Your AI uses your API keys. Make sure nobody else does.
A free, open-source credential vault built for developers who code with AI. Store keys once. Your AI agent uses them, but never sees them. Free forever. No tiers. No account. No telemetry.
phantom edit opens your vault in $EDITOR as KEY=VALUE text. Save — encrypted. No add/remove ceremony for adding 10 secrets at once.
Cap monthly USD spend per key per provider. Never wake up to an $82K bill from a leaked API key.
AES-256-GCM + Argon2id. Master key in macOS Keychain (Touch ID when present). The vault on disk is opaque without you.
One command wires Phantom into Claude Code. Your AI agent gets tools — none return plaintext secrets. Auto-unlock at boot.
Drop a honeypot fake credential in your code. If it's ever used, you get an instant alert. Catch the leak before it catches you.
Output scanned for secrets in 15+ encodings before returning to your AI. Base64, hex, URL-encoded — all caught.
Every AI coding assistant — Claude Code, Cursor, Aider, Windsurf — reads your .env files directly. Your API keys sit in conversation context, logs, memory. If the AI is compromised by prompt injection, or the conversation gets saved/synced/forked, your keys go with it.
This isn't theoretical. February 2026: a three-person startup in Mexico woke up to an $82,314 Gemini bill over 48 hours — a stolen key, no refund, near bankruptcy (The Register). April 2026: Lakera scanned 46,500 npm packages and found 1 in 13 with Claude Code's "allow always" leaked live credentials (bdtechtalks). Phantom Vault eliminates this entire category of risk — locally, free, open-source, audit the crypto yourself.
Detects your OS + CPU. Downloads phantom and vault-mcp from GitHub Releases. SHA-256 verified. Drops into /usr/local/bin (sudo) or ~/.local/bin (no sudo).
Sets a master password. Creates your encrypted vault. Local only.
Opens the vault in your $EDITOR as plain KEY=VALUE text. Save and quit — re-encrypted. Like a notepad, but the file on disk is always sealed.
One-time setup. Master password lives in macOS Keychain (encrypted by your login). After this, every phantom command and the vault-mcp server auto-unlock — no prompts. Touch ID adds an extra layer when present.
Wires Phantom into Claude Code's MCP config. Restart Claude — your AI now sees secrets by reference name (openai-key), never by value.
Optional but recommended:
phantom guardrail set OPENAI_KEY --cap 50 --provider openai
— cap monthly spend per key. Never wake up to an $82,000 surprise bill from a leaked credential.
Master key lives in Apple Secure Enclave or TPM 2.0. Physically cannot be extracted.
AES-256-GCM + XChaCha20-Poly1305. Unique nonce per secret. Memory locked and zeroed.
Commands run in network-restricted subprocesses. Only approved domains reachable.
15+ encoding variants scanned. Base64, hex, URL, HTML entities — all caught.
HMAC-chained logs. Canary honeypots. Trust-level tracking. Tamper-evident.
These are the gaps that humans consistently miss because they think about secrets the way humans use them — not the way machines exploit them.
These tools aren't hidden or restricted — they don't exist in the binary. You cannot call what does not exist.
Phantom Vault is open source under Apache 2.0. Security tools must be auditable. Every line of code is public. Every design decision is documented. We need security researchers, Rust developers, and anyone who cares about AI safety to review, challenge, and improve this.
100% funds development. No investors. No ads. No tracking.