Native macOS | Menu bar + CLI

Many APIs.
One local endpoint.

“If there are several ways of doing the same thing, choose one.”
RFC 1958, Architectural Principles of the Internet (1996)

Bring private remote APIs to your Mac, combine them with commercial HTTPS models, then reverse-forward the local Unified API to tools running on a remote server.

Get the source Explore the workflows

macOS 14 or later | Built on the system OpenSSH | MIT licensed

Three core workflows

Move APIs across the SSH boundary in either direction.

Use each workflow independently, or combine all three so local and remote tools share the same selected models and stable aliases.

ssh -L | Remote to local

Bring a remote API to your Mac

Turn a private vLLM, SGLang, Ollama, or other remote service into a stable Mac loopback endpoint. ModelMoor manages the SSH process, recovery, API health, and model discovery.

Remote 127.0.0.1:8888
          |
          | SSH -L
          v
Mac    127.0.0.1:18888

Unified API | Local aggregation

Combine remote and commercial models locally

Collect selected SSH-hosted and direct HTTPS models behind one authenticated URL. Stable public model names route to exact upstream models with the correct Keychain credential.

SSH endpoints ---+
                 +--> 127.0.0.1:17777/v1
HTTPS providers -+

ssh -R | Local to remote

Make the Unified API available on a remote server

Carry the Mac's local Unified API back through SSH for remote development and compute tools. Both listeners stay on loopback, so the API is not exposed to the remote LAN or public internet.

Mac    127.0.0.1:17777
          |
          | SSH -R
          v
Remote 127.0.0.1:17777

Reverse-forward the Unified API

Run this on the Mac, then point a client on my-ssh-host to http://127.0.0.1:17777/v1 with an enabled ModelMoor Unified API key.

modelmoor add remote-unified-api my-ssh-host \
  --direction remote \
  --listen-port 17777 \
  --destination-port 17777

Features

Many sources, one client configuration.

Keep SSH forwarding as transport, store each commercial key separately in Keychain, and route every selected model through 127.0.0.1:17777/v1.

SSH config discovery

Finds targets from ~/.ssh/config and its recursive Include files.

Local & remote ports

Forward in either direction: -L to reach a remote API, or -R to expose a local one.

Auto-reconnecting

One resilient SSH process per Mooring keeps every mapping alive and re-establishes on drop.

Independent endpoints

Inspect tunneled APIs, direct HTTPS providers such as DeepSeek, and Ollama without coupling API health to SSH state.

Local Gateway

Expose stable model aliases through one authenticated OpenAI-compatible URL, including transparent SSE streaming.

Keychain-safe

API tokens are stored only in the current user's macOS Keychain, never in plain config.

How it works

From many endpoints to one local API.

1
Add endpoints in the appUse the GUI to add an SSH mapping or a direct HTTPS provider. The CLI remains available for automation.
2
Discover modelsInspect each API independently and choose the models you want to expose.
3
Create aliasesMap stable public model names to exact upstream models without fallback or retries.
4
Connect your clientUse http://127.0.0.1:17777/v1 and an enabled Unified API key, or explicitly turn authentication off.

GUI

+--------------------------------------+
| ModelMoor                       [--] |
+-------------+------------------------+
| Overview    | Endpoints              |
| Endpoints > |                        |
| Unified API |  + Add Endpoint        |
| Usage       |                        |
| Settings    |  SSH        HTTPS      |
|             |  host       provider   |
|             |  port       API key    |
|             |                        |
|             |  [Inspect Models]      |
|             |  [Add to Unified API]  |
+-------------+------------------------+

CLI

# Create a default -L mapping
modelmoor init localhost \
  --name dgx-spark \
  --direction local \
  --listen-port 18888 \
  --destination-port 8888 \
  --probe-path /v1/models

# Copy the unified client settings
modelmoor gateway url
modelmoor gateway token --copy

Security boundaries

Deliberately conservative.

ModelMoor leans on the system OpenSSH and keeps the attack surface small by design.

Passwords, keys, ProxyJump, and the agent are handled by the system OpenSSH.
BatchMode=yes stops background connections from prompting for a password.
Listener addresses only accept 127.0.0.1 or localhost.
-R 0.0.0.0:... and GatewayPorts are not supported, to avoid exposing local services.
Endpoint credentials and all Unified API key values live only in the current user's macOS Keychain.
The Unified API binds only loopback. Multi-key bearer authentication is on by default, can be disabled explicitly, and client credentials are stripped before routing.

Requirements

What you need.

macOS 14 or later Xcode 26 / Swift 6.1+ (to build) System OpenSSH client

Ready to moor?

Clone the repo, build the app, and start mapping ports in minutes.

View on GitHub Development docs DGX Spark -> Copilot guide

Many APIs.One local endpoint.