrections welcome.