purple

Abstract

Open-source terminal SSH manager that keeps ~/.ssh/config in sync with your cloud infra across 16 cloud providers. Spin up a VM, it shows up. Destroy it, it dims. Plus live tunnel monitoring, fleet-wide Docker and Podman, scp, Vault SSH certs and an MCP server for AI agents. Rust TUI, MIT.

The Problem

Hand-maintaining ~/.ssh/config across cloud infrastructure is error-prone and tedious. Every VM you spin up on AWS, GCP, Azure, or Hetzner requires manually adding an entry with the correct IP, then updating it when the instance moves, then removing it when decommissioned. This repo solves that by keeping SSH config synchronized with live infrastructure across 16 providers.

What This Does

purple is a Rust TUI that syncs your cloud provider inventory into ~/.ssh/config. It watches for host additions and removals, dims decommissioned hosts, and provides fuzzy search, file transfer, container management, and short-lived Vault SSH certificates. It also ships an MCP server for AI agent integration.

The codebase is substantial — 236 Rust files, ~3,700 functions, and a 6,000-edge internal call graph. The core logic lives in src/app/ (UI state), src/providers/ (cloud API clients), and src/handler/ (event handling).

How It Is Wired

Execution starts at main in src/main.rs:10, which reaches only 6 functions — it delegates to the TUI event loop. From there, handle in src/askpass.rs:65 reaches 47 functions and run in src/mcp.rs:954 reaches 53. The CLI entry points handle_sync and handle_provider_command in src/cli.rs handle headless operations.

The most-connected functions carry the widest blast radius: make_app is called from 292 places, sync_provider from 93, and parse_str from 78. Changing any of these ripples across the entire codebase.

Effects on the outside world are minimal and concentrated. Only 2 functions touch a database, 4 run external commands, and 11 read/write files. The traced paths show handle -> init writing to the filesystem via fs::OpenOptions, and handle_sync -> migrate_renames_persistent_state -> save_recents -> atomic_write opening files. A single run's external footprint is small — it reads provider APIs and writes ~/.ssh/config.

Key files by responsibility: src/app/host_state.rs manages host configuration and grouping, src/app/forms.rs handles provider forms, src/app/tunnel_state.rs tracks tunnel state, and src/providers/ contains per-cloud API clients (aws.rs, gcp.rs, azure.rs, etc.).

How To Use It

Setup:

curl -fsSL getpurple.sh | sh

Or from source:

git clone https://github.com/moses-y/purple
cd purple && cargo build --release

Configuration: Drop one API token per provider into the UI. The repo includes rust-toolchain.toml for pinned Rust versions and Cargo.lock for reproducible builds.

Running: Execute purple, press ? for help. The MCP server is read-only by default and available as a .mcpb bundle.

Real-World Use

A developer managing 50+ VMs across AWS and Hetzner runs purple, adds both provider API tokens, and gets a live host list. When a Terraform run creates a new instance, it appears in the TUI and ~/.ssh/config automatically. The developer uses : for the jump bar, searches by username, and pushes SSH keys to a fleet with one command.

Code Health & Issues

Static analysis (not opinion) found 177 findings: 59 high, 118 medium, 0 low, across 3 kinds:

High — Deep nesting (x35): src/app/display_list.rs, src/app/search.rs, src/app/tunnel_state.rs hit max indentation depth 9. Fix with early returns.
High — Duplicated code (x133 files): 484 repeated 6-line blocks across fuzz/fuzz_targets/fuzz_ssh_config.rs, tests/proptest_ssh_config.rs, and scripts. Extract shared helpers.
High — Oversized files (x24): src/app/forms.rs, src/app/tests.rs, src/app.rs exceed 1,300 lines each. Split by responsibility.

SDLC observations: CI exists (GitHub Actions), tests present (196 test files), license present. Two high-severity issues: unpinned third-party actions in workflows (tag-based, movable) and automated pushes to the default branch in release.yml. A 14.6MB demo.gif bloats every clone. Two PEM files in tests/fixtures/ are flagged as secret-shaped but are likely test fixtures — verify before release.

The Bottom Line

A serious, well-tested tool for anyone who manages SSH access to cloud infrastructure. The 16-provider sync, Vault integration, and MCP server make it genuinely useful. The main risks are maintainability — deep nesting and 1,300-line files will slow future changes — and the CI hygiene issues should be fixed before public adoption.