One gate for humans and AI agents
A wing-connector runs next to your assets and dials out, so VPS, dev machines and home servers stay behind NAT with zero inbound exposure. Reach them through Web Terminal, SSH, file transfer or MCP — under project-scoped grants with full audit.
Built for people who run their own machines
WingGate is for individuals and small teams operating a handful of remote machines, not fleets. If your infrastructure fits in your head, it fits in WingGate.
- Personal VPS
- Keep one or a few cloud servers reachable and auditable without leaving SSH ports open to the internet.
- Dev machines
- Reach your workstation or build box from anywhere, through NAT and firewalls, with the same session tools.
- Test environments
- Give staging machines scoped, revocable access instead of shared keys copied around the team.
- Home servers
- Manage a homelab behind consumer internet with no port forwarding and no dynamic DNS workarounds.
- Small production
- Operate small production environments with project-scoped grants and an audit trail of every session.
One service, one component you run
WingGate splits into the service you connect to and a wing-connector you run where your assets live. All traffic from your side is outbound.
WingGate
The service: console, identity, authorization and audit. Hosted by the service operator or self-hosted by you.
wing-connector
Runs next to your assets — on the machine itself or on its network — and dials out to WingGate over mTLS.
Because the connector initiates the connection, assets stay behind NAT and firewalls with zero inbound exposure.
From a machine to a managed asset in five steps
-
Onboard the asset
Install the wing-connector on your network and register the machine as an Asset with a connection profile.
-
connector dials out
The wing-connector keeps an outbound, mutually-authenticated connection to WingGate. Your asset never exposes an inbound port.
-
Grant access by project
Add members to a Project and grant them that Project's full data plane.
-
Connect your way
Open a Web Terminal, use your own SSH client, transfer files, or attach an AI agent over MCP.
-
Review what happened
Sessions and actions are recorded in the Audit log, and access can be revoked at any time.
Four ways to work, one grant model
A full terminal in the browser for quick checks and fixes from any device, no local client required.
Keep your own ssh, scp and IDE remote workflows — WingGate brokers the connection under your grants.
Browse and transfer files on SSH assets from the console without setting up separate file sharing; existing SMB / WebDAV / S3 storage can also join as assets for AI agents to read and write over MCP.
Attach an AI agent over MCP and let it work your machines — file and command access scoped by the same project grants and audit trail as any human session.
Grants you can reason about — and revoke
Project access grant
Access is granted per project, per member. There is no blanket admin-by-default.
Revocable at any time
Remove a grant and the member loses access immediately, including any capability derived from it.
Audit by default
Session opens, commands and administrative changes land in the Audit log so you can answer who did what, when.
Start managing your assets
Create an account and connect your first machine in minutes, or walk through the full setup first.