Private beta — request access

1. Connect.
2. Ask questions.
That's IT.

Transit AI is a cross-platform SSH client with a read-only AI assistant for investigating switches, routers, and firewalls. Every command the AI proposes passes a per-vendor permit list and your explicit click. Always both, never either.

The IT is the point.

macOS · Windows · Linux · Free during beta

CSR1 — sonnet-4-6

CSR1# show version | i Version
Cisco IOS XE Software, Version 16.11.1b
Cisco IOS Software [Gibraltar], Virtual XE
ROM: IOS-XE ROMMON
CSR1# show netconf-yang status
netconf-yang: disabled
netconf-yang ssh port: 830
CSR1# _

you

What version is this device and is NETCONF enabled?

transit

IOS-XE 16.11.1b on a CSR1000V. NETCONF is disabled; SSH 830 is configured but netconf-yang isn't running. Candidate datastore is also disabled.

4,866 in · 56 out · 0% of budget

The three inviolable rules

Not preferences. Not promises. Built into the product — and verified on every release we ship.

Rule 1

Your SSH credentials stay in your OS keychain — Transit AI's UI never reads them back.

Rule 2

The AI has four abilities — list, read, propose, ask. It can't gain a fifth at runtime.

Rule 3

Every AI-suggested command passes the vendor permit list AND your explicit click.

Read the full security model →

Built for network engineers

Your old SSH client just got upgraded — now with an AI that can investigate but can't break things.

Read-only AI agent

Ask, don't bash. The AI investigates with four tools — list, read, propose, ask — and every proposed command runs through a per-vendor permit list AND your explicit click. Always both, never either.

Per-vendor command policy

Default-deny regex lists for Junos, Cisco IOS / IOS-XE / NX-OS, Arista EOS, PAN-OS. Shell-escape verbs are explicitly blocked (no start shell, no tclsh, no app-hosting).

The AI never sees your credentials

Even a jailbroken model can't ask for your password — the AI and the credential store are isolated components with no programmatic path between them. An automated check fails the build if anyone tries to add one.

Multi-session tabs

The tab strip you already know. One terminal pane per session, scrollback survives tab switches. Right-click for rename, export scrollback, split right, close.

Secrets stay in your keyring

macOS Keychain, Windows Credential Manager, Linux Secret Service, or the SSH agent. Provider API keys (Anthropic, OpenAI) live in isolated proxy infrastructure — never on disk in the app.

Output redaction

PEM blocks, encrypted passwords, AWS keys, JWTs — stripped before scrollback ever reaches the LLM. Per-conversation ordinals (REDACTED:pem#1) let the agent reason about credential equivalence without seeing bytes.

Quick copy/paste, syntax highlighting

Per-device toggles. Auto-copy on selection, right- or middle-click paste, multi-line paste confirmation. Familiar, but way better.

Session export with re-redaction

Export any session's scrollback to a file. Re-runs the redaction filter on save and offers age encryption so a shared transcript can't accidentally leak.

Investigate faster. Touch nothing.

Free during beta. Sign up and start a session.

1. Connect. 2. Ask questions. That's IT.