RelayBar is a tiny native macOS menu-bar app for local SSH port forwards. It has no external dependencies and runs macOS's built-in /usr/bin/ssh directly.

Download the latest release

• Imports common commands such as ssh -N -L 8080:localhost:3000 user@host
• Adds tunnels manually with five small fields
• Starts and stops each tunnel with one click
• Starts a tunnel and opens its local URL in the default browser with one click
• Retries unexpected disconnects up to 10 times with exponential backoff
• Shows startup failures directly beside the tunnel
• Stores tunnel definitions in local UserDefaults
• Stops child SSH processes when RelayBar quits

RelayBar intentionally manages one local (-L) forward per item. Safe connection options such as -p, -J, -i, and a restricted set of -o values are preserved when importing a command. Options that can execute local commands, select arbitrary configuration files, or write logs are rejected. RelayBar never invokes a shell.

RelayBar is distributed outside the Mac App Store and is intentionally not sandboxed. Its SSH process behaves like the command-line client: it reads the user's normal ~/.ssh/config and known_hosts, can use configured identity files, and inherits access to the user's SSH agent. SSH still runs non-interactively, so password prompts are not supported. On recent macOS versions, the first connection to a .local or LAN host may ask for Local Network access.

The concise architecture and behavior archive starts at docs/system-specs.

Requires macOS 13 or newer and the Xcode command-line tools.

./scripts/build-app.sh
open .build/RelayBar.app

The packaged app is written to .build/RelayBar.app. The build script automatically finds the first valid Developer ID Application certificate in the login keychain and signs with the hardened runtime.

To create a signed ZIP:

./scripts/package-release.sh

This writes .build/RelayBar.zip. A Developer ID signature identifies the publisher, but a downloaded app should also be notarized to pass Gatekeeper without warnings. After storing one notarytool keychain profile, notarize and staple with:

xcrun notarytool store-credentials relaybar-notary \
  --apple-id YOUR_APPLE_ID \
  --team-id YOUR_TEAM_ID \
  --password YOUR_APP_SPECIFIC_PASSWORD

NOTARY_PROFILE=relaybar-notary ./scripts/notarize-release.sh

Set SIGNING_IDENTITY only when a Mac has multiple Developer ID certificates and the automatic choice is not the one you want.