shellhub

ShellHub v0.25.0 finishes two long-running migrations and opens the door to AI tooling. The backend now runs on a single Postgres datastore, the console is React-only, and there is a built-in MCP server so assistants like Claude Code and Cursor can drive ShellHub directly.

Postgres is now the only datastore

The MongoDB store has been removed and Postgres is the sole storage implementation (#6429). This is the end of the migration started in earlier releases: less surface area, one query layer, one set of migrations to reason about.

Upgrading from a MongoDB-backed install? Complete the Mongo to Postgres migration before moving to v0.25.0. There is no in-place path back once you are on a Mongo-less build. Check /api/migration/status and follow the migration guide first.

One console, built on React

The deprecated Vue frontend is gone (#6401) and the React frontend has been promoted from ui-react to ui as the only served console (#6423). Everything now ships from a single, actively developed UI.

Manage ShellHub from your AI assistant

ShellHub now embeds an MCP (Model Context Protocol) server inside the api service (#6266). AI assistants (Claude Code, Claude Desktop, Cursor) can list and manage devices, sessions and namespaces without any extra binary or sidecar.

It authenticates with a namespace API key sent as X-API-Key, validated through the same nginx auth_request path as the REST API. Tools run through the API middleware in-process, so authorization is enforced by exactly the same layer that guards /api (#6400).

{
  "mcpServers": {
    "shellhub": {
      "url": "https://<shellhub-host>/mcp",
      "headers": { "X-API-Key": "<your-api-key>" }
    }
  }
}

Device custom fields

Attach arbitrary metadata to devices and manage it through per-key endpoints (#6248, #6286).

Valkey replaces Redis

The cache and pubsub backend moved from Redis to Valkey, a drop-in Redis fork (#6402). If you point ShellHub at an external Redis, switch it to Valkey.

Also in this release

Features

• Namespace device auto-accept setting (#6264)
• Billing & subscription management in the console (#6232)
• Chatwoot live-chat support widget (#6249) and user-facing announcement modal (#6265)
• Cloud free-tier device chooser (#6279)
• Web endpoints: tls.domain as Host override even without TLS (#6321), and a Domain without enabling TLS (#6323)
• Customer-facing API documentation build (#6392)

Fixes

• Block API keys on account-level routes (#6397) and return clean 404s for malformed tenant/namespace IDs (#6405, #6408)
• Public key tag sync (#6340), percent-encoded fingerprint paths (#6336), and search across all pages (#6384)
• Restore TLS-to-backend in the web endpoint proxy (#6320)
• CLI: fatal on config parse error (#6326), namespace inspect device counts (#6325) and member list (#6324)
• Console: validate add-member email (#6315); UTF-8 base64 list filters (#6388); Setup, Sign In, app bar and namespace selector polish (#6344, #6343, #6403, #6399)

Performance

• Scope session event aggregation to the listed page (#6433)

Enterprise

• Enterprise-only license banner in the console (#6342)
• Use the api-enterprise image in the enterprise compose (#6291) and pass web endpoint envs to it (#6394)
• Map SHELLHUB_-prefixed SAML env vars on the api service (#6410)

Under the hood

• Reusable agent core extracted into the importable agentd package (#6431)
• docker-compose wrapper rework with profiles and bats tests (#6337, #6339, #6348)
• Shared-component and OpenAPI refactors across the UI
• Dependency updates across all services (Go 1.25.11, Alpine, nginx, assorted Go/npm modules) via Dependabot

New Contributors

• @danielgatis made their first contribution in #6248
• @kekius-maximus45 made their first contribution in #6315

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.24.2...v0.25.0