Haven

Free, open-source remote access & mobile workspace for Android —
SSH · Mosh · VNC · RDP · SFTP · SMB · email · cloud storage, a local Linux shell, mesh networking, and a consent-gated AI-agent endpoint

"Haven is an interesting vibe coding experiment. Let's see what comes out of it." — DBP

GitHub Releases • F-Droid

_{▶ Watch: the terminal — and every Haven screen — made translucent over the device wallpaper (new in 5.60.4). Live wallpaper: MagicFluids.}

---

         

---

At a glance

• Terminal — Mosh / Eternal Terminal / SSH, tmux-aware session restore, configurable keyboard toolbar, OSC 7/8/9/52/133/777 integration.
• Desktops — VNC (RFB 3.8 / VeNCrypt), RDP (IronRDP + EGFX), a GPU-accelerated native Wayland compositor, and a multi-distro local-desktop manager.
• Files & cloud — unified browser for SFTP/SCP, SMB, and 60+ cloud providers; cross-filesystem copy/move, editor and image tools; plus on-device FFmpeg transcode, HLS streaming, and DLNA.
• Connections — port forwarding (-L/-R/-D/-J), SOCKS/HTTP/Tor proxies, per-app WireGuard & Tailscale tunnels, port knocking and fwknop SPA, and SSH keys (incl. FIDO2/SK).
• Email — ProtonMail (bridge protocol) and any IMAP/SMTP mailbox; compose / reply / forward, multi-account, attachments; plus Mail Rules inbound automation.
• AI chat — chat with self-hosted or API models (OpenAI-compatible, Ollama, Anthropic, Gemini) over per-profile tunnel routing; image attach for vision models, clipboard copy/paste both ways, opt-in encrypted saved transcripts.
• Local Linux — a Linux userland via PRoot (no root, any Android 8+ device): Alpine, Debian, Arch, or Void, side-by-side.
• USB forwarding — broker an attached USB device through Android and re-expose it to the agent, into the Linux guest, or over USB/IP to a remote host (e.g. a phone-hosted YubiKey, touch on the phone).
• Reticulum — rnsh shell, file transfer, and -L/-D port forwarding over Reticulum mesh, pure Kotlin. The one transport that keeps working with no internet at all.
• Agent transport (MCP) — an optional MCP server exposing ~130 consent-gated, audited tools; the agent can even see and operate Haven itself for a self-hosting build → install → verify loop.
• Security — biometric lock, no telemetry, encrypted backup/restore (AES-256-GCM).

See docs/FEATURES.md for the full feature index.

Why one app

The list above is the parts; the point is how they compose. Each of these is one flow inside Haven — no second app, no curl | ssh incantation:

• Tap a 4K MKV in Google Drive → FFmpeg transcodes it over HTTP and the result lands back in the same Drive folder, never touching local disk.
• SSH to a box, forward its port, tap the VNC profile that targets localhost — the desktop opens in the same app, keyboard and clipboard shared.
• Cut a log directory from an S3 bucket, switch tabs, paste it onto an SFTP server — rclone does the server-side copy when it can, otherwise Haven streams it through.
• Run your agent CLI in the on-device Linux shell; it pushes over the SSH agent you forwarded from your laptop while you watch on the same screen.
• Cast a cloud video to the TV across the room over HLS, copy the LAN URL from the snackbar, send it to a friend so they can watch too.

The phone is the thin client, Haven is the thin-client OS, and the cloud, your servers, and your agents are the computer. Width is sufficient; composition is the point. (Vision.)

Languages

Available in 12 languages: English, Chinese (simplified), Spanish, Hindi, Arabic (with RTL support), Portuguese, Bengali, Russian, Japanese, Korean, French, and German. The UI follows the device language.

Want to help translate? Improve a translation or add a new language straight from the web translation page — no cloning or setup; your changes become a GitHub pull request. See Languages & translation for details.

Install

Both builds have the same features — SSH, Mosh, Eternal Terminal, VNC, RDP, SFTP, SMB, email, and cloud storage. IronRDP (Rust) is built from source via cargo-ndk. rclone (Go) is built from source via gomobile.

Pick one channel and stay on it. The two channels are signed with different keys — GitHub Releases use Haven's own release key; F-Droid builds from source and signs with F-Droid's per-app key. Android treats different signing keys as different apps, so you can't update in place from one channel to the other — switching means uninstall + reinstall, which clears app data (back up first via Settings → Backup). Direct sideloads and Obtainium track the GitHub Releases key.

Signing certificate SHA-256 (to verify a sideloaded APK with apksigner verify --print-certs):

• GitHub Releases: ea03a3a70e1c11d0a78932f959b21f20d8735d9cd750997657cb7f7d7c2b90b3
• F-Droid: ea05a89431961b8ac53c36725452673c2be1c2d7b6e48771617b974e6092b332

Build from source

Requires Rust with Android targets, cargo-ndk, Go 1.26+, and gomobile:

# Rust (for RDP)
rustup target add aarch64-linux-android x86_64-linux-android
cargo install cargo-ndk

# Go (for rclone cloud storage)
go install golang.org/x/mobile/cmd/gomobile@latest
go install golang.org/x/mobile/cmd/gobind@latest

git clone --recurse-submodules https://github.com/GlassHaven/Haven.git
cd Haven
./gradlew assembleDebug

Output: app/build/outputs/apk/debug/haven-*-debug.apk

Documentation

• Features — detailed feature descriptions.
• Backup file format — wire format, the PBKDF2/AES-GCM envelope, and a Python recipe for manual decryption if the in-app importer fails.
• Maintainer Protocol — the /maintain skill driving Haven's maintenance loop (CI triage, release readiness, issue response, and dependency tracking) run by Qwen3.8-Flash running locally via llama-claude, with daily security audit passes performed by GLM5.3-flash.
• Release process — versioning, tagging, and F-Droid steps.
• Privacy policy.
• Vision.

Third-party libraries

Backing

Haven sits on top of the projects listed in the table above — the heavy lifting was done long before this repo existed.

Most of the direction Haven has taken has come from the user base, not from a roadmap: bug reports, screenshots of edge cases, "have you tried…” comments on long issue threads. Qwen3.8-Flash running locally writes most of the actual code; the maintainer's role is closer to that of a messenger between the user group and the model: listening, setting the agenda, and quality-checking.

A small recurring amount comes in via Ko-fi and Liberapay. It helps offset the electricity costs of running the work above, and it's a clear signal that the work is useful to people. The project continues regardless of donations.

License

AGPLv3