Identity-aware access to SSH, databases, Kubernetes, message brokers and internal apps.
Open source, written in Rust, and run on your own infrastructure.
 Nothing long-lived Each session gets a certificate that expires in an hour, or sooner if you choose. CI jobs sign in with their own OIDC token, so no person or pipeline keeps a key or a password. |
 An audit you can verify Every session is recorded or audited into signed, hash-chained batches. One command proves nothing was edited, reordered or removed. If audit can't be written, new sessions are refused. |
 No inbound ports Workers run next to your targets and dial out. Your servers and databases stay private, and only the worker ever holds their credentials. |
$ limen login # a browser opens on your identity provider
$ limen ls
NAME KIND ACCESS AS LABELS
orders-staging ● postgres limen_read, limen_write env=staging team=payments
web-staging-1 ● ssh ec2-user, ubuntu env=staging
$ limen ssh web-staging-1 # a recorded session, with a one-hour certificate
$ limen db connect orders-staging # psql through Limen, no password to copy
$ limen explain orders-prod # which rule stops me?
$ limen request orders-prod --for 30m --reason "INC-123"flowchart LR
people["👤 Engineers<br>🤖 CI jobs"]
proxy["Limen proxy"]
subgraph private["Your private network"]
worker["Limen worker"]
targets[("Your servers<br>and databases")]
end
cp["Limen control plane"]
idp["Your identity provider"]
s3[("Audit in S3<br>signed · chained")]
people ==>|"ssh, psql, kubectl"| proxy
proxy <==>|"tunnel opened<br>from inside"| worker
worker ==> targets
idp -.->|"who you are"| cp
cp -.->|"policy and<br>certificates"| proxy
cp -.->|"audit"| s3
Nothing inside your network opens a port: the worker connects out to the proxy, and only the worker holds target credentials.
SSH · PostgreSQL · MySQL · Redis and Valkey · Kubernetes · MongoDB · OpenSearch · Elasticsearch · RabbitMQ · Kafka · internal web apps · anything else over TCP
Works with your own servers and with the AWS managed services (RDS, Aurora, ElastiCache, EKS, MSK, Amazon MQ)
| Repository | What it is |
|---|---|
| limen | The control plane, proxy, worker and limen CLI, the web console, and the docs |
| terraform-provider-limen | Manage resources, roles and bots from Terraform or OpenTofu, through the management API |
| homebrew-tap | brew install limen-dev/tap/limen |
Important
Limen is pre-release. There is no tagged release yet. Everything is tested end to end, but against local stand-ins: Dex in place of a real identity provider, databases and brokers in containers, a local S3. Nothing has been verified against real AWS, Okta or Datadog. Evaluate it; don't put it in front of production systems yet.
Limen is Latin for threshold: the line you cross to get in.
Found a security problem? Please report it privately.