8.1k stars · Apache-2.0 | v0.29.2, 7 Oct 2026 | [warpgate.null.page](https://warpgate.null.page/) · v0.29.2 (2026-10-07) · Track this in Rising ↗
A guarded front door for a server, with two-factor sign-in and a recording of every session.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 27 Oct 2026, the same day before this check.
Latest release v0.30.2 on 26 Oct 2026.
Public since February 2022, a little over 4 years.
8,155 stars and 434 forks.
421 commits and 140 new issues in the last 90 days.
88 contributors. 229 pull requests merged in 90 days.
A security policy says how to report a problem. 29 published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 27 Oct 2026 from the repository on GitHub. Covered in Edition 16.
▶Repo detailsthe review · specs · pros & cons · install
What it does
Warpgate is a single guarded machine that all access passes through, so the machines behind it never face the internet. It accepts connections carrying specially formatted credentials, signs the person in itself, opens the connection to the target, and joins the two sides together. It covers SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC, and it offers terminal, remote-desktop and VNC sessions inside a browser while normal command-line clients keep working. An administrator assigns each person to named hosts and addresses through a built-in web interface, which also shows sessions live, replays finished ones and holds the logs. It includes a code-from-your-phone second factor and single sign-on, and it blocks addresses and locks accounts after repeated failed attempts. It is one program written in Rust with no other software to install, and it keeps its data in SQLite, a database that lives in a single file. It is deliberately not a jump host: nothing extra is installed on the machine you connect from, and no wrapper script is needed.
Why it matters
Who it suits. It fits anyone running one or two servers alone, which is the case where this kind of thing is normally skipped as overkill. It also fits a small team that has to show a customer it keeps access records. There are two ways to work: open the web page and get a terminal or a database session in the browser, or keep using the normal ssh command and point it at Warpgate. Skip it if the servers are already behind a company network that does this, or if adding a second piece of infrastructure to maintain is the bigger risk.
Verdict. Worth a weekend, and the session recording is worth more than it sounds — the first time a customer asks whether access is logged, the honest answer stops being no. The real danger is the obvious one: this becomes a single point of failure in front of everything. Keep another way in before switching over, whether that is the hosting company's console or a firewall rule that lets one address through. Do not close the existing SSH access until a sign-in through the new door has worked once. gravitational/teleport does the same job at company scale, with a heavier licence and a much larger install.
Summary (Key Points)from the README
Key features
- Protocol coverage: Accepts SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC connections on one bastion host.
- No client app needed: Works without a custom client or SSH wrapper, and native clients keep working.
- Browser access: Built-in browser-based SSH, RDP and VNC access.
- Session recording: Records every session, viewable live and replayable later in the admin web UI.
- Precise access assignment: Admins assign users to specific hosts and URLs through the admin UI.
- Native 2FA and SSO: Supports TOTP and OpenID Connect out of the box.
- Brute-force protection: Blocks IPs and locks out users.
- Temporary credentials: Tickets provide temporary access credentials.
- Single binary: Ships as one binary with no dependencies, written in 100% safe Rust.
- Editor-friendly config: Setup-generated config files include a yaml-language-server schema reference.
Ways to install
| Platform or method | What it needs | Effort |
|---|---|---|
| Getting started docs | Follow the Getting started guide; the README lists no prerequisites for this path | Not stated |
| Getting started on Docker | Docker; the README names Docker but gives no version or details | Not stated |
| Release and beta binaries | Download the single binary; no dependencies are required | Download and run |
| Nightly builds | Download the nightly build; the README gives no stability details | Download and run |
| Build from source | Rust, NodeJS, NPM and `just`; then `just npm install`, `just npm run build` and `cargo build` | Highest of the listed options |
Important
- Deployment position: Warpgate is meant to run on a bastion or DMZ host, not as a jump host or VPN, and it forwards connections transparently to the target.
- Session storage: Session history is stored in an SQLite database, which defaults to /var/lib/warpgate.
- Build prerequisites: Building from source requires Rust, NodeJS, NPM and the `just` task runner.
- AI-assisted contributions: Contributors must disclose AI use, and the maintainer states that architectural and security decisions are made by humans.
- Security reports: Report vulnerabilities through GitHub's vulnerability reporting system.
- Project status: The README says Warpgate is used in enterprise settings and points to a public roadmap for planned work.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- One program and no separate database. It uses SQLite, which lives in a single file, so there is nothing extra to install or back up.
- Nothing to install on the machine you connect from. A browser is enough, and the normal
sshcommand still works. - The project states it is free and stays free, with no features held back for a paid tier. The second factor is included, which some competitors charge for.
- It becomes a single point of failure in front of everything behind it. Keep a second way in.
- No memory or processor minimum is published, so plan to watch it for the first week.
- It is a small project. The licence is safe, but the number of people maintaining it is not large.
docker run --rm -it -v /opt/warpgate:/data ghcr.io/warp-tech/warpgate setup docker run --rm --name warpgate -p 8888:8888 -p 2222:2222 \ -it -v /opt/warpgate:/data ghcr.io/warp-tech/warpgate
