localvault (Inventlist)

LocalVault

使用MCP服务器为AI代理加密本地机密库。零基础设施，零云依赖。

尝试交互式演示 --探索浏览器中的每个命令。

部分 InventList工具 --面向独立开发者的免费开源开发工具。

______________________________________________________________________

安装

自制（macOS/Linux）

brew install inventlist/tap/localvault

Ruby 宝石

gem install localvault

需要利博纳：

# macOS
brew install libsodium

# Ubuntu/Debian
sudo apt-get install libsodium-dev

# Fedora
sudo dnf install libsodium-devel

快速开始

# Create a vault (prompts for passphrase)
localvault init

# Store secrets
localvault set OPENAI_API_KEY "sk-proj-..."
localvault set STRIPE_SECRET_KEY "sk_live_..."
localvault set DATABASE_URL "postgres://localhost/myapp"

# Retrieve a secret (raw, pipeable)
localvault get OPENAI_API_KEY

# View all secrets (masked by default)
localvault show

# Reveal values
localvault show --reveal

# Export as shell variables
eval $(localvault env)

# Run a command with secrets injected
localvault exec -- rails server

命令

秘密

保险库管理

同步和登录

团队共享（v1.3.0）

保险库级别的操作正在进行中 team.人员操作（ @handle 已经向某人发出信号）是顶级的。

这 team add, team remove，以及 team verify 别名仍然适用 向后兼容，但首选顶级形式。

钥匙

AI/MCP

所有命令接受 --vault NAME （或 -v NAME)针对特定的保险库。默认保管库为 default.

个人同步

在机器之间同步您的保管库——相同的密码，不需要团队功能：

# Machine A: push all your vaults at once
localvault sync

# Machine B: install, login, sync
brew install inventlist/tap/localvault
localvault login YOUR_TOKEN
localvault sync                # pulls everything, pushes local-only vaults
localvault show                # enter your passphrase — same secrets

或推/拉单个保险库：

localvault sync push production    # push one vault
localvault sync pull production    # pull one vault
localvault sync status             # check what's synced vs local-only

同步前预览：

localvault sync --dry-run
#   Vault         Action    Reason
#   default       skip      up to date
#   production    push      local changes
#   staging       pull      remote changes

团队共享

使用X25519非对称加密与队友共享保险库访问权限。服务器永远看不到明文。

# 1. Convert to team vault (required first)
localvault team init -v production

# 2. Verify teammate has a published key
localvault verify @alice

# 3. Add with full access
localvault add @alice -v production

# 4. Or scoped — they only see specific keys
localvault add @bob -v production --scope STRIPE_KEY WEBHOOK_SECRET

# 5. When Alice pulls, auto-unlocks via her identity key
# (on Alice's machine)
localvault sync pull production
# => Unlocked via your identity key.

# 6. Scoped members can't push
# (on Bob's machine)
localvault sync push production
# => Error: You have scoped access. Only the owner can push.

# 7. Rotate without removing anyone
localvault team rotate -v production

# 8. Full revocation + re-key
localvault remove @alice -v production --rotate

先决条件： 队友必须有一个公开的公钥。 localvault login 自动执行此操作，或者： localvault keys generate && localvault keys publish.

MCP服务器（AI代理）

为AI代理提供安全的秘密访问权限。密钥从不出现在代理上下文或配置文件中。

# One-command install for Claude Code
localvault install-mcp claude-code
# Also supports: cursor, windsurf, zed

# Unlock your vault for the session
localvault unlock

# MCP tools available to the agent:
#   get_secret(key, vault?)      — read a secret
#   list_secrets(vault?, prefix?) — list key names
#   set_secret(key, value, vault?) — store a secret
#   delete_secret(key, vault?)   — remove a secret

执行操作 --代理声明意图，LocalVault执行时注入秘密。代理人永远看不到钥匙：

localvault exec_action -- curl -s https://api.openai.com/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY"

多项目金库

一个金库，许多项目。点符号使秘密保持有序：

# Store with project prefix
localvault set myapp.DATABASE_URL postgres://localhost/myapp -v work
localvault set api.DATABASE_URL postgres://localhost/api -v work

# View grouped by project
localvault show --group -v work

# Filter to one project
localvault show -p myapp -v work

# Export one project
eval $(localvault env -p myapp -v work)

# Bulk import
localvault import .env --prefix myapp -v work

会话缓存

避免重复键入密码：

eval $(localvault unlock)

# All subsequent commands skip the passphrase prompt
localvault get API_KEY
localvault exec -- rails server

会话生活在 LOCALVAULT_SESSION --当终端关闭时消失。

安全

加密堆栈

• 每次加密随机24字节随机数
• Poly1305身份验证防止篡改
• Argon2d是内存硬的（GPU/ASIC抗性）
• 所有加密货币通过 钠库 （RbNaCl结合）
• SyncBundle v3适用于团队保险库（所有者字段+每个成员的密钥槽）

存储布局

~/.localvault/
├── config.yml              # Default vault, server URL, token
├── identity.key            # X25519 private key (encrypted at rest)
├── identity.pub            # X25519 public key (safe to share)
├── vaults/
│   ├── default/
│   │   ├── meta.yml        # Salt, creation date, version
│   │   └── secrets.enc     # Encrypted JSON blob
│   └── production/
│       ├── meta.yml
│       └── secrets.enc

服务器独立性

LocalVault与服务器无关。它配置为 inventlist.com 而是与实现该协议的任何主机（4个端点）一起工作：

# Use a different server
localvault config set server https://vaulthost.example

# Or override per-login
localvault login --server https://vaulthost.example

发展

git clone https://github.com/inventlist/localvault.git
cd localvault
bundle install
bundle exec rake test  # 463 tests, 918 assertions

被...使用

在以下位置启用凭据管理 发明列表 --独立建筑商在这里发货、分享和被发现。

许可证

Apache 2.0——请参阅 许可证. 由 发明列表 团队。