Pocketty iPhone SSH Terminal Review and Comparison

Pocketty delivers instant, sealed agent alerts to your iPhone

Pocketty lets you open a full‑screen SSH pane on iOS the moment a herdr agent is blocked or finishes, and the notification payload is sealed with HPKE so only your phone can read it.

Core functionality: real‑time agent alerts

What happens: When an agent changes state (e.g., herdr w1:p1 blocked → working), the pocketty daemon on the host seals the alert with a key stored in the iPhone Secure Enclave, forwards the ciphertext through a Cloudflare Worker relay, and Apple Push Notification Service delivers it to the device.
Why it matters: The alert contains only metadata (agent name, state, host, workspace, tab). No pane text or code is transmitted, guaranteeing privacy even though a third‑party relay is involved.

Direct SSH connection, no middle server

What happens: Pocketty opens an SSH session straight to the host over Tailscale (or any reachable SSH server). The app does not act as a proxy; the terminal traffic never passes through Pocketty’s servers.
Why it matters: End‑to‑end encryption is preserved, and there is no additional latency or single point of failure.

Native herdr Pane view on iOS

What happens: Pocketty speaks herdr’s API to list workspaces, tabs, and agents. Selecting a Pane opens the exact remote terminal pane in a full‑screen Metal‑rendered terminal (Ghostty engine). Swiping from the edge shows a diff of the last agent turn, and closing the Pane returns you to the previous view.
Why it matters: Users get a desktop‑grade terminal experience on a phone without taking screenshots or installing hooks in the agents.

Secure key handling and host verification

What happens: SSH keys are generated inside the iPhone Secure Enclave and protected by Face ID. Host keys are pinned; a changed host key triggers a manual trust prompt.
Why it matters: Compromise of the phone’s private key is mitigated, and man‑in‑the‑middle attacks are blocked by host‑key pinning.

Agent‑state‑driven UI features

Turn‑based diffs: The daemon snapshots the worktree at each agent turn, allowing you to view only the changes made in that turn, the whole session, or all uncommitted changes.
Port preview: When an agent opens a local port, Pocketty offers an in‑app preview that loads through the same SSH tunnel—no separate port‑forwarding configuration is required.
Text‑mode input: Whole messages can be sent at once via dictation, paste, or image upload; the app inserts the resulting file path into the remote shell.

Pricing and trial model

Free trial: 14 days of full functionality from the first connection.
Launch price: $99 one‑time purchase (originally advertised as $129). No subscription, no account, no ads.

Comparison with Moshi (another iOS SSH/agent client)

Feature	Pocketty	Moshi
Price	$99 one‑time (free 14‑day trial)	Free tier; Pro $9.99 /mo, $89.99 /yr, $199 lifetime
Notification payload	Sealed metadata only (HPKE)	Sends title, prompt, and up to 256 bytes of command text to Moshi’s server
Who can read notifications	Only your phone (relay and Apple see ciphertext)	Moshi’s server caches events for up to 24 h
herdr integration	Native Pane view, live agent state, no hooks	Partial integration; some features require a paid Moshi‑hook
Diffs	Turn‑based, session, uncommitted (daemon required)	Only uncommitted side‑by‑side, Pro feature
Version compatibility	App and daemon update independently	Desktop hook must match App version

The comparison table is taken directly from Pocketty’s website and reflects the state of both products as of October 2 2026.

Community feedback from Hacker News

Alternative open‑source clients: Users mentioned Heeler (a free, open‑source iOS SSH client) and herdr‑web‑ui (a self‑hosted PWA) as comparable solutions.
Feature requests & bugs: One comment reported a “herdr is not installed on this host” error after connecting, indicating a possible compatibility issue that may affect the $99 value proposition.
Use‑case validation: Multiple commenters praised the ability to monitor agents while commuting, confirming the core value proposition of mobile‑first agent awareness.

Security model at a glance

Sealed alerts: Host daemon encrypts alerts with HPKE using the phone’s public key; only the phone can decrypt.
Relay: Cloudflare Worker forwards ciphertext; it never sees plaintext.
Apple Push: Delivers sealed payload; Apple sees only a generic “Agent update” label.
Phone: Notification extension decrypts, verifies host key, and presents the alert.
Optional: Turn off notifications to eliminate any relay traffic entirely.

Full details are available in Pocketty’s security model documentation.

Quick start checklist

Install the pocketty daemon on the host (curl -fsSL https://pocketty.app/install.sh | sh).
Ensure the host is reachable via Tailscale or another SSH‑accessible network.
Open Pocketty on iOS, tap Nearby, and enter the six‑digit pairing code displayed on the phone.
Accept the host key prompt; the key is now pinned.
Use the native Pane list to open any herdr agent or a regular SSH shell.

Verdict

Pocketty provides a privacy‑first, low‑latency bridge between iOS and remote herdr agents, delivering sealed state notifications and a full‑screen terminal that feels native on a phone. Its limited feature set (by design) reduces attack surface compared with competitors like Moshi, and the one‑time $99 price makes it a compelling option for developers who need mobile access to AI‑driven coding agents.