Early-access documentation.
Slifer Key Locker is a local-first API key broker for developers and agentic workflows. These pages describe what actually ships today, with the commands to drive it.
What this is#
Slifer keeps upstream provider keys in an encrypted vault on your machine. Anything that makes API calls, an app or a coding agent, gets a scoped Locker token instead. A trusted local process attaches the real credential only after a request passes policy, and only for that one request.
The point is not that the key becomes unreachable. The point is that it stops living in the places keys actually leak from: .env files, shell history, source control, log lines, and agent context windows.
What exists today#
Being specific here matters more than sounding finished:
- An encrypted vault with two-factor unlock, a passphrase plus a generated Vault Secret Key.
- A
lockerbinary covering the vault lifecycle, secrets, tokens, and the activity log. - A local daemon that brokers requests, evaluating a deny-by-default policy before anything is decrypted.
- An MCP server so a coding agent can drive the broker without ever holding a credential.
locker run, which puts a secret into one child process's environment and nothing else.
And what does not exist, stated just as plainly: there is no installer, no published package, and no release binary. The brokered path covers one provider, OpenAI. There is no dollar-denominated budget enforcement, and proxied requests are not written to the persisted activity log.
Where to start#
| Page | Read it when |
|---|---|
| Quickstart | You want a vault open and one real command running. |
| CLI reference | You need the exact command, flag, or exit code. |
| Agents and MCP | You are pointing Claude Code or another agent at the broker. |
| Proxy and policy | You want to know exactly what a token is allowed to do. |
| Security model | You want the guarantee, the algorithms, and the residual risk. |
| References | You want the specifications behind the cryptography. |
How to read these#
Every command shown here is one that the project's own test gates run end to end. Where something is designed but not wired up, it says so rather than describing the design in the present tense. If a page claims a capability, the claim is mapped to specific code in the repository's claims ledger.
One rule that never changes. A secret value never goes on a command line. Every command that takes one reads it from standard input, and the binary refuses a raw secret passed as an argument. Argument lists are readable by other processes on the machine and land in shell history.