ShellYard vs Hudu

Documentation isn't enough.
You need to connect, run, and prove it.

Hudu nails MSP documentation. ShellYard adds the actual workspace your technicians live in — SSH, HTTP, DB queries, 40+ network diagnostics, vault, audit, AI — and scopes docs per client Space. Hudu importer included.

Download free for macOS, Windows, Linux

Free forever · Hudu importer included · Per-Space KMS on Team+

ShellYard · MSP Workspace

Active Space: Acme Corp 3 of 18 clients

docs / runbooks / firewall-cert-rotation.md edited 2d ago

## Acme firewall — quarterly cert rotation
# Owner: NetOps · Cadence: 90d · Next: 2026-08-12

1. SSH to acme-fw-01 (vault → fw-admin)
2. Export CSR — `request security pki ...`
3. Hand CSR to CA, retrieve signed PEM
4. Install: `set security pki ca-certificate ...`

SSH · netadmin@acme-fw-01 connected · 00:14:32

netadmin@acme-fw-01> show clock
14:22:08.041 UTC Mon Jun 01 2026
netadmin@acme-fw-01> _

vault · Acme Corp · 2 entries CMK: acme-cmk-prod

acme-fw-01 · fw-admin ••••••••••

acme-postgres-prod · pg_readonly ••••••••••

Quick decision

Which side of the table are you on?

Stay on Hudu if

A documentation portal is enough.

Documentation is 100% of what you need from this tool.
Your techs are happy switching to Termius / Postman / DBeaver / etc. for everything else.
You only manage one or two clients — per-tenant isolation isn't a daily concern.
Mobile-web access from a phone is part of the job.

Switch (or supplement) with ShellYard if

Your techs live in a terminal, not a wiki.

You want connections and docs living in the same app, scoped to the same client.
You manage 5+ clients and you want per-client crypto + audit, not just per-client folders.
You're tired of asking techs to alt-tab between Hudu, their terminal, an HTTP client, and a DB GUI.
You want an AI assistant grounded in the actual tool output — not a wiki.

Side by side

What each tool actually ships.

Capability	Hudu	ShellYard
Documentation (notes / runbooks)	Strong — asset types, custom fields, related items	Markdown + Tiptap WYSIWYG, version history, PDF export (Team+)
IPAM (subnets + hosts)	Yes	Yes, with Subnet Calculator + Nmap writeback (Team+)
Per-client / per-tenant separation	Companies	Spaces — audit-scoped, RBAC-scoped, KMS-scoped
Public document share links	Yes	Yes — password-gated, expiry, revocable (Team+)
Credential / password storage	Built-in password manager	Local AES-256-GCM vault on Free; KMS-wrapped cloud vault on Pro+
Self-host option	Yes	No — managed cloud sync only
Mobile / phone access	Web app works on mobile	Desktop-only (macOS / Windows / Linux)
Integrated SSH / Telnet / serial	—	In-app, jump-host chains, vault auto-fill
RDP + VNC inside the app	—	Native RDP launcher + in-app noVNC (no extra client)
AWS SSM Session Manager	—	Built-in, auto-installs the session plugin
40+ network diagnostic tools	—	DNS, MTR, packet capture, TLS inspector, MAC tracker, PoE budget, AP scanner, Nmap, AAA tester, …
Multi-engine DB inspector	—	Postgres / MySQL / SQL Server / Redis / MongoDB / SQLite + live Health dashboards
HTTP / GraphQL / Realtime client	—	Postman v2.1 import, SSH-tunneled requests, collection runner (Pro+)
Per-Space CMK (customer-managed KMS key)	Org-wide encryption	Each Shared Space gets its own AWS KMS key (Team and Enterprise)
Per-Space audit log + CSV export	Activity log	Every credential read, doc edit, command, query, request (Team+ exports CSV)
AI assistant grounded in tool output	—	Magellan — BYO Anthropic / OpenAI / Gemini / Ollama key
Native desktop app	Web app	macOS / Windows / Linux, code-signed + notarized
Hudu importer	—	Documents + IPAM into the matching Space, preserves structure

Accent-tinted rows = ShellYard adds capabilities Hudu doesn’t cover. Red-tinted rows = Hudu wins or ShellYard doesn’t play.

Where Hudu still wins

The places we don’t pretend to compete.

We’d rather you find this out from us than discover it three weeks in. Hudu is the better tool for these jobs today:

Pure-documentation depth — asset types, custom fields, related-items graph is more mature than ours.
Established MSP industry presence, tight community, and clear "alternative to IT Glue / Kaseya" positioning.
Mobile-web access from a phone — ShellYard is desktop-only by design, so if a tech needs the runbook from their car, Hudu wins.
"Quick Jump" / global search across every doc and asset in every client has years of polish on it.
Self-hostable. If your data has to live on your iron, Hudu does that today and we don't.

Switching (or supplementing) path

You don’t have to migrate to try ShellYard.

1

Install ShellYard. Create a Space per client.

Free works for the first tech evaluating it. When you want Shared Spaces (one per client), Team tier covers up to 25.
2

Run the Hudu importer.

Settings → Imports → Hudu. Documents and IPAM (subnets + hosts) come into the matching client Space. Structure preserved.
3

Add the SSH / RDP / VNC connections inside each Space. Credentials go in the vault.

Connections live next to the docs they explain. Credentials are AES-256-GCM locally, KMS-wrapped in the cloud, wrapped under that Space’s own CMK on Team and Enterprise.
4

Run both during transition. Cut over Hudu when you’re ready.

Plenty of MSPs leave Hudu running for the client-portal surface and use ShellYard for the technician workspace. Hybrid is a real option — not a half-measure.

Before you decide

What MSPs ask first.

The Hudu importer — what does it actually bring across?

Documents (notes and runbooks, with structure) and IPAM (subnets + hosts) into the matching ShellYard Space. Custom asset types with unusual field schemas may need a manual pass — open a support thread and we’ll look at the export. The importer is non-destructive: your Hudu instance is untouched.

Can I keep Hudu and use ShellYard just for the connections / terminal / diagnostics side?

Yes — that's the most common motion. Many MSPs leave Hudu as the client-facing documentation portal (especially if you've built it out with PSA / RMM integrations) and use ShellYard as the technician workspace where the actual hands-on work happens. The Hudu importer means you don't have to re-key the bits you do want in ShellYard.

Vault parity with Hudu’s password manager?

Yes for the basics — user/pass, bearer tokens, API keys, SSH keys, per-credential metadata, tag and search, auto-fill into connections. Beyond that: every cloud-synced credential is envelope-encrypted with AWS KMS, and on Team and Enterprise every Shared Space wraps its credentials under its own customer-managed KMS key. Per-group sharing (Phase C) narrows a credential to a sub-group inside a Space.

What does "per-client crypto" actually mean?

Every Shared Space on Team and Enterprise gets its own AWS KMS customer-managed key. Documents, credentials, and synced resources for that client wrap under that key. When you offboard the client, we call kms:ScheduleKeyDeletion on their key — the ciphertext we still hold becomes unreadable. That's cryptographic erasure, not 'we promise we deleted the row.'

Native desktop vs Hudu’s web app — why?

Because the work happens in a terminal, an RDP window, a VNC client, a packet-capture, a SQL editor. Browsers fight you on all of that. ShellYard ships as a native desktop app on macOS (signed + notarized), Windows (Authenticode via Azure Trusted Signing), and Linux (.deb / .rpm / AppImage).

Mobile access — anything?

No. ShellYard is desktop-only, deliberately. If pulling up the runbook from a phone in the field is part of how your techs operate, keep Hudu for that surface and use ShellYard at the workstation. We don't think a phone is the right place to SSH into a customer firewall.

Open a Space for your next client.
See how it feels.

Install. Create a Space named after one client. Run the Hudu importer. Open an SSH session inside that Space. If it doesn’t feel like the workspace your techs have been asking for — uninstall. No account required to try it.