为什么值得关注

它颠覆了传统的秘密管理模型，提供操作而非秘密，即使在代理不可信时也能防范供应链攻击和提示注入。

适合谁使用

需要安全访问生产系统的 AI/代理开发者
注重安全的 macOS 用户，部署编码助手
希望为基于 MCP 的工具实现凭据隔离的 DevOps 团队
在 Apple Silicon Mac 上使用 Claude 或类似 MCP 客户端的开发者

典型使用场景

让编码代理在生产服务器上执行 SSH 命令或 HTTP 请求，而无需暴露 SSH 密钥或 API 令牌
对敏感操作强制要求逐次调用或每次会话审批
通过签名审计跟踪对代理访问数据库或云控制台进行门控
用绝不向代理进程泄露秘密的保险库替代 `.env` 文件的使用

项目优势

凭据从不暴露给代理环境——不存在任何可显示、导出或恢复凭据的命令
本地加密保险库（隐含与 macOS 钥匙串集成）支持每次调用时通过点击或 Touch ID 批准
签名审计日志和 Secure Enclave 完整性锚点提供不可否认性
兼容现有 MCP 客户端（如 Claude），支持 HTTP、SSH 和上游 MCP 工具

使用前须知

仅支持 macOS 14+ 和 Apple Silicon，暂无跨平台版本
目标服务器的响应原样传递，因此回显的敏感数据仍可能被看到
公开仓库不接受拉取请求，且完整可复现构建需要 Apple 的签名材料

README 快速开始

Sallyport

Let your agent touch prod. Keep the keys.

Sallyport is a free Mac app that holds API and SSH credentials in an encrypted local vault and executes authenticated actions for AI agents. The agent asks for an operation over MCP; Sallyport runs it, records it in a signed journal, and the key never appears in the agent's environment. There is no command that reveals a stored credential, and no export or recovery route either.

Website: sallyport.dev

Why

Coding agents read .env files, shell variables, and config files, and so does every package they pull in. Recent npm supply-chain attacks harvested credentials from exactly those places, and a prompt-injected agent can leak a token without any malware at all.

Traditional secret managers still deliver the secret to the workload. That model breaks when the workload itself is untrusted. Sallyport inverts it: the workload gets an action, the vault keeps the secret.

The exact security boundary, including what Sallyport does not stop, is written down in docs/14-trust-model.md and docs/08-security-model.md. Executor responses are returned as received, so a target that echoes sensitive data is outside the credential-isolation guarantee.

Repository

This public repository contains one source snapshot per Sallyport release. Pull requests are not accepted here. Report bugs and security issues as described in CONTRIBUTING.md.

Install

Install the signed and notarized DMG from sallyport.dev, Releases, or Homebrew:

brew install --cask olegsotnikov/tap/sallyport

Launch the app, create the vault, add a credential, and point your MCP client at the gate:

claude mcp add sallyport -- /Applications/Sallyport.app/Contents/MacOS/sp mcp

From install to the first gated call takes about two minutes. Requires Apple Silicon and macOS 14 or newer. Release checksums are published with each release and in https://sallyport.dev/downloads/manifest.json.

Authorization

Every action follows the fixed ladder in docs/14-trust-model.md:

The vault must be ready.
A marked key or MCP server requires per-call approval.
A new process requires session approval unless observe mode or the optional allowlist applies. 4

sallyport