How it works

Five steps from empty vault to an approved agent run.

1. 01

   Install and init

   Install the CLI, run latchkey init, and choose keychain or passphrase wrap for the master key.

2. 02

   Add secrets

   latchkey add NAME stores ciphertext in the local vault. Values are never written to project files.

3. 03

   Scope the project

   Commit .latchkey.toml with the env names this repo may request.

4. 04

   Run or MCP

   latchkey run -- your-agent injects only scoped names after approval. MCP tools use the same gate.

5. 05

   Audit

   Each approve or deny appends metadata to the local audit log. Export from the app when signed in.

npm install -g @latchkey/cli   # or npx
latchkey init
latchkey add OPENAI_API_KEY
# edit .latchkey.toml
latchkey run -- node agent.js