allow
Tools you pre-approved
A rule like Bash(git commit:*) lets that command through without stopping. The rule is scoped to the command, not to what the command opens once it runs.
Claude Code
Claude Code security is a credential problem
The permission system decides which tools Claude Code may run. It says nothing about what those tools can reach, and what they can reach is every secret on your machine. Sallyport moves the keys somewhere the agent cannot read them.
permission rules stop at the tool boundaryone allowed shell command reads .envthe gap is where the key lives
Permissions
What the permission prompts actually cover
Claude Code asks before running a tool you have not allowed. The rules live in settings.json as allow, ask, and deny lists, and they are worth setting up properly.
no prompt
ask
Everything unlisted
The default. Claude Code shows you the tool call and waits. You are reviewing one action, in the moment, with whatever context you happen to have at 2am.
deny
Paths and tools you blocked
A deny rule keeps the Read tool out of ./.env. It does not keep a permitted shell command out of the same file, and it has no say over the processes your dependencies start.
bypass
No prompts at all
The --dangerously-skip-permissions flag drops the question entirely. That one has its own section below.
Every one of those rules governs the agent's tools. None of them governs the file a tool reads. Your API tokens are in .env, your SSH key is in ~/.ssh, and both are readable by any process running as you, prompt or no prompt.
YOLO mode
What --dangerously-skip-permissions actually turns off
People reach for it with good reason: long refactors and overnight runs where a confirmation dialog means the job sits idle until morning. It is worth knowing exactly what you traded for that.
It turns off confirmations, not capabilities
Claude Code could already read your files, run your shell, and reach the network. The flag removes the pause where you would have noticed it happening.
The file was always readable
The prompt was a chance to catch the agent opening .env. It was never a barrier around the file itself. Any process running as you can read it, including the dependency npm installed while you were reading the prompt.
The blast radius is whatever your shell can do
One prompt injection in a fetched page, one poisoned README in a transitive dependency, and those instructions land inside a session that holds your credentials and has no prompts left.
YOLO mode costs you the chance to notice. It is not what put the keys within reach; they were within reach in default mode too.
Security review
Reviewing your code is a different job
Claude Code will read a diff and flag vulnerabilities in it, and you should let it. That work is about the code you are shipping. It says nothing about what the agent itself can reach while it runs, which is the exposure this page is about. They are separate problems, and fixing one does nothing for the other.
The fix
Take the keys off the table
Sallyport holds the credential and runs the call. Claude Code asks for an action and gets a result back. No key enters its environment, so there is nothing for a skipped prompt, a poisoned dependency, or an injected instruction to walk out with.
01
The agent asks for an action
http.request to api.stripe.com, or ssh.exec on prod-03. It arrives over MCP, the same way Claude Code calls any other tool.
02
Sallyport decides
A locked vault denies everything. A key flagged for approval per call shows a card every time. Otherwise one card per agent run, carrying the caller's code-signing authority.
03
Sallyport makes the call
The credential attaches inside the app, during execution. It does not enter the agent's environment, and a cross-host redirect does not carry it along.
04
The journal keeps the receipt
Encrypted and hash-chained as the action happens. You can find out what ran without relying on the agent's account of it.
After that, run Claude Code however suits you, prompts on or off. The decision that mattered moved out of the agent.
Setup
Point Claude Code at the gate
Sallyport runs in the menu bar and hosts the vault in process. There is no daemon and no account.
01
Install and launch
Onboarding creates the vault and turns on its Touch ID gate.
brew install --cask olegsotnikov/tap/sallyport02
Register the MCP shim
Claude Code picks up http.request, ssh.exec, and any upstream MCP server you proxy through Sallyport.
claude mcp add sallyport -- /Applications/Sallyport.app/Contents/MacOS/sp mcp03
Move the key and delete the copy
Store the credential in the vault, bind it to its host, and remove it from .env. Flag the ones that scare you for approval per call.
stripe → api.stripe.com · approval per callAbout two minutes. The prompts you keep are Sallyport's, and they ask about actions against real infrastructure rather than about which tool is allowed to run.
FAQ
Claude Code and Sallyport
Can I still use --dangerously-skip-permissions?
Yes, and it becomes a much more reasonable thing to do once the keys are out of reach. Sallyport's approvals are separate from Claude Code's, so skipping one does not skip the other.
Does this slow Claude Code down?
One card per agent run, then nothing until the run ends, unless you flagged a key for approval per call. Approved calls execute at the speed of the API behind them.
Can Claude Code see the API response?
Yes. Sallyport returns the target's response as it arrives and does not inspect the content. If a service echoes a secret back inside its own response, the agent sees that response. Requests go through the gate; replies are not filtered.
Is Sallyport a Claude Code plugin?
No. It is a Mac app with an MCP shim, so it works with any MCP client and there is nothing to update when Claude Code updates.
What about Cursor, Codex, and the rest?
Same mechanism, since they all speak MCP. Claude Code is what we test against most, and Cursor and Codex are in the regular rotation.
Let it skip every prompt. It still cannot read your keys.
Free download. Apple Silicon, macOS 14 or newer. No account, ever.
$
brew install --cask olegsotnikov/tap/sallyportmacOS 14+ · Apple Silicon