Does Latchkey send my keys to the cloud?

No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery — never vault plaintext.

How is encryption implemented?

Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.

Can an AI agent read every key?

Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.

Is there a free tier?

No. Paid plans start at Solo. There is a £2.99 one-off leak scan (one per email and device).

What is the leak scan?

An offline heuristic pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.

How do MCP tools get a secret?

The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.

What does the audit log contain?

Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.

What is .latchkey.toml?

A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.

Which platforms does the CLI support?

macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.

How do licences work?

After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.

What do you never see?

We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync — not secret values.

Who do I contact for Enterprise or support?

Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.

Docs

Install, CLI reference, MCP setup, and project scopes.

2-minute quickstart

Running in under two minutes

Free scan (no account): npx @stitchaxis/latchkey scan
Buy Pro → copy licence from /success or email
npm i -g @stitchaxis/latchkey
latchkey login <key>
latchkey add MY_API_KEY then latchkey run -- … → Approve

Cursor MCP: /integrations/cursor

How it fits together

Website — buy plan, get licence, preview dashboard.
CLI — real vault on your machine; Approve / Deny when something asks for a key.
Project file — .latchkey.toml allowlists which names a repo may request.

Install

npm install -g @stitchaxis/latchkey
latchkey --help
latchkey login <your-licence-key>

# Prefer OS keychain; on Windows if keytar fails:
latchkey init --passphrase
# PowerShell — every new terminal after passphrase mode:
$env:LATCHKEY_PASSPHRASE = "your-vault-password"

$env:LATCHKEY_VALUE = "sk-test-fake-not-real"
latchkey add MY_API_KEY
latchkey list

# .latchkey.toml → [scope] allowed = ["MY_API_KEY"]
latchkey run -- node -e "console.log('got=', process.env.MY_API_KEY)"
# Approve? [y/N] → type y → Enter

Package: @stitchaxis/latchkey on npm. Full Windows notes: docs/FIRST_RUN_WINDOWS.md.

CLI reference

latchkey init — create vault + master key (keychain or --passphrase)
latchkey add NAME — store a secret (value via LATCHKEY_VALUE)
latchkey get / list / rm — manage names
latchkey run -- cmd — inject scoped env after approval
latchkey scan — free offline leak scan (upsell to Pro / Leak scan for the full product)
latchkey login <token> — activate licence
latchkey lock — clear unlocked material from memory

MCP setup

Point your MCP client at the Latchkey stdio server. Set LATCHKEY_MCP_APPROVE=1 in the environment that launches the server so requests can prompt for approval. The tool name is latchkey_get_secret.

{
  "mcpServers": {
    "latchkey": {
      "command": "npx",
      "args": ["latchkey", "mcp"],
      "env": { "LATCHKEY_MCP_APPROVE": "1" }
    }
  }
}

Agent sandbox (planned)

Approve/deny ships today. Preview: latchkey run --sandbox -- … (warns only; see /agent-sandbox. Do not enable sandbox flags until announced in changelog.

.latchkey.toml

# Commit this file. Never put secret values here.
[scope]
allowed = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY"]

Threat model: /security. Questions: Yusuf@yusuf-choudhury.com.

Docs

Install, CLI reference, MCP setup, and project scopes.

2-minute quickstart

Running in under two minutes

Free scan (no account): npx @stitchaxis/latchkey scan
Buy Pro → copy licence from /success or email
npm i -g @stitchaxis/latchkey
latchkey login <key>
latchkey add MY_API_KEY then latchkey run -- … → Approve

Cursor MCP: /integrations/cursor

Install

npm install -g @stitchaxis/latchkey latchkey --help latchkey login <your-licence-key> # Prefer OS keychain; on Windows if keytar fails: latchkey init --passphrase # PowerShell — every new terminal after passphrase mode: $env:LATCHKEY_PASSPHRASE = "your-vault-password" $env:LATCHKEY_VALUE = "sk-test-fake-not-real" latchkey add MY_API_KEY latchkey list # .latchkey.toml → [scope] allowed = ["MY_API_KEY"] latchkey run -- node -e "console.log('got=', process.env.MY_API_KEY)" # Approve? [y/N] → type y → Enter

Package: @stitchaxis/latchkey on npm. Full Windows notes: docs/FIRST_RUN_WINDOWS.md.

CLI reference

latchkey init — create vault + master key (keychain or --passphrase)

latchkey add NAME — store a secret (value via LATCHKEY_VALUE)

latchkey get / list / rm — manage names

latchkey run -- cmd — inject scoped env after approval

latchkey scan — free offline leak scan (upsell to Pro / Leak scan for the full product)

latchkey login <token> — activate licence

latchkey lock — clear unlocked material from memory

MCP setup

{ "mcpServers": { "latchkey": { "command": "npx", "args": ["latchkey", "mcp"], "env": { "LATCHKEY_MCP_APPROVE": "1" } } } }