Vectron Help

The short version. You already know SSH; this page is about how Vectron for Mac does things. Vectron for Mac, iPhone and iPad is coming to the App Store in October 2026.

On this page: Copy and paste, AI assistant, Which commands the AI may run, AI usage and monthly limit, A model on your own Mac, Serial console, Moving from another app, Shortcuts, Uninstalling, Troubleshooting

Getting started

1. Create a vault. On first launch click Create Vault and set a master password. Everything you save (hosts, folders, credentials, templates, IP records) is encrypted in that one file. If iCloud Drive is on, the vault is kept in Vectron’s own iCloud Drive folder, so the same vault opens on your other Macs, iPhone and iPad; if not, it is kept only on this Mac. Turn on Remember on this Mac to unlock it with Touch ID. Already have a vault file? Click Use a Vault File…: Vectron copies it in and never changes the original. Just looking? Try the Demo opens sample switches that run inside Vectron.
2. Connect. ⌘T (File → New Connection) opens Quick Connect: type user@host, pick the protocol, press Return. Or add a host to the vault (⌘N) and double-click it.
3. Work side by side. Open a grid from the Layout menu (Two Columns, Two Rows, One and Two, Three Columns, Grid of Four), from Grid in the session bar, or drag hosts onto panes. Drag the dividers to resize panes; double-click a divider to make them equal again. A grid holds up to four sessions. SSH, Telnet, Serial, RDP and VNC panes can sit in the same grid.
4. Type once. In a grid, ⇧⌘B (Session → Start Broadcast) sends what you type to every terminal pane. Pause on a pane leaves it out. Grids with production devices ask first. At a sign-in prompt, what you type (user name, password) goes only to the panes that are signing in too, never to a pane at its command prompt.

Good to know

Credentials. Save a username and password once under Vault → Credentials and choose it in a host’s or folder’s Edit…, for many hosts or a whole folder. Change it in one place and every host follows.

SSH keys. In a credential choose SSH Key, then Choose File… (in the file picker press ⇧⌘. to see the hidden ~/.ssh folder) or Paste a Key…. OpenSSH and PEM keys work: Ed25519, ECDSA and RSA, with or without a passphrase. PuTTY .ppk keys: in PuTTYgen choose Conversions → Export OpenSSH key first. If a server refuses the key, Vectron asks for the password instead. The key stays in your encrypted vault. It is shown only when you click Show Private Key… and confirm with Touch ID or your Mac password.

Copied passwords are cleared from the clipboard after 30 seconds (Settings → Security → Clipboard), unless you copied something else in the meantime.

New hosts. The first time you connect to a server (SSH, SFTP, RDP), Vectron shows its fingerprint and asks Trust and Connect before any password is sent. Compare it with the device if you can (on Linux: ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub). Connect All and Open in Grid show all new servers in one list. Setting up many new devices on your own network? Settings → Security → New hosts → Trust new hosts automatically. A changed fingerprint is always shown. Vault → Show Known Hosts… lists every saved fingerprint. Demo devices never ask.

Latency. Tabs and grid panes show the ping time to the device next to the title: green under 50 ms, amber up to 150 ms, red above. If a device that answered before stops answering, the session shows “Not responding”. Devices that don’t answer ping show nothing. Turn it off in Settings → Sessions → Show latency on tabs.

Serial console. Plug in a USB-to-serial adapter, choose Serial in Quick Connect, pick the port and speed (9600 is the usual default). More below.

TFTP. Tools → TFTP Server. Click Browse… to choose the folder (your home folder and Vectron’s own folders are refused), which network answers under Listen on (by default the wired one; a VPN can be chosen too) and whether devices may upload. Uploads never replace a file: an existing one is kept as a .bak copy. Port 69 works without administrator rights. The server runs in its own small process, apart from your open vault.

SFTP. Right-click an SSH host → Browse Files (SFTP), or choose SFTP in Quick Connect, to drag files to and from the server. Downloads ask where to save, or go straight to a folder you set in Settings → Files & Recordings → SFTP Downloads (a file with the same name is kept and the new one saved as name (1)).

Remote desktops. RDP and VNC open in tabs or grid panes like terminals. Ctrl+Alt+Del and the Windows key are in the session bar; drag files from Finder onto an RDP desktop. Files you copy on the Windows side show a Save to Mac… banner (up to 10 MB each). Clipboard and files are shared only when Settings → Sessions → Share clipboard text with remote computers is on.

Config templates. Keep command snippets with {{variables}}, fill them in and send them to a session after you check the result (Session → Send Template…, ⇧⌘T). Template Library… on the Config Templates page adds ready-made templates for Cisco IOS / IOS XE, Aruba CX, HP E-Series / ProCurve, H3C / HPE Comware and Huawei VRP to your vault, where you can edit them like your own. Vectron warns when a template was written for another kind of device.

IP Scanner. Tools → IP Scanner, then pick one of your networks under My Networks (or type a range). Devices that ignore ping but answer on a service port are marked with an amber dot ●. Green service badges connect straight away (SSH, Telnet, RDP, VNC) or open the web page; ⋯ has ping, port check, Wake-on-LAN, copy and Add to Vault. The type column is a best guess from the open ports. Export saves the list as CSV (spreadsheet) or PDF (report).

Find. ⌘F searches the terminal screen and scrollback; ⌘G / ⇧⌘G for next and previous.

Recording. ⇧⌘R records a session (terminals as replayable text, remote desktops as video). Only what the session shows is recorded, never your keystrokes. Session → Play Last Recording or Open Recording… opens the player; Export as Text there saves the whole session as a plain text file, for a change record or a ticket. Settings → Files & Recordings → Remote desktop video quality: Small, Standard or Sharp.

AI assistant (optional). ⌘J, in SSH, Telnet and serial sessions. Uses your own provider and key (Claude, OpenAI, Gemini, others) or a model on your own Mac. With Ask first on (the default) every command it wants to run waits for your click; it only ever runs viewing commands. Changes are suggested as commands you review, and Review & Send… types them only after you confirm. It answers in the language you write in. Passwords and secrets it recognizes are removed before anything is sent (see Security), and Vectron asks once per provider before the first question. Details below.

Shortcuts. The full list is below and in the app under Help → Keyboard Shortcuts.

Copy and paste in the terminal

In SSH, Telnet and serial sessions (not remote desktops):

• Select to copy. Selecting text with the mouse copies it; a small “Copied” appears at the pointer. ⌘C copies too. Switch it off in Settings → Terminal → Mouse and Paste → Copy text when selected.
• Right-click opens a small menu: Copy, Paste, Select All, Find… and Clear Terminal (only your screen; nothing is sent to the device). With text selected, Ask AI About Selection is at the top. If you prefer the classic terminal habit, turn on Right-click pastes (PuTTY style) in the same settings: right-click then pastes at once, and ⌥-right-click opens the menu.
• Pasting more than one line asks first. Whether you paste with ⌘V, the menu, right-click or by dropping text, Vectron shows “Paste 12 lines into DC-01?”, or “into 4 panes (…)” when Broadcast is on, with the lines to check. Cancel is the default button, so an accidental Return does not paste a whole script into a switch. A single line pastes without asking. This can be switched off in Settings → Terminal → Mouse and Paste → Ask before pasting more than one line, but we suggest keeping it.

AI assistant

Open it with ⌘J in a terminal session and ask in plain words: “is anything wrong in the logs?”, “why is the disk full?”, “is port 4 up?”. The assistant looks at the device with viewing commands, explains what it found and, when a change is needed, writes the exact commands for you to review.

• Ask first is on by default: every command the assistant wants to run appears in the panel with a Run (Read-Only) button; you see it typed into your session. Switch it per session at the bottom of the panel (Ask first: on / off), or for all sessions in Settings → AI Assistant → Run read-only commands automatically.
• The platform is detected by Vectron, not guessed by the model: from the version output, the login banner or the shape of the prompt, Vectron recognizes Cisco (IOS, IOS XE, NX-OS, ASA), Arista EOS, Aruba AOS-CX, ArubaOS-Switch / ProCurve, H3C / HPE Comware, Huawei VRP, Juniper Junos, FortiGate, MikroTik, Dell OS10, Extreme EXOS, Ubiquiti EdgeOS, Linux and Windows, and tells the assistant to use that syntax.
• It stays on topic. A question that has nothing to do with network or system work gets a one-line reply, and nothing from your session is sent with it.
• Web search. With Claude, Gemini or OpenAI, the assistant can look up current releases, security advisories, end-of-life dates and vendor documentation. Only the search words go to your provider, never addresses, host names or configuration. A search with words taken from the device asks first. Turn it off in Settings → AI Assistant → Search the web when needed.
• Changes are only suggested. They arrive in a code block with Copy and Review & Send…. Review & Send lists every line and types them only after you confirm. If the assistant asked you to run a viewing command yourself and you sent it, a Continue with the Output button lets the conversation go on with what the device answered.
• One command, once. The assistant never types the same command twice for one question; it is told to use the output it already has.
• When a provider is busy or out of credit, the message says so plainly, including how long to wait when the provider tells us.
• Answer language is “The language I write in” by default. To use your Mac’s language or a fixed one, change Settings → AI Assistant → Answer language.

Which commands the AI may run

Only commands that view things. Vectron checks every command the assistant wants to run before it is typed; the model’s intent does not matter, the command text does.

• Network devices: show, display, get, ping, traceroute, MikroTik print, and the commands that turn paging off for the session. Output filters such as | include, | grep, | head are allowed after them.
• Linux and Unix servers: the usual viewing commands: uname, uptime, df, du, free, ps, top -b -n 1, ss, netstat, ip, ifconfig, dmesg, journalctl, ls, find (listing only), cat / head / tail / grep / wc / stat on a file, systemctl status, service … status, lsof, mount, docker ps / logs / inspect, dig, host and a few more, each with only its harmless options.
• Always blocked: anything that writes, deletes, installs, restarts or configures; sudo; options that run other programs or read a list from a file (find -exec, grep -f…); redirections and ;, &&, backticks; anything interactive (less, vi, top without -b) or endless (tail -f, docker logs -f).
• Never read: files that may hold passwords or keys, such as /etc/shadow, sudoers, anything under .ssh, .env files, *.pem and *.key, shell histories, cloud and database credential files, /proc/*/environ. Not even through wildcards or .. paths. Passwords and keys that do appear in other output are replaced with ‹hidden› before anything is sent.
• When a command is refused, the panel says why and that you can type it yourself if you want it.

AI: usage and monthly limit

Vectron counts the tokens your provider reports with each answer and keeps the count on your Mac (Settings → AI Assistant → Usage): per provider this month and today, the number of questions, and last month’s total. In the panel a thin line shows “Month … · today … · chat …”, each answer ends with “2 steps · 4.7k tokens”, and the footer shows the last question. Nothing about money: the provider’s own page has the exact figures and your bill.

Monthly token limit. Enter a number such as 1M or 500k. It covers all cloud providers together; a model on your own Mac is not counted. At 80% you get one note; at the limit the assistant pauses (if “Pause the assistant at the limit” is on): nothing is sent until you allow a single question, and past the limit every further command round asks Continue One More Step or Stop Here. Change or remove the limit any time; Reset the Counters… clears this month’s and last month’s numbers on your Mac only.

AI: using a model on your own Mac (Ollama, LM Studio)

Nothing leaves your network, and no key is needed.

1. Install a server. With Ollama, get a model in Terminal, for example ollama pull llama3.2 (small, with tool support) or a larger one such as qwen2.5-coder:14b. LM Studio: download a model and start its local server.
2. Point Vectron at it. Settings → AI Assistant → Provider: Local server (Ollama, LM Studio). For Ollama on this Mac, click Use This Mac (it fills in http://127.0.0.1:11434). For LM Studio, type http://127.0.0.1:1234 and click Save. A server elsewhere on your own network works too. The model list then loads, and the status says “Connected · 3 models” or says, in plain words, that nothing answers at that address (is the server running?), that the server has no /v1/models, or that there are no models yet.
3. Give the model room. Ollama’s default context is 4,096 tokens, too little for the assistant’s rules plus a screen of output; the model then ignores its instructions. Set 16k or more: in the Ollama app’s settings if it offers a context length, or quit Ollama, run launchctl setenv OLLAMA_CONTEXT_LENGTH 16384 in Terminal and start it again. If you run the server yourself, start it as OLLAMA_CONTEXT_LENGTH=16384 ollama serve (stop a Homebrew service first with brew services stop ollama). Vectron notices the typical signs of a cut-off conversation and tells you once.

What to expect. Small models (3–7B) are quick but often pick wrong commands or ask you to run them; 14B and larger do noticeably better. Everything else is the same as with a cloud provider: Ask first, the read-only check, secret removal and Review & Send. If a model cannot use tools, the panel says so and suggests one that can.

Serial console

Plug in the USB-to-serial adapter first, then Quick Connect → Serial. USB adapters are listed first; the Mac’s own ports (debug-console, Bluetooth) come last and are marked “(macOS, not a cable)”; they are not what you want. Pick the speed the device expects (9600 is the usual default; 115200 for many newer ones). The tab shows “Connected” once the port is open; a serial line has no login step, so press Return to see the prompt.

If the port does not open within 8 seconds, Vectron says so instead of waiting: usually the adapter’s driver is stuck. Unplug the adapter, plug it in again and connect once more. “The port is in use by another app” means exactly that: close the other program first.

Moving from another app

Open a vault, then File → Import into Vault… (or Import… on the Vault page) and pick where your sessions come from. You see how many connections and folders were found before anything is added. Everything lands in one new folder in the sidebar, “Imported – app (date)”; drag or Move the items where you want them.

• SSH, Telnet, RDP and VNC connections are imported with their folders, host, port and username. Other types (serial, web, file transfer…) are listed as skipped.
• Saved passwords from other apps are not imported. Those apps keep them encrypted in their own way. Vectron asks when you connect, or attach a credential to the folder.
• Passwords in a CSV file are stored encrypted in your vault. The CSV itself is plain text: delete it when you are done.
• Vectron only reads the file. Nothing in it is run; SSH config ProxyCommand, Include and Match lines are skipped.
• Importing into a folder name that already exists asks first, so the same file is not added twice by accident.

Sharing hosts with a colleague or another Mac

On the Vault page click Export… (or File → Export Vault…, or right-click a folder → Export…), tick the folders or hosts (folders open with the arrow; ticking a folder takes everything in it), set a password for the file and click Export… to choose where to save it. The file is encrypted the same way as your vault.

• Include IPAM subnets (on by default) adds the subnets and IP records of the selected folders.
• Include logins (off by default) adds saved credentials and usernames/passwords typed on hosts. Anyone who knows the file’s password can read them, so use a strong password and send it separately from the file.
• Tick the customer’s folder rather than single hosts: its credentials then stay in that folder after import. Credentials of hosts exported without their folder arrive under Shared.
• To import: Import… → Vectron vault → pick the file and enter its password. Everything lands in a new folder. A Shared credential that is already in your vault (same name, username and password) is not added twice; credentials inside folders always stay separate, even if they use the same password.

Keyboard shortcuts

The same list is in the app under Help → Keyboard Shortcuts and Settings → Shortcuts.

General

Hosts and folders

Terminal (SSH, Telnet, Serial)

Command box

Remote desktop (RDP and VNC)

Recording player

Diagnostics

Uninstalling Vectron

Drag Vectron from Applications to the Trash (or in Launchpad hold its icon and click ×). Before you do:

• Cancel your subscription separately. Deleting the app does not cancel it. App Store → your name → Account Settings → Subscriptions → Vectron → Cancel.
• Remove your AI provider key. Settings → AI Assistant → Forget Key. We never see or store your key anywhere else, so it is also up to you to revoke it in your provider’s console if you no longer use it.
• Forget the remembered vault password: on the Vault page, click Forget Saved Password on This Mac (or Settings → Security → Touch ID → Forget…), so it doesn’t stay in the Keychain.
• Keep a copy of your vault. If your vault is in iCloud Drive, it stays there for your other devices. If it is kept only on this Mac, the vault and its backups are inside Vectron’s own folder: first use Vault → Export… (tick everything and Include logins) to save a copy somewhere else.
• To remove Vectron’s settings too, delete ~/Library/Containers/app.vectronlabs.vectron after the app is gone. This also deletes a vault kept only on this Mac, so export it first.

Troubleshooting

Serial console: the port doesn’t open, or the wrong port. Choose a USB adapter from the top of the list, not “debug-console (macOS, not a cable)”. If Vectron gives up after 8 seconds, unplug and re-plug the adapter and try again; if another app has the port, close it first. See Serial console.

Devices on the local network don’t answer. System Settings → Privacy & Security → Local Network → turn on Vectron.

“New host” every time I connect to a new device. That is the first-connection check. Trust it once and it is remembered; or switch to Trust new hosts automatically in Settings → Security → New hosts.

“The server’s host key has changed.” Vectron warns before sending any password. If you know why (the device was replaced or re-keyed), right-click the host → Forget Host Key (RDP: Forget Server Certificate), or use Vault → Show Known Hosts…, and connect again.

RDP: sign in on the server’s own screen. Some servers show a logon message, a Duo / 2FA prompt or a “change your password” screen before you can sign in. Edit the host and turn on Sign in on the server’s screen (logon message, 2FA; no NLA): Vectron then does not send the saved password, and you sign in on Windows’ own logon screen. The server’s certificate is still checked. The server must allow sign-in without Network Level Authentication (NLA); if it refuses (“requires Network Level Authentication”), turn the option off again.

TFTP: a device can’t reach the server. Check that it is on the network chosen under “Listen on” and that uploads are allowed if it is sending a file. Refused requests are listed in the TFTP log.

Vectron asks for a folder again (session logs, TFTP). Mac App Store apps can only open what you picked. Choose it once more after moving or renaming it.

“iCloud Is Off”. Your vault is in iCloud, but iCloud Drive is off for Vectron on this Mac. Turn it on in System Settings → [your name] → iCloud → iCloud Drive, or click Use the Copy on This Mac to work with the last copy kept here. That copy then counts as a separate vault; when iCloud is back, you compare the two and choose.

Subscription. Settings → Subscription shows the status, Restore Purchases, Redeem Code and Manage Subscription. Without internet Vectron keeps working until the paid period ends.

Anything else: Support.