1. Conduid
  2. Security
  3. Sallyport
MCP server · Security

Sallyport

by · github.com/OlegSotnikov/sallyport

A Mac vault that runs authenticated actions for AI agents over MCP. The agent gets the operation, never the key: no command reveals a stored credential, and there is no export route.

Unclaimed Apache-2.0 ai-agentscredentialsdeveloper-toolsmacosmcpsecrets-managementsecurityswift
InstallView source
52Fair

Scored 2 hours ago · breakdown

About Sallyport

Sallyport is an MCP server published by OlegSotnikov in the Security category: a Mac vault that runs authenticated actions for AI agents over MCP. The agent gets the operation, never the key: no command reveals a stored credential, and there is no export route.

The repository has 193 stars and 5 forks, with the last commit 3 months ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/OlegSotnikov/sallyport

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Sallyport

Powered by Claude · Grounded in docs

I know everything about Sallyport. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 1 hours ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • ✓Tests presentA test suite exists in the repository.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.

1 check has not been run yet.

Releases

v0.8.16Sallyport 0.8.16 · 17 Jul 2026Sallyport 0.8.16 Documentation and repository-hygiene release; app behavior is unchanged. A new messaging and claims policy (docs/15-messaging.md) pins every product claim to documented behavior in the trust model and lists the claims…
v0.8.15Sallyport 0.8.15 · 17 Jul 2026Sallyport 0.8.15 Hotfix: the MCP stdio shim (`sp mcp`) blocked on stdin with FileHandle.read(upToCount:), which waits for a full buffer or EOF. A live MCP host writes one small initialize request into an open pipe and waits for the reply,…
v0.8.14Sallyport 0.8.14 · 16 Jul 2026Sallyport 0.8.14 Transport and trust-context hardening: Pin each control-socket connection to one peer process instance (connect-time audit token + kernel start time), re-validated on every call; connection descriptors are close-on-exec on…
v0.8.13Sallyport 0.8.13 · 16 Jul 2026Sallyport 0.8.13 Security and trust-boundary hardening: Pin HTTP, OAuth, and remote MCP connections to validated DNS snapshots while supporting bounded multi-address failover. Persist accept-new SSH host keys only after successful client…
v0.8.12Sallyport 0.8.12 · 15 Jul 2026Sallyport 0.8.12 Localize the macOS app in German, Spanish, French, Brazilian Portuguese, Russian, and Simplified Chinese. Add per-app language switching, an About update button, and localized approval and activity copy.

README

Sallyport

Let your agent touch prod. Keep the keys.

Sallyport is a free Mac app that holds API and SSH credentials in an encrypted local vault and executes authenticated actions for AI agents. The agent asks for an operation over MCP; Sallyport runs it, records it in a signed journal, and the key never appears in the agent's environment. There is no command that reveals a stored credential, and no export or recovery route either.

Website: sallyport.dev

Why

Coding agents read .env files, shell variables, and config files, and so does every package they pull in. Recent npm supply-chain attacks harvested credentials from exactly those places, and a prompt-injected agent can leak a token without any malware at all.

Traditional secret managers still deliver the secret to the workload. That model breaks when the workload itself is untrusted. Sallyport inverts it: the workload gets an action, the vault keeps the secret.

The exact security boundary, including what Sallyport does not stop, is written down in docs/14-trust-model.md and docs/08-security-model.md. Executor responses are returned as received, so a target that echoes sensitive data is outside the credential-isolation guarantee.

Repository

This public repository contains one source snapshot per Sallyport release. Pull requests are not accepted here. Report bugs and security issues as described in CONTRIBUTING.md.

Install

Install the signed and notarized DMG from sallyport.dev, Releases, or Homebrew:

brew install --cask olegsotnikov/tap/sallyport

Launch the app, create the vault, add a credential, and point your MCP client at the gate:

claude mcp add sallyport -- /Applications/Sallyport.app/Contents/MacOS/sp mcp

From install to the first gated call takes about two minutes. Requires Apple Silicon and macOS 14 or newer. Release checksums are published with each release and in https://sallyport.dev/downloads/manifest.json.

Authorization

Every action follows the fixed ladder in docs/14-trust-model.md:

  1. The vault must be ready.
  2. A marked key or MCP server requires per-call approval.
  3. A new process requires session approval unless observe mode or the optional allowlist applies.
  4. Sallyport audits and executes the action.

Approvals use a click or Touch ID and resolve in process. They are not signed grants. A separate Secure Enclave signer signs audit rows and integrity anchors.

The app supports http.request, ssh.exec, sallyport.request_credential, and configured upstream MCP tools. There is no credential-reveal route, but target and upstream results may contain credentials or other sensitive data.

Build

(cd core && go test -race ./...)
(cd mac && swift build -c release && swift test)

Creating the signed .app bundle requires the matching Apple signing identity and provisioning profile and is performed by release CI. The public snapshot supports source compilation and tests; it cannot reproduce Apple's signature without the private signing material.

Run the Secure Enclave self-test from an official signed bundle:

mac/build/Sallyport.app/Contents/MacOS/Sallyport --selftest

Configure an MCP client to run Sallyport.app/Contents/MacOS/sp mcp. The shipped sp CLI contains only mcp and version.

Documentation

File Contents
docs/14-trust-model.md authorization and vault states
docs/01-architecture.md components and call flow
docs/02-channels.md HTTP, SSH, and upstream MCP
docs/04-vault.md vault and keystore
docs/05-approvals.md session and per-call approvals
docs/06-audit.md audit, result handling, and recordings
docs/07-identity-deployment.md process identity and deployment
docs/08-security-model.md threats and residual risk
docs/11-reference.md settings, tools, operations, errors
docs/15-messaging.md messaging and claims policy

License

Licensed under Apache-2.0.

The Sallyport name, glyph, and logo are trademarks. See TRADEMARK.md.

README fetched from the repository 1 hours ago. The original is authoritative.

Questions

About Sallyport

How do I install Sallyport?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Sallyport safe to use with an AI agent?

Its trust score is 52 out of 100 (fair). It passes 5 of the 5 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Sallyport still maintained?

Yes — the latest release is v0.8.16 (17 Jul 2026), and the last commit was 3 months ago. The repository has 193 stars.