Download

Download Sallyport

Free, with no account to create. Install with Homebrew or download the same signed, notarized app.

Homebrew

Install from the command line.

$brew install --cask olegsotnikov/tap/sallyport

Direct download

The signed, notarized DMG from sallyport.dev. The app checks for updates.

Signed and notarizedDownload for macOS

Prefer a direct download? Notarized builds are on GitHub Releases.

Requirements

Apple Silicon required

Apple Silicon (M-series)

Secure Enclave and Touch ID gate access to the vault encryption key. Intel Macs are not supported.

Touch ID · macOS 14+

Touch ID unlocks the vault. Per-call keys can require a click or Touch ID. Configuration changes can require Touch ID; settings and allowlist changes always do.

macOS 14+ · Apple Silicon

Quickstart

Set up Sallyport

Sallyport runs in the menu bar and hosts the vault in process. It does not use a separate daemon.

Install and launch

Onboarding creates the vault and enables its Touch ID gate.

brew install --cask olegsotnikov/tap/sallyport

Add a key

Store a credential and bind it to a host. Enable "Approval per call" if every use should require approval.

cloudflare → api.cloudflare.com · approval per call

Point your agent at the gate

Add the bundled MCP shim to Claude Code, Codex, Cursor, or another MCP client.

claude mcp add sallyport -- /Applications/Sallyport.app/Contents/MacOS/sp mcp

Approve the first card

The first call shows the agent's code-signing authority. Approve the run to continue; Sallyport records its actions.

From brew install to the first gated call takes about two minutes. Flag your most dangerous keys for per-call approval and let the agent work.