Docs

Installation

Dendrite ships as a single binary for macOS, Linux, and Windows. Current release: v0.15.0-alpha.

Quick install (all platforms)

curl -fsSL https://dendrite.sh/install.sh | sh

macOS (Homebrew)

brew install kazlabs/tap/dendrite

Windows (winget)

winget install KazLabs.Dendrite

Air-gapped environments can install from an offline package provided by your workspace administrator - see Self-hosted & air-gap deployment.

Note: Dendrite is in active development. Features and commands may change between releases; breaking changes are called out in the release notes.

Quickstart

From install to your first shared session in about a minute.

1. Sign in

Authenticate against your workspace directory. Your identity and display name come from the directory - there is no separate Dendrite account to manage.

$ dendrite login

2. Host a session

Start a session on one of your registered hosts. You'll be prompted to pick a host if you don't specify one.

$ dendrite host --host build-server-01

3. Share the session

Invite teammates from the session, or share the session reference. Every join is authenticated against your directory - and, depending on your plan, subject to just-in-time approval and recorded in the audit log.

Tip: You can also host sessions from the app: New Session → pick a host → Host.

Hosting & joining sessions

Every session runs on a host - a machine registered to your workspace. The shell, files, and environment all belong to that host; the coordination layer never executes commands on your behalf.

  • Host picker - choose from hosts registered to your workspace when creating a session.
  • Session dashboard - active and recent sessions on the home screen; click to rejoin.
  • Chat - every session has an integrated chat panel visible to all participants.
  • Latency panel - per-hop network latency, so participants can distinguish connection issues from performance issues.
  • Leaving - closing your client detaches you; the session keeps running on the host until the host ends it.

View-only mode

View-only mode locks a session so that only the host can type; everyone else observes. Use it for demos, training, incident walkthroughs, and compliance-supervised access to production.

Toggle it in Session → Terminal Settings → View only. The restriction is applied on the server immediately - already-attached clients lose input capability at once, with no reconnection. This is a server-side control, not a client courtesy.

$ dendrite session set --view-only on

Terminal settings

Open Terminal Settings from any session to customize:

  • Name - your display name, pulled from the workspace directory.
  • Color palette - theme for terminal text; ships with popular palettes including VS Code Dark. Per-user, and never affects other participants.
  • Scrollback - lines of previous output retained in the window (default 5000).
  • View only - the server-enforced view-only lock described above.

LDAP / SSO integration

Professional and Enterprise plans authenticate users against your existing directory - LDAP, or your SSO provider. There is no parallel user database to secure.

  • Identity, display names, and group membership flow from your directory.
  • Disable or remove a user in the directory and their Dendrite access ends with it.
  • Enterprise adds SCIM for automated provisioning and de-provisioning.
  • Host registration and host-group visibility can follow directory groups.

Just-in-time approvals

Access in Dendrite is granted for the session that needs it - not permanently.

  • Session hosts approve or deny collaborator join requests on demand.
  • Approvers can grant observe-only access, keeping production input restricted to the host.
  • Every approval decision is captured in the audit log (see below).

Audit logging

Dendrite records administrative and session events server-side:

  • Session creation, termination, and host attribution
  • Collaborator joins, approvals, and denials
  • View-only mode changes
  • Sign-in events and directory authentication outcomes

Professional plans can export audit logs; Enterprise supports custom retention policies and integration with your existing log pipeline - the evidence trail your compliance processes expect.

$ dendrite audit export --from 2026-09-01 --to 2026-09-30 --format json

Self-hosted & air-gap deployment

Enterprise deployments run entirely on your infrastructure:

  • Self-hosted - deploy the coordination service in your VPC or on bare metal; clients connect over your network.
  • Air-gap capable - no outbound dependency on KazLabs services is required at runtime; offline installer packages are available.
  • Telco / CII readiness - directory-based authentication, least-privilege session controls, and audit logging are designed for regulated operators.

Contact sales@dendrite.sh to scope a deployment.

Security architecture

Dendrite is built around a simple rule: share a shell, not your secrets.

  • Authenticated access - joining a session requires directory sign-in; no anonymous participants.
  • Encrypted transport - session traffic is encrypted between clients and the host.
  • Host-side execution - commands run only on the host you chose; the coordination layer never executes commands on your behalf.
  • Server-side enforcement - view-only and approval controls are enforced on the server, not by client behavior.
  • Just-in-time access - approvals are per-session, avoiding standing access grants.

Report security issues to security@dendrite.sh.

Troubleshooting

I can't see any hosts in the picker

Confirm you're signed in to the correct workspace (dendrite login) and that your administrator has registered the host you expect. On directory-backed plans, host visibility may follow group membership.

My terminal colors look wrong

Open Terminal Settings and pick a palette. Palettes are per-user and don't affect other participants.

A collaborator can still type during view-only

View-only is enforced server-side. Verify the toggle applied (dendrite session set --view-only on) and that all clients run v0.15.0 or later.

LDAP sign-in fails

Confirm your bind credentials with your workspace administrator and that your user object is in a group mapped for Dendrite access. The failure reason appears in the audit log.

FAQ

Do collaborators need to install anything?
Yes - the Dendrite client. Nothing is configured on the host machine beyond sign-in.

What's in the free Community edition?
Up to 5 hosts and 5 users, live shared sessions, chat, and view-only mode - free forever. See pricing.

Can we self-host?
Yes - self-hosted and air-gap-capable deployment is part of the Enterprise tier: sales@dendrite.sh.