Sallyport

Sallyport

Let your agent touch prod. Keep the keys.

Sallyport is a free Mac app that holds API and SSH credentials in an encrypted local vault and executes authenticated actions for AI agents. The agent asks for an operation over MCP; Sallyport runs it, records it in a signed journal, and the key never appears in the agent's environment. There is no command that reveals a stored credential, and no export or recovery route either.

Website: sallyport.dev

Why

Coding agents read .env files, shell variables, and config files, and so does every package they pull in. Recent npm supply-chain attacks harvested credentials from exactly those places, and a prompt-injected agent can leak a token without any malware at all.

Traditional secret managers still deliver the secret to the workload. That model breaks when the workload itself is untrusted. Sallyport inverts it: the workload gets an action, the vault keeps the secret.

The exact security boundary, including what Sallyport does not stop, is written down in [docs/14-trust-model.md](docs/14-trust-model.md) and [docs/08-security-model.md](docs/08-security-model.md). Executor responses are returned as received, so a target that echoes sensitive data is outside the credential-isolation guarantee.

Repository

This public repository contains one source snapshot per Sallyport release. Pull requests are not accepted here. Report bugs and security issues as described in [CONTRIBUTING.md](CONTRIBUTING.md).

Install

Install the signed and notarized DMG from sallyport.dev, [Releases](../../releases), or Homebrew:

brew install --cask olegsotnikov/tap/sallyport

Launch the app, create the vault, add a credential, and point your MCP client at the gate:

claude mcp add sallyport -- /Applications/Sallyport.app/Contents/MacOS/sp mcp

From install to the first gated call takes about two minutes. Requires Apple Silicon and macOS 14 or newer. Release checksums are published with each release and in https://sallyport.dev/downloads/manifest.json.

Authorization

Every action follows the fixed ladder in [docs/14-trust-model.md](docs/14-trust-model.md):

1. The vault must be ready.
2. A marked key or MCP server requires per-call approval.
3. A new process requires session approval unless observe mode or the optional allowlist applies.
4. Sallyport audits and executes the action.

Approvals use a click or Touch ID and resolve in process. They are not signed grants. A separate Secure Enclave signer signs audit rows and integrity anchors.

The app supports http.request, ssh.exec, sallyport.request_credential, and configured upstream MCP tools. There is no credential-reveal route, but target and upstream results may contain credentials or other sensitive data.

Build

(cd core && go test -race ./...)
(cd mac && swift build -c release && swift test)

Creating the signed .app bundle requires the matching Apple signing identity and provisioning profile and is performed by release CI. The public snapshot supports source compilation and tests; it cannot reproduce Apple's signature without the private signing material.

Run the Secure Enclave self-test from an official signed bundle:

mac/build/Sallyport.app/Contents/MacOS/Sallyport --selftest

Configure an MCP client to run Sallyport.app/Contents/MacOS/sp mcp. The shipped sp CLI contains only mcp and version.

Documentation

| File | Contents | |---|---| | [docs/14-trust-model.md](docs/14-trust-model.md) | authorization and vault states | | [docs/01-architecture.md](docs/01-architecture.md) | components and call flow | | [docs/02-channels.md](docs/02-channels.md) | HTTP, SSH, and upstream MCP | | [docs/04-vault.md](docs/04-vault.md) | vault and keystore | | [docs/05-approvals.md](docs/05-approvals.md) | session and per-call approvals | | [docs/06-audit.md](docs/06-audit.md) | audit, result handling, and recordings | | [docs/07-identity-deployment.md](docs/07-identity-deployment.md) | process identity and deployment | | [docs/08-security-model.md](docs/08-security-model.md) | threats and residual risk | | [docs/11-reference.md](docs/11-reference.md) | settings, tools, operations, errors | | [docs/15-messaging.md](docs/15-messaging.md) | messaging and claims policy |

License

Licensed under [Apache-2.0](LICENSE.md).

The Sallyport name, glyph, and logo are trademarks. See [TRADEMARK.md](TRADEMARK.md).

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: OlegSotnikov
• Source: OlegSotnikov/sallyport
• License: Apache-2.0
• Homepage: https://sallyport.dev

Install and usage instructions live in the source repository linked above.