Free, open-source remote access & mobile workspace for Android —
SSH · Mosh · VNC · RDP · SFTP · SMB · email · cloud storage, a local Linux shell, mesh networking, and a consent-gated AI-agent endpoint

"Haven is an interesting vibe coding experiment. Let's see what comes out of it." — DBP

GitHub Releases • F-Droid

• Terminal — Mosh / Eternal Terminal / SSH with tmux-aware session restore, configurable keyboard toolbar, OSC 7/8/9/52/777 integration. Bundled Hack Nerd Font Mono renders Powerline / Devicons / Font Awesome / Material Design glyphs in shell prompts out of the box.
• Desktop — VNC (RFB 3.8 with VeNCrypt), RDP (via IronRDP, with EGFX graphics-pipeline support), a GPU-accelerated native Wayland compositor (labwc on GLES2), and a multi-distro local-desktop manager: install Alpine, Debian, Arch, or Void side-by-side and run Xfce4 / Openbox (X11) or Sway (nested Wayland, via wayvnc) desktops.
• Files — Unified browser for SFTP/SCP, SMB, 60+ cloud providers, and Reticulum mesh. Multi-select, built-in editor, image tools, chmod, cross-filesystem copy/move.
• Email — An in-app mail client: read ProtonMail (via the Proton bridge protocol) and any IMAP/SMTP mailbox (Gmail, Outlook, Fastmail, iCloud, self-hosted — username/password, app-password where 2FA requires it; no OAuth yet); compose / reply / forward, multi-account, and attachments (save-to / attach-from any browsable filesystem) over IMAP/SMTP; plus Mail Rules — inbound automation (match → mark / flag / move / delete / notify, agent- or human-authored) with a master switch, firing history, and an approval queue for destructive actions while backgrounded, managed from the Mail screen.
• Media — Transcode and stream on-device with FFmpeg 8.0; HLS streaming to the LAN; DLNA server for cloud media.
• Keys — On-device Ed25519/RSA/ECDSA generation, FIDO2/SK hardware keys (NFC + USB), deploy-key helper.
• Connections — Host-key TOFU, port forwarding (-L/-R/-D/-J), SOCKS/HTTP proxies, Tor, ProxyJump, per-app WireGuard and Tailscale tunnels (userspace, no system VPN slot — each profile can route through its own tunnel without affecting other apps), and port knocking / Single Packet Authorization — fire a TCP/UDP knock sequence, or send a native fwknop SPA packet (AES-256-CBC + HMAC-SHA256, interoperable with fwknopd), at the remote firewall before the real connect, with per-profile fields and in-dialog "Test knock" / "Test SPA" buttons.
• Local shell — a Linux userland via PRoot (no root, any Android 8+ device): Alpine, Debian, Arch, or Void, each with its native package manager, side-by-side.
• USB to the guest — broker an attached USB/OTG device through Android and re-expose it, no root: as MCP tools for the agent (enumerate + raw control/bulk transfers), or — with a Settings opt-in — into the Linux guest as a /dev/hidraw* node that unmodified native (LD_PRELOAD) and Mono/.NET HidSharp (DllMap) apps can use. HID-focused today.
• Reticulum — rnsh shell, file transfer (browse/download/upload), and -L/-D port forwarding over Reticulum mesh networks, pure Kotlin. The one transport that keeps working with no internet at all.
• Security — Biometric lock, no telemetry, encrypted backup/restore (AES-256-GCM).
• Agent transport (MCP) — Optional MCP server exposes Haven's read and write surfaces as ~130 tools, so an AI agent drives the same primitives you tap — and you watch every action in the same UI. The agent can even see and operate Haven itself — capture_haven_ui screenshots the app's own screen (also the ui://haven/screen resource) and tap_haven_ui / swipe_haven_ui drive it — closing a self-hosted build → install → verify loop with no human hand on the device. Reads are free; writes prompt for consent and are audited, with optional scoped, rate-capped, expiring standing policies for hands-off workflows (revocable from the Agent activity screen). Reached over the device's WireGuard/LAN address or a one-tap SSH reverse-forward; disabled by default, under Settings → Agent endpoint.

See docs/FEATURES.md for the full, detailed feature list.

Available in 12 languages: English, Chinese (simplified), Spanish, Hindi, Arabic (with RTL support), Portuguese, Bengali, Russian, Japanese, Korean, French, and German. The UI follows the device language. Community translation contributions welcome.

Both builds are identical — SSH, Mosh, Eternal Terminal, VNC, RDP, SFTP, SMB, email, and cloud storage. IronRDP (Rust) is built from source via cargo-ndk. rclone (Go) is built from source via gomobile.

Requires Rust with Android targets, cargo-ndk, Go 1.26+, and gomobile:

# Rust (for RDP)
rustup target add aarch64-linux-android x86_64-linux-android
cargo install cargo-ndk

# Go (for rclone cloud storage)
go install golang.org/x/mobile/cmd/gomobile@latest
go install golang.org/x/mobile/cmd/gobind@latest

git clone --recurse-submodules https://github.com/GlassHaven/Haven.git
cd Haven
./gradlew assembleDebug

Output: app/build/outputs/apk/debug/haven-*-debug.apk

• Features — detailed feature descriptions.
• Backup file format — wire format, the PBKDF2/AES-GCM envelope, and a Python recipe for manual decryption if the in-app importer fails.
• Release process — versioning, tagging, and F-Droid steps.
• Privacy policy.
• Roadmap and Vision.

Haven sits on top of the projects listed in the table above — the heavy lifting was done long before this repo existed.

Most of the direction Haven has taken has come from the user base, not from a roadmap: bug reports, screenshots of edge cases, "have you tried…" comments on long issue threads. Claude Code Opus writes most of the actual code; the maintainer's role is closer to that of a messenger between the user group and the model — listening, setting the agenda, and quality-checking.

A small recurring amount comes in via Ko-fi and Liberapay. It helps offset the Anthropic bills for the Claude Code usage above, and it's a clear signal that the work is useful to people. The project continues regardless of donations.

AGPLv3