[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93510":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":8,"language":10,"languages":8,"totalLinesOfCode":8,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":15,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":15,"compositeScore":16,"rankGlobal":8,"rankLanguage":8,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":8,"pushedAt":8,"updatedAt":22,"readmeContent":23,"aiSummary":8,"trendingCount":14,"starSnapshotCount":14,"syncStatus":24,"lastSyncTime":25,"discoverSource":26},93510,"sallyport","OlegSotnikov\u002Fsallyport","OlegSotnikov",null,"https:\u002F\u002Fsallyport.dev","Swift",321,10,1,0,14,48.52,"Apache License 2.0",false,"main",true,[],"2026-07-22 04:02:09","# Sallyport\n\n**Let your agent touch prod. Keep the keys.**\n\nSallyport is a free Mac app that holds API and SSH credentials in an encrypted local vault and executes authenticated actions for AI agents. The agent asks for an operation over MCP; Sallyport runs it, records it in a signed journal, and the key never appears in the agent's environment. There is no command that reveals a stored credential, and no export or recovery route either.\n\nWebsite: [sallyport.dev](https:\u002F\u002Fsallyport.dev)\n\n## Why\n\nCoding agents read `.env` files, shell variables, and config files, and so does every package they pull in. Recent npm supply-chain attacks harvested credentials from exactly those places, and a prompt-injected agent can leak a token without any malware at all.\n\nTraditional secret managers still deliver the secret to the workload. That model breaks when the workload itself is untrusted. Sallyport inverts it: the workload gets an action, the vault keeps the secret.\n\nThe exact security boundary, including what Sallyport does not stop, is written down in [docs\u002F14-trust-model.md](docs\u002F14-trust-model.md) and [docs\u002F08-security-model.md](docs\u002F08-security-model.md). Executor responses are returned as received, so a target that echoes sensitive data is outside the credential-isolation guarantee.\n\n## Repository\n\nThis public repository contains one source snapshot per Sallyport release. Pull requests are not accepted here. Report bugs and security issues as described in [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## Install\n\nInstall the signed and notarized DMG from [sallyport.dev](https:\u002F\u002Fsallyport.dev), [Releases](..\u002F..\u002Freleases), or Homebrew:\n\n```bash\nbrew install --cask olegsotnikov\u002Ftap\u002Fsallyport\n```\n\nLaunch the app, create the vault, add a credential, and point your MCP client at the gate:\n\n```bash\nclaude mcp add sallyport -- \u002FApplications\u002FSallyport.app\u002FContents\u002FMacOS\u002Fsp mcp\n```\n\nFrom install to the first gated call takes about two minutes. Requires Apple Silicon and macOS 14 or newer. Release checksums are published with each release and in `https:\u002F\u002Fsallyport.dev\u002Fdownloads\u002Fmanifest.json`.\n\n## Authorization\n\nEvery action follows the fixed ladder in [docs\u002F14-trust-model.md](docs\u002F14-trust-model.md):\n\n1. The vault must be ready.\n2. A marked key or MCP server requires per-call approval.\n3. A new process requires session approval unless observe mode or the optional allowlist applies.\n4. Sallyport audits and executes the action.\n\nApprovals use a click or Touch ID and resolve in process. They are not signed grants. A separate Secure Enclave signer signs audit rows and integrity anchors.\n\nThe app supports `http.request`, `ssh.exec`, `sallyport.request_credential`, and configured upstream MCP tools. There is no credential-reveal route, but target and upstream results may contain credentials or other sensitive data.\n\n## Build\n\n```bash\n(cd core && go test -race .\u002F...)\n(cd mac && swift build -c release && swift test)\n```\n\nCreating the signed `.app` bundle requires the matching Apple signing identity\nand provisioning profile and is performed by release CI. The public snapshot\nsupports source compilation and tests; it cannot reproduce Apple's signature\nwithout the private signing material.\n\nRun the Secure Enclave self-test from an official signed bundle:\n\n```bash\nmac\u002Fbuild\u002FSallyport.app\u002FContents\u002FMacOS\u002FSallyport --selftest\n```\n\nConfigure an MCP client to run `Sallyport.app\u002FContents\u002FMacOS\u002Fsp mcp`. The shipped `sp` CLI contains only `mcp` and `version`.\n\n## Documentation\n\n| File | Contents |\n|---|---|\n| [docs\u002F14-trust-model.md](docs\u002F14-trust-model.md) | authorization and vault states |\n| [docs\u002F01-architecture.md](docs\u002F01-architecture.md) | components and call flow |\n| [docs\u002F02-channels.md](docs\u002F02-channels.md) | HTTP, SSH, and upstream MCP |\n| [docs\u002F04-vault.md](docs\u002F04-vault.md) | vault and keystore |\n| [docs\u002F05-approvals.md](docs\u002F05-approvals.md) | session and per-call approvals |\n| [docs\u002F06-audit.md](docs\u002F06-audit.md) | audit, result handling, and recordings |\n| [docs\u002F07-identity-deployment.md](docs\u002F07-identity-deployment.md) | process identity and deployment |\n| [docs\u002F08-security-model.md](docs\u002F08-security-model.md) | threats and residual risk |\n| [docs\u002F11-reference.md](docs\u002F11-reference.md) | settings, tools, operations, errors |\n| [docs\u002F15-messaging.md](docs\u002F15-messaging.md) | messaging and claims policy |\n\n## License\n\nLicensed under [Apache-2.0](LICENSE.md).\n\nThe Sallyport name, glyph, and logo are trademarks. See [TRADEMARK.md](TRADEMARK.md).\n",2,"2026-07-20 02:30:03","CREATED_QUERY"]