Sallyport MCP
A Mac key vault for agents: Sallyport runs HTTP and SSH with your keys over MCP, and the agent never receives the key itself
- 175 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Runs HTTP requests and SSH commands with real keys on your behalf, so the agent gets access to live systems
- A request result goes back to the agent as received, and a secret the target service returns in its response is outside the vault's protection
- The vault can be neither recovered nor exported: losing access to it means losing the stored secrets
Install
- Works in
Manual install
brew install --cask olegsotnikov/tap/sallyportLaunch the app, create the vault and add a key. A signed DMG is available at sallyport.dev. Requires Apple Silicon and macOS 14 or newer.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Runs HTTP requests and SSH commands with real keys on your behalf, so the agent gets access to live systems
- A request result goes back to the agent as received, and a secret the target service returns in its response is outside the vault's protection
- The vault can be neither recovered nor exported: losing access to it means losing the stored secrets
This is third-party code. Review the repository files before installing.
What it does
Sallyport is a free macOS app with an encrypted local vault for API and SSH keys. An agent asks for an operation over MCP, the app performs it, records it in a signed journal and returns only the response. The key never enters the agent's environment, and there is no command to show a stored secret or export the vault at all. The server starts with the sp mcp command from the app bundle. It gives the agent the http.request, ssh.exec and sallyport.request_credential tools, plus the tools of connected upstream MCP servers. Before running, an action climbs a ladder of checks: the vault must be ready, a marked key or server requires approval for every call, a new process requires session approval, then audit and execution follow. Approval is a click or Touch ID. A separate Secure Enclave signer signs journal rows and integrity anchors. The point is that a malicious package or a prompt injection cannot steal a token from .env or environment variables, because the token is not there. The security boundary is written down in docs/14-trust-model.md and docs/08-security-model.md, including what Sallyport does not stop.
Who it is for. Mac developers who give Claude Code access to production APIs and servers over SSH and do not want to leave keys in .env, environment variables and configs.
Good fit when
- The agent calls a production API and the token must not live in .env or environment variables
- You need to run commands on a server over SSH while keeping the private key out of the agent's reach
- Every call to a live system should need your approval with a click or Touch ID
- You need a signed journal of agent actions that use real keys, for incident review
- Many packages get pulled into the project and you want a stolen .env to be worthless
Not a fit when
- The work machine runs Windows or Linux, or is an Intel Mac: Apple Silicon and macOS 14 or newer are required
- The target service echoes a token in its response: results are returned as received, and the vault's protection does not cover such a secret
- You need a shared team secrets manager: the vault is local and tied to one Mac
- You will need to retrieve or move the key later: Sallyport has no recovery or export
Example request
Through Sallyport call GET on https://api.example.com/v1/status with the stored key and show only the status code and bodyMCP
- Transport
- stdio
- Authentication
- not required
Limitations
- Apple Silicon and macOS 14 or newer are required. The app is signed and notarized and installs from a DMG or through Homebrew.
- Responses from target systems are returned as received. If a service echoes a secret back, the key-isolation guarantee does not cover that case.
- The repository holds one source snapshot per release and pull requests are not accepted. The source builds and tests, but Apple's signature cannot be reproduced without the private materials.
- The shipped sp has only the mcp and version commands. The last commit in the repository is dated July 2026.
How to disable. Remove the entry with claude mcp remove sallyport. The app goes away with brew uninstall --cask sallyport or by dragging it out of Applications. The vault cannot be recovered without its keys, and there is no export.
FAQ
What is Sallyport and how does it protect keys?
A free macOS app with an encrypted vault. An agent asks for an action over MCP and Sallyport performs it with the key, returning only the response. There is no command to reveal or export a secret, so the key never enters the agent's environment.
How do I connect Sallyport to Claude Code?
Install the app, create a vault, add a key and run claude mcp add sallyport -- /Applications/Sallyport.app/Contents/MacOS/sp mcp. It takes about two minutes from install to the first call.
Which tools does Sallyport give an agent?
Three of its own: http.request, ssh.exec and sallyport.request_credential. The agent also gets the tools of any upstream MCP servers you connected to Sallyport.
How are agent actions approved?
A marked key or server requires approval for every call and a new process requires session approval. Approval is a click in a window or Touch ID.
Which computers does Sallyport run on?
Only Macs with Apple Silicon on macOS 14 or newer. The README mentions no builds for Windows, Linux or Intel Macs.
Discussion
No questions or reviews yet.
Related
MCP serversA gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging
A CLI and MCP bridge over a KeePass-compatible vault: an agent gets one secret only after your answer, and every request lands in a log
A local password manager with MCP: the agent signs in to sites, SSH and APIs while hidden secrets stay out of model context
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
The official Socket MCP server scores the security of npm, PyPI, cargo and other dependencies inside an agent chat.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Sallyport (this card) | yes | not required | 175 | |
| Vault MCP Server | yes | API key | 66 | HashiCorp's official server gives the agent access to Vault secrets, while Sallyport never hands over a secret and performs the action itself |
| SandVault | no | 450 | runs the agent in a separate macOS account, while Sallyport hides keys and signs a log of calls |
README in short
The README explains the idea of a vault where the agent gets the operation but not the key and links to the trust model. It continues with DMG or Homebrew installation, MCP connection, the authorization ladder, building from source, a table of documents and the license and trademark terms.