iTerm2 is free software under GPL v2, it has been refined for two decades, and it is a better terminal than we are going to be for years. We are not trying to replace it. This page is about the job it does not do.
iTerm2 is a terminal emulator for macOS. It is free software, licensed under GPL v2, and the current release works on macOS 12.4 or newer. Its feature list is the accumulated result of twenty years of people asking "can it do X": split panes, a hotkey window, regex search, instant replay, triggers, shell integration that knows where your prompt is and which host you are on, automatic profile switching, inline images, annotations, captured output. If you want a terminal to do something, iTerm2 probably already does it, and probably has a preference for it.
Tryssh is not a better terminal. It is an SSH workspace: a list of machines, each with a saved connection record, a persistent chat with an agent that runs commands over its own SSH channel, live CPU/memory/disk/network metrics, an SFTP browser, background jobs, recurring watchers, and a local audit log of every command the agent proposed. The terminal inside it is SwiftTerm and it is fine. It is not the point.
Two different questions. "How good is my terminal?" and "who is looking after these servers?"
Verified as of July 29, 2026. Every iTerm2 claim below is taken from iterm2.com, with the exact source URL in an HTML comment next to the claim in this page's source. iTerm2's AI features in particular have moved quickly — if you spot something stale, tell us.
Read the "iTerm2" column first. It is free, and it wins more rows than you might expect.
| Capability | iTerm2 | Tryssh |
|---|---|---|
| Price and licence | Yes Free software under GPL v2 | Free to download; agent turns metered. 200 credits to start, Pro $19/mo for 2,400, Scale $29/mo for 4,500 |
| macOS requirement | Yes macOS 12.4 or newer | macOS 14 or newer (Apple silicon, arm64) |
| Terminal emulation depth | Yes Split panes, hotkey window, regex search, Instant Replay, triggers, inline images, captured output, annotations, badges | No SwiftTerm, competent, nowhere near this |
| Shell integration | Yes Knows your prompt, your commands, your host and your directory | No Not implemented |
| Host configuration | A taggable, searchable profiles database — profile-shaped, one config per profile | Host records with name, host, port, user, auth type and per-host agent settings, in SQLite under ~/.tryssh |
| Credential storage | Yes Password manager, stored encrypted in the macOS keychain | Yes Keys and passphrases in the macOS keychain (service ai.definable.tryssh), never in a database |
| SSH conveniences | SSH integration auto-loads shell integration, sets env vars and copies files over — documented as beta quality and needing Python 3 on the remote | Plain SSH: an ssh2 exec channel for the agent and a separate PTY for you. Nothing installed on the remote |
| File transfer | Upload and download via Shell Integration utilities | Yes Built-in SFTP browser and remote file editor over the same SSH session |
| AI available | Yes An optional AI plugin, deliberately shipped as a separate component so terminal data cannot leave by accident | Yes Built in — it is the product |
| Can the AI run commands | Yes With the Run Commands permission granted; it can also type for you and write to the filesystem | Yes Multi-step, on its own SSH exec channel — reads output, decides the next step, reports back |
| AI permission model | Per-capability, cycling Never → Ask → Always; a new chat gets no visibility into your windows until you link a session | Per-command classification: default-deny unless it is read-only and metacharacter-free; a denylist that always prompts even under auto-approve |
| Where the AI sends data | Yes Your own provider and your own API key, stored in the keychain — no vendor in between | Our gateway to Anthropic by default (that turn's commands and output leave the machine); with your own ANTHROPIC_API_KEY, direct — no gateway, no credits, no account |
| Per-host agent memory | Not documented — a chat is linked to a session, not to a stored host | Yes Each host has its own chat sessions and its own memory |
| Live host metrics | Status-bar values from the remote host via SSH integration | Yes CPU, memory, disk and network sampled and charted while connected |
| Background jobs & recurring checks | Not offered as a feature — this is not a terminal's job | Yes Long commands detach into tracked jobs; watchers re-run a check on an interval |
| Command audit trail | Scrollback, Instant Replay and shell-integration command tracking — not a queryable log | Yes Every agent command with risk level, auto-approved flag, exit code and output — local SQLite |
| Source available | Yes GPL v2, twenty years of public history | No Not public today |
Most of this table. Here are the rows that should actually change your decision.
ANTHROPIC_API_KEY, but ours is not the default and theirs is.We should also correct a thing people say about iTerm2 in comparison posts: it is not an AI-free tool. Its AI Chat can execute commands on your behalf and type for you, and it gates each capability with a permission that cycles Never → Ask → Always. That is a considered design, not a bolt-on.
The difference is not "we have AI and they do not". It is what the application is built around.
iTerm2's answer to "many different hosts" is a taggable, searchable profiles database. A profile is terminal configuration: colours, font, a command to run. That is the right abstraction for a terminal.
In Tryssh a host is a first-class object with things hanging off it: chat sessions with memory, a metrics history, an SFTP tree, background jobs, watchers, a per-host command allowlist you grow by approving things, and an audit log. Open the machine on Thursday and Tuesday's investigation is still attached to it. That is a different data model, not a longer preferences pane.
iTerm2's AI, once you grant the permissions, acts through your session — "Run Commands" and "Type for You" are the documented capabilities. It is honest about that, and the Never/Ask/Always cycle is how you control it.
Tryssh splits the channels at the architecture level. The agent opens its own ssh2 exec channel; your interactive shell is a separate PTY. The agent cannot read what is on your screen and cannot type into it, regardless of settings. Whatever it runs, it runs in its own channel, and you see the transcript.
Both tools ask before doing risky things; the mechanisms differ. iTerm2 gates by capability — you decide whether the AI may run commands at all. Tryssh gates by command — the AI can always propose, and each individual command is classified.
Auto-run requires two conditions: the command matches a read-only allowlist (ls, cat, df, ps, journalctl, systemctl status, git log, kubectl get and friends) and it contains no shell metacharacters. An unrecognised command is unsafe. Unbalanced quoting is unsafe. Everything that fails those tests renders on a card with the exact text and waits for your click. A separate denylist — mkfs, dd of=, recursive rm against a system path, flushing firewall rules, stopping the sshd you are connected through, piping a download into a shell — always asks, even with auto-approve on for that host.
Not a claim about safety in general. A default-deny gate is a real constraint, not a guarantee. It stops an agent surprising you; it does not stop you approving something you should not have. You are still the operator.
Long commands detach into background jobs you can check on later instead of holding a session hostage. Watchers re-run a check on an interval and tell you when the answer changes. Metrics are sampled and charted while you are connected. Every agent command is written to a local audit log with its risk level and outcome. None of these belong in a terminal emulator, which is exactly why iTerm2 does not have them.
There is no migration, because there is nothing to migrate away from. Keep iTerm2.
Tryssh has no importer. No ~/.ssh/config import, no iTerm2 profile import. Hosts are added by hand in the app. If you have thirty profiles, do not sit down and retype thirty of them — add the few you actually SSH into and judge from those.
iTerm2 stays your terminal. Tryssh does not register itself as a terminal, does not touch your profiles, and does not read your shell config.
Profiles that open a local shell or a tmux session have no equivalent here and should stay in iTerm2. Add the remote machines you are responsible for.
Add a private key once to the key vault and reuse it across hosts; the key bytes and any passphrase go to the macOS keychain and the database stores only a reference. ssh-agent also works — pick "SSH agent" as the auth type and Tryssh uses your existing SSH_AUTH_SOCK.
"What is filling /var and is any of it safe to delete" is a fair first test. If the answer is not better than what you would have typed yourself, close it and go back to iTerm2 — that is a legitimate outcome.
~/.ssh/config. Hosts are added by hand. It is a real gap and it is on the list.ANTHROPIC_API_KEY and the gateway is skipped entirely — the same posture iTerm2's plugin takes by default.Add one server, ask one real question. 200 agent turns to start, no card required.