Latchkey CLI

Local-first encrypted vault for AI API keys. No network calls by default.

Offline leak scan, npx -y @stitchaxis/latchkey@latest scan

No install, no account, no network. Scans the current folder (or a path) for key-shaped strings (OpenAI, Anthropic, xAI, Google, GitHub, AWS, Stripe live, Slack) including .env, .env.*, .npmrc. Values are always printed redacted.

npx -y @stitchaxis/latchkey@latest scan            # current folder
npx -y @stitchaxis/latchkey@latest scan ./apps     # a specific path
npx -y @stitchaxis/latchkey@latest scan --json     # machine-readable
npx -y @stitchaxis/latchkey@latest scan --ci       # exit 1 if anything found (CI / pre-commit)

Skips node_modules, .git, dist, build, .next, .vercel, binaries and files > 2 MB.

⚠️ Use the scope. npx latchkey (unscoped) installs a different, unrelated npm package. After npm i -g @stitchaxis/latchkey the command is just latchkey scan.

Exit codes: 0 ok · 1 findings with --ci · 2 scan error.

Quickstart (after npm install -g @stitchaxis/latchkey)

latchkey login <licence-key>
latchkey init                         # or: latchkey init --passphrase
latchkey add OPENAI_API_KEY           # value from LATCHKEY_VALUE
latchkey list
latchkey run -- node agent.js         # needs .latchkey.toml; Approve with y + Enter

Windows PowerShell (first success)

Use $env:, not cmd set. Full walkthrough: docs/FIRST_RUN_WINDOWS.md.

# From monorepo before npm publish:
.\lk.cmd login <licence-key>
.\lk.cmd init --passphrase
$env:LATCHKEY_PASSPHRASE = "your-vault-password"
$env:LATCHKEY_VALUE = "sk-test-fake-not-real"
.\lk.cmd add MY_API_KEY

# .latchkey.toml → [scope] allowed = ["MY_API_KEY"]
.\lk.cmd run -- node -e "console.log('got=', process.env.MY_API_KEY)"
# Approve? [y/N] → type y → Enter
# expect: got= sk-test-fake-not-real

If an IDE terminal won’t accept keys at Approve: .\lk.cmd run --yes -- …

Project scope (.latchkey.toml)

[scope]
allowed = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY"]

Daemon & MCP

node packages/cli/dist/daemon.js   # Unix socket at ~/.latchkey/daemon.sock
LATCHKEY_MCP_APPROVE=1 node packages/cli/dist/mcp-server.js

See SECURITY.md for the threat model.