Vscode Mosh
You cannot run a native vscode mosh link inside the standard remote extension. Instead, you open a separate Mosh shell alongside a standard SSH editor link. Teams often try this setup to fix dropped links on slow networks. Engineers want fast typing in the shell while they edit files on a server. To make this work, admins often hand out broad SSH keys to the team. Those wide permissions let anyone run any command once they log in. How a vscode mosh workflow operates in practice The code edit
Mosh: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You cannot run a native vscode mosh link inside the standard remote extension. Instead, you open a separate Mosh shell alongside a standard SSH editor link.
Teams often try this setup to fix dropped links on slow networks. Engineers want fast typing in the shell while they edit files on a server. To make this work, admins often hand out broad SSH keys to the team. Those wide permissions let anyone run any command once they log in.
How a vscode mosh workflow operates in practice
The code editor needs a steady TCP stream to run its remote server binary. That remote binary handles file edits, code checks, and extensions over SSH. Mosh does not use a steady TCP stream after the first login step.
Mosh starts over SSH to check your key and start a server process. Then it switches to UDP to sync screen states back and forth. Because Mosh only syncs visible text, it cannot carry the editor data stream.
To use both tools, developers run them side by side on their machines. They link the code editor over normal SSH for file tree updates. Then they open a local terminal app to run a Mosh session. This gives them fast shell typing even when Wi-Fi drops for a minute. If the network changes, Mosh keeps the shell alive without losing work.
Network rules and permission gaps in remote shells
Running Mosh requires extra firewall rules on every single remote server. Admins must open wide UDP port ranges to the public network or VPN. Opening UDP ports adds more network paths for the security team to watch. Standard SSH bastions also struggle to forward UDP packets to inner hosts.
Mosh: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Beyond network rules, the setup leaves a big gap in access control. SSH keys and OS user roles only check who can log in. Once the session starts, the OS grants full shell rights to that user. A developer with server access can read secret files or drop local tables.
Native SSH and Mosh setups do not check individual commands in flight. If a script or user queries user data, raw records appear right on screen. Emails, phone numbers, and card numbers show up in plain text in the terminal. Admins also lack a clear log of what commands ran inside UDP states. Because Mosh only sends screen diffs, network tools cannot read the command stream. Teams need a better way to control commands and protect sensitive data.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Can the remote SSH extension use UDP through Mosh?
No, the remote editor server needs a reliable byte stream to transfer files. Mosh only syncs terminal screen states over UDP and drops older frames.
Why do teams still use Mosh with their code editor?
Developers use the editor over SSH to browse and save code files. They use a separate Mosh window for fast typing on high latency links.
What firewall changes does Mosh need on a remote host?
You must allow inbound SSH on TCP to start the login process. You must also open a range of UDP ports for the state sync.