Your machines are either hard to reach or exposed. Make access convenient and you make it exposed at the same time: the port that lets you in is the port the scanners sweep for.
So estates accumulate exceptions. A VPN client here, a jump host there, a vendor console, a custom portal, a different token for each, and automation ends up with five code paths instead of one. Hop chains cost more than that: log into a bastion, hop onward, and the middle machine sees your session in clear and holds the keys to the next leg. Session recording works precisely because it can.
askd removes the trade. Machines dial out to a relay and wait, so nothing listens anywhere and there is no port to find. The relay forwards bytes it cannot read, and never holds an address it could use to call your machine back. You meet somewhere neutral, not at your house.
The complexity collapses. Different networks, different access methods and multi-hop chains all reduce to one setup and one SSH hop. ssh yourbox uses the keys and config you already have; -L, -D, -W, scp and rsync ride it; SSH stays end-to-end from your terminal to the target, so the hops that disappeared were also the ones that could read you. Simpler and safer at once, which is the trade you were told you could not have. The relay is yours, on a box you picked, under a law you picked, and movable whenever you like because it holds no private key and no secret state. The CA is yours too, on hardware in your hand. Nobody vets your security or issues your identities. Zero third-party dependencies, no control plane, no subscription.
The protocol is already public: read the specification · test vectors
What actually rides inside what, tunnels within tunnels:
Both sides dial out, so neither opens a hole. Access is decided by small CA-signed capability credentials, not passwords or IP allow-lists: an identity, capability bits, a validity window, revocable. The relay holds only the CA's public key and verifies statelessly. No account database anywhere.
All of the above disappears behind the tools you already have:
# once: write an ssh ProxyCommand block for this host
ask config prod-db
# from then on it is just ssh, from anywhere, with no open port on prod-db
ssh prod-db
scp report.tar.gz prod-db:/srv/ # scp, rsync, -L, -D all ride the same tunnel
# or skip the config entirely and connect ad hoc
ask ssh prod-dbNo VPN, no jump-host chain, no client to replace. Your keys, your ~/.ssh/config, your tooling, unchanged. When something breaks, ask doctor prod-db names the part instead of hanging.
An agent exposes more than its own box. Point it at a service, front a whole inventory (a gateway), or let it dial a client-chosen host on demand (a jump), each bounded by the credential's capabilities and the gateway's allow-list. The machines behind it install nothing, and SSH stays end-to-end to the final host.
And the hops collapse for you. A box that would normally take a chain of jump hosts, several ssh -J hops, or a bastion you tunnel through by hand, becomes a plain ssh <host>. The agent carries the multi-hop path (and, for an enclave it can't reach directly, bridges over a further SOCKS hop); you run one command, as if the machine were next to you. And, riding several relays at once, that one ssh is gap-free, unbroken by a relay failing mid-session.
Two guarantees fall straight out of the design, then the capability set beneath them.
With askd you can drop all inbound, including port 22, and still get SSH, because the machine dials out and the login rides the brokered tunnel. The entire class of “sshd exposed to the internet” risk goes with it: credential brute-force, scanning, and even a pre-authentication sshd zero-day of the regreSSHion variety have nothing to reach. You cannot attack a port that does not listen.
A VPN or mesh drops you onto a flat network, where one compromised host can pivot to everything. askd grants capability-gated, per-target, brokered reachability: each connection is authorised by a specific credential to a specific destination. There is no flat network to sweep, so compromising one path does not hand over the estate. Reachability stays high; blast radius stays small.
Maximum availability of access, minimum available attack surface.
The full capability set:
Drop all inbound, including port 22, and still get SSH. You cannot attack a port that does not listen.
Single Packet Authorization. Get the packet wrong and you learn nothing: there is no error to enumerate against.
The relay forwards your SSH bytes without ever decrypting them, unlike an access proxy that terminates your session to read it. The encryption stays sealed end-to-end; a compromised relay inconveniences you, it does not expose you.
Sign exactly what an identity may do, connect, register, jump, scoped and time-bound. Revocable.
The CA private key lives on a hardware token, a Swedish YubiKey or a German Nitrokey HSM, both from European makers, and never leaves it. Tested and in use on both (7/7 end-to-end each), with a verified backup across two Nitrokey HSMs.
Every access event is sealed to an offline auditor's key before it is written, so the relay records who reached what and can never read its own log back. Tamper-evident against corruption and in-place edits. A compromised relay could still rewrite its own history, which is exactly why the auditor's key never lives on the box.
Ride several relays at once, so a relay dying mid-session is covered with zero gap. And since each packet counts from whichever copy lands first, latency is the fastest path per packet, measured, quicker than even the best single relay, with the jitter smoothed out.
It is an ssh ProxyCommand. scp, rsync, -L/-D all ride the tunnel. Bring your own tools.
No third-party libraries at all. Runtime safety checks stay on in production. Sandboxed and isolated, failing closed.
None of this is a roadmap promise. Every capability above is implemented and in author-operated use today. What it is not yet is publicly released, or proven across other people's environments, and both of those are what the status section is for.
Convenience is the surface. Three things underneath are structural.
SSH in practice rests on weak passwords, keys unprotected on disk, and passphrases a compromised machine captures as they are typed. askd's CA key lives on a hardware token: non-extractable, touch-per-use. Own an admin laptop and you still cannot mint a credential. Proven 7/7 on both a YubiKey and a Nitrokey HSM, backup verified across two devices. (The operator's knock key is still software; hardware for that is funded work, not claimed here.)
Removing SSH access means editing authorized_keys on every machine someone could reach, and hoping none were missed. An askd credential is checked by the relay on every connection: deny it once and it is gone estate-wide on the next connect, no restart, nothing pushed to the fleet. Credentials carry a validity window, so access nobody revokes expires anyway.
No identity provider, no SSO, no directory, no account database. A relay verifies statelessly against a public key, so nothing has to be reachable for access to work. No third party can be breached into letting someone in, and none can have an outage that locks you out. You can issue a credential on a machine that has never been online.
Every vendor claims the word, so here is a test it can fail: who can say no to you? If a party can revoke, subpoena, deprecate, price out or switch you off, you are not sovereign in that dimension. A coordination server can say no. An access proxy can. An identity provider says no by accident every time it is down. askd's answer is that no such party is in the path: you hold the authority, nobody has to approve you, you choose the jurisdiction, and you can leave whenever you like because the relay holds nothing worth staying for.
The CLOUD Act reaches data in a US company's control wherever it physically sits, and the customer is often not permitted to be told. Choosing an EU region does not fix that. Choosing an EU provider, or your own hardware, does. askd makes the switch cheap: the relay is a sub-1 MB binary with no key and no state, so standing one up elsewhere is minutes and nothing is migrated. (Repointing an existing fleet is a config change per agent today; signed relay rotation is on the roadmap to make it one signature.)
This is sovereignty over reachability, not over your stack: silicon, kernel and compiler still belong to someone else. And it is independence, not immunity. Providers are breached and served orders routinely, and a host you rent can be compelled or compromised like any other. What changes is what it could hand over, and the answer is the same either way because it is structural: nobody but you can grant access, and the relay has no readable traffic to give, only connection metadata. A SaaS control plane, compelled or breached, gives up access itself along with the audit trail.
That is not hypothetical. In 2021 attackers exploited Kaseya's remote-management product to push ransomware through roughly 60 service providers into about 1,500 downstream organisations. In 2023, session tokens lifted from Okta's support system were used against Okta's own customers, Cloudflare, 1Password and BeyondTrust among them. In both cases the product that held the access became the way in. That is not one vendor being careless: concentrating access is precisely what makes it worth attacking, and a component trusted by a thousand estates is worth more than any one of them.
askd is deliberately not a network, and that is the whole sovereignty argument. A network, an L3 mesh with assigned addresses and a control plane, is a standing asset somebody has to own, secure, and be trusted with. When that somebody is a foreign SaaS, the “network” is a liability: a control plane that can be revoked, subpoenaed, breached, or switched off, and a dependency you cannot inspect. Even self-hosted, an overlay is heavy, a CA, a coordinator, per-node certs, an address plan, tun interfaces, routing state. All of it surface to attack and state to break.
askd replaces the network with a disposable blind relay:
You get the reachability you actually wanted, without taking on a network as a liability.
The honest one-line version: only askd and OpenZiti are both in the path, so they work through hostile, egress-only networks, and blind, so they never see your traffic. The mesh VPNs (Tailscale, Nebula, WireGuard) avoid the middleman by being peer-to-peer, which is exactly why they struggle where egress is locked down. The commercial proxies (Cloudflare, Teleport) work anywhere by being the actual man-in-the-middle, terminating your traffic to read it. Of the two blind in-path overlays, askd is the sovereign, minimal one: EU-based, hardware-rooted, a sub-1 MB static binary, where OpenZiti is a US-stewarded programmable-SDN fabric.
That is the summary, and a summary is not an argument. The full comparison against Tailscale, Cloudflare Access, Teleport, WireGuard, Nebula, fwknop, OpenZiti and NetBird is a page of its own, including where each of them beats askd and when you should pick one instead.
There is no runtime, no interpreter, and no library to install: one static binary, well under 1 MB, that needs little memory, loads no kernel module, and runs as an unprivileged user, sandboxed and isolated.
That is small enough for the machines that actually need this and never get it: a Raspberry Pi, a router, a plant-floor gateway, a decade-old OT box, a VPS you pay cents for. No tun interface, no routes, no DNS, no CIDR planning, nothing that can break host networking, and nothing to clean up if you remove it.
Software like this rarely dies of bugs. It dies because a dependency stops being maintained, a vendor retires a control plane, or a build stops reproducing. Longevity is a design constraint here, which explains several otherwise odd choices.
And it can be rebuilt without us. The wire format is published byte-exact with known-answer vectors, under a licence that cannot be withdrawn. If this project stopped tomorrow your deployment keeps running, and someone else can rebuild an interoperable client from the document alone. The test is not whether the maintainer survives, but whether the artefact does.
Two of Rams' ten principles: good design is honest, and good design is long-lasting. They apply to infrastructure as well as to objects.
Working today, in author-operated use:
Not shipped. No public release, the source is not yet published, and it is not open for general use. Author-operated is not field-proven: it needs broader testing across diverse real environments and the hardening that surfaces from it. Remaining work to reach public-release grade: expanded spec and vectors, reproducible builds with an SBOM, an auditor-ready threat model, a machine-checked formal model of the knock, hardware-backed client authentication, multi-party consent gating, and distribution packaging so it installs from a package manager rather than a script.
The protocol is already public. The byte-exact specification and its known-answer vectors are published under Apache-2.0, so the design can be reviewed, criticised and independently implemented today, before the reference code opens. The vectors are generated by driving the real code paths from fixed seeds, so they cannot drift from the implementation.
How AI-assisted code is kept in check. The design, the threat model, the security review, the protocol and what must be tested are the author's. The coding is done with AI assistance under that direction: the implementation, and the test code. That split weakens the usual signals, because deciding what must be true is not the same as writing the assertion that checks it, and an assertion written next to the code it checks may simply agree with it. So the tests are themselves tested. Faults are injected one at a time, each disabling a single security property: signature verification, the replay window, capability enforcement, credential expiry, the audit chain, session resume proofs. Every one has to be caught, and a surviving mutant fails the build. Fuzz harnesses cover what an unauthenticated packet reaches, the length checks and arithmetic that necessarily run before any signature is trusted. One command reproduces all of it. The reasoning is written up in Who Tests the AI’s Tests?
The code ships under EUPL-1.2. Until then, source access for review, a walkthrough or a live demonstration is available on request.
Multipath, scoped precisely. Duplicate-send is settled practice at other layers, proven in SD-WAN and MPTCP. askd brings it to a self-hostable, blind, dial-out overlay under stock SSH, and because each packet counts from whichever copy arrives first, a session tracks whichever relay is faster, automatically, with no path selection to configure. Where the paths are close enough that jitter decides each frame, racing them lands below either one on tail latency; where one relay is clearly faster it simply wins, and you get that one. Measured both ways on a live fleet.