HashiCorp Boundary alternatives after the Community Edition archive

HashiCorp archived Boundary Community Edition on October 8, 2026, and plans no further releases or security patches for it. Your choices are to pay for HCP Boundary, move to another access proxy such as Teleport, Warpgate or JumpServer, or use shellz if you only needed Boundary for session recordings. CE never recorded sessions. On HCP, recording costs $47.92 per user a month.

Get started free How shellz workslast verified November 3, 2026

Choose shellz if

You set up Boundary because an auditor asked for SSH recordings, and the proxy came along with it.
People still SSH straight to servers, run docker exec or copy files over SFTP, and those sessions need recording too.
You don't want to run recording servers, a storage bucket and encryption keys just to replay a session.
You want to watch sessions live. shellz shows them about a second behind.

Stay on HCP Boundary if

Users must reach servers through Boundary, with HashiCorp Vault supplying credentials they never see.
Windows servers are in scope. Boundary records RDP and shellz doesn't.
Recordings must sit in your own S3 or MinIO bucket, encrypted with your own keys.
You already pay for HCP and Vault, and procurement would rather add a line item than a new vendor.

At a glance

shellz vs HCP Boundary, checked November 3, 2026
Capability	shellz	HCP Boundary
Where recording happens	On the server itself	On a Boundary worker (a proxy you run) in the connection path
Direct SSH to the server	Yes, recorded	No, only sessions that go through a worker
Interactive SSH replay	Yes	Yes
Remote commands (`ssh host cmd`)	Yes	Yes, with output since version 1.0.2
SFTP transfers	Yes	Partial: stored in the recording file, but can't be played back
RDP	No	Yes, since 1.0 (June 2026)
Live view	Yes, about one second behind	Not documented; recordings upload when the session ends
Tamper-evident recordings	Yes, signed and chained	Yes, signed files you can validate
Supplies credentials and SSO to servers	No	Yes, through Vault plus OIDC or LDAP
Price	Free for 10 devices; Commercial $10 per member a month plus $1/GB	$47.92 per user a month on the tier with recording

The options

01shellz
Records on each server, so every way in is captured: SSH shells and remote commands, SFTP, su -, tmux, desktop terminals, consoles and docker exec. Sessions are encrypted before they leave the server, and the recordings are signed so edits show.
best for
Linux teams that need a replayable record of every server session and don't want to run a proxy to get it.
pricing
Free for up to 10 active devices. Personal Pro is $1 a month, billed annually. Commercial is $10 a month per team member, plus $1 per stored GB.
watch out
It records access but doesn't control it, so you still need something to decide who gets in. It doesn't record RDP, Kubernetes or databases. SaaS only.
02HCP Boundary (staying)
The paid editions continue. Version 1.1.0 shipped on October 26, 2026 for HCP and Enterprise only. Recordings are signed files stored in your own bucket.
best for
HashiCorp Vault users who want access control plus SSH and RDP recording from one vendor.
pricing
$23.96 per user a month for the entry tier, $47.92 for the tier with session recording. Enterprise is quoted.
watch out
Recording on HCP needs a worker you run yourself, with local disk. HashiCorp-managed workers can't record. Service accounts count as users.
03Teleport
Records on each server through Teleport's own SSH service, or at its proxy for plain OpenSSH servers. Self-hosted or Teleport Cloud.
best for
The closest like-for-like swap: single sign-on, short-lived certificates, and recording for SSH, Kubernetes, databases and Windows desktops.
pricing
Community Edition is free for companies with fewer than 100 staff and under $10M in revenue. Larger companies get a quote.
watch out
It records only sessions that go through Teleport, so you have to block direct SSH. Budget time to run and upgrade the cluster.
04Warpgate
A single program that proxies SSH, web, RDP, VNC, Kubernetes, PostgreSQL and MySQL connections. It replays SSH, Kubernetes, RDP and VNC sessions, and includes single sign-on and approval workflows.
best for
Former CE users who want a free, self-hosted bastion and are happy to run it.
pricing
Free and open source (Apache-2.0), with every feature included. Paid support from EUR 650 a month.
watch out
Self-hosted only. Sessions that skip the proxy aren't recorded, and its docs say SSH command detection is a best guess.
05JumpServer
A self-hosted bastion for SSH, RDP, VNC, databases and Kubernetes. Session recording, file transfer logs and command blocking are in the free edition.
best for
Teams that want a full open-source PAM product, with a password vault, command filtering and many protocols.
pricing
Community Edition is free (GPL-3.0) for up to 5,000 servers and devices. Enterprise is a subscription priced by size.
watch out
Single sign-on, temporary access grants and password rotation are Enterprise-only. If Boundary handled your SSO, budget for Enterprise.
06StrongDM (now Delinea)
A managed access proxy with temporary access grants and session recording. Delinea plans to merge it into its own platform during 2027.
best for
Organisations that want a managed proxy for servers, databases, Kubernetes and web apps.
pricing
No public price since strongdm.com began redirecting to Delinea on October 30, 2026. The last list price was $70 per user a month.
watch out
You'd be signing up mid-merger. Get renewal pricing in writing.
07Cloudflare Access for Infrastructure
Users connect through Cloudflare's client and a tunnel, and servers trust short-lived certificates issued by Cloudflare. Command logs are encrypted with a key you provide.
best for
Small teams already on Cloudflare that want SSH gated by single sign-on.
pricing
Free for up to 50 users, then $7 per user a month.
watch out
There's no player in the browser, so you download each log and decrypt it yourself. The free plan keeps logs for 24 hours.

Boundary CE stopped getting security patches on October 8, 2026

Boundary is HashiCorp's access proxy. Users connect to servers through it, and the paid editions record those sessions. In June 2026, Boundary 1.0 added RDP recording to the paid editions while Community Edition stayed on version 0.21.

On October 8, HashiCorp made the CE code repository read-only. Old versions stay downloadable, but no new releases, bug fixes or security patches are planned.

Your CE servers will keep running without fixes. That's fine in a lab and hard to defend to an auditor.

Most CE users only need to replace the proxy

CE never recorded sessions, so most CE users only lose the access proxy. To replace it, self-host Teleport, Warpgate or JumpServer, or buy Cloudflare or StrongDM.

If you were about to pay for HCP only to get recordings, you may not need a proxy at all. See when you need PAM and when recording alone is enough.

Moving recording from Boundary to the servers

These steps move recording to shellz. Keep or replace your access layer separately.

List your servers. shellz covers the Linux ones; Windows servers stay on Boundary or another proxy that records RDP.
Install shellz on a test group, one command per server. There are no recording workers, buckets or encryption keys to set up.
Run both for a week and compare. Expect shellz to show sessions Boundary never saw, such as direct SSH, remote commands, SFTP, console logins and AI agents logging in with their own keys.
Keep a way to control access, because shellz doesn't decide who gets in. A bastion host, VPN or SSH certificates all work, or Boundary with recording turned off.
Keep the old recordings. Deleting Boundary's storage setting leaves the files in your bucket, so keep the bucket and a Boundary CLI until your retention period ends.
Roll shellz out to the rest of your Linux servers, then turn off Boundary recording for them.

Ten engineers on HCP recording cost $479.20 a month

IBM's price list puts HCP Boundary at $23.96 or $47.92 per user a month, and recording is only on the higher tier. Every person or service account that does anything in a month is billed as a user, so automation adds up.

Ten shellz Commercial members cost $100 a month plus $1 per stored GB, with no limit on servers. See shellz plans.

shellz replaces Boundary recording on Linux only

Access control, the Vault integration and RDP stay with Boundary or another proxy. shellz also has no SIEM export, public API or self-hosted edition yet. If you record over Tailscale SSH too, see the tsrecorder alternatives page. Encryption and integrity checks are explained on the security page.

Questions

Is Boundary Community Edition still supported?

No. HashiCorp archived it on October 8, 2026 and plans no further releases or security patches. Paid HCP Boundary bills per monthly active user and comes with a $500 starting credit.

Did Boundary CE ever record sessions?

No. SSH recording arrived in version 0.13 and RDP recording in 1.0, both for the paid editions only.

Which open-source tool comes closest to Boundary?

Warpgate, which is fully free under Apache-2.0, and JumpServer, which is free for up to 5,000 servers and devices. Teleport's source code is open, but its free Community Edition is limited to smaller companies.

Does shellz do what Boundary does?

It does the recording half. shellz records Linux sessions, including direct logins Boundary never sees. It doesn't control access, supply credentials or record RDP. shellz vs Teleport covers the same trade-off.

What does HCP Boundary cost per user?

$23.96 a month on the entry tier and $47.92 on the tier with session recording, per IBM's price list in November 2026. Boundary Enterprise is quoted.

Related comparisons

Sources

Competitor details come from public documentation and pricing pages, last checked on November 3, 2026. Products change; if something here is out of date, tell us at hello@shellz.dev and we will correct it.

~ $ shellz --helpOne command. Two minutes. Every session recorded.

Get started free See pricing