RelayBar is a tiny native macOS menu-bar app for local SSH port forwards. It has no external dependencies and runs macOS's built-in /usr/bin/ssh directly.
- Imports common commands such as
ssh -N -L 8080:localhost:3000 user@host - Adds tunnels manually with five small fields
- Starts and stops each tunnel with one click
- Starts a tunnel and opens its local URL in the default browser with one click
- Retries unexpected disconnects up to 10 times with exponential backoff
- Shows startup failures directly beside the tunnel
- Stores tunnel definitions in local
UserDefaults - Stops child SSH processes when RelayBar quits
RelayBar intentionally manages one local (-L) forward per item. Safe connection options such as -p, -J, -i, and a restricted set of -o values are preserved when importing a command. Options that can execute local commands, select arbitrary configuration files, or write logs are rejected. RelayBar never invokes a shell.
RelayBar is distributed outside the Mac App Store and is intentionally not sandboxed. Its SSH process behaves like the command-line client: it reads the user's normal ~/.ssh/config and known_hosts, can use configured identity files, and inherits access to the user's SSH agent. SSH still runs non-interactively, so password prompts are not supported. On recent macOS versions, the first connection to a .local or LAN host may ask for Local Network access.
The concise architecture and behavior archive starts at docs/system-specs.
Requires macOS 13 or newer and the Xcode command-line tools.
./scripts/build-app.sh
open .build/RelayBar.appThe packaged app is written to .build/RelayBar.app. The build script automatically finds the first valid Developer ID Application certificate in the login keychain and signs with the hardened runtime.
To create a signed ZIP:
./scripts/package-release.shThis writes .build/RelayBar.zip. A Developer ID signature identifies the publisher, but a downloaded app should also be notarized to pass Gatekeeper without warnings. After storing one notarytool keychain profile, notarize and staple with:
xcrun notarytool store-credentials relaybar-notary \
--apple-id YOUR_APPLE_ID \
--team-id YOUR_TEAM_ID \
--password YOUR_APP_SPECIFIC_PASSWORD
NOTARY_PROFILE=relaybar-notary ./scripts/notarize-release.shSet SIGNING_IDENTITY only when a Mac has multiple Developer ID certificates and the automatic choice is not the one you want.
swift test