Features

Keep credentials out of the agent environment

For built-in HTTP and SSH, Sallyport authorizes the operation, talks to the target itself, and attaches the credential only inside the app. The agent gets the result, not the key. The exact boundary is written down in the security model.

Runs on your MacNo Sallyport accountNo cloud control planeHTTP · SSH · upstream MCP

Request path

Built-in HTTP and SSH keep request and credential paths separate

The request names an operation and target. Sallyport checks the live process, applies the authorization ladder, writes a durable intent, and only then hands the operation to the HTTP or SSH executor.

You

Click or Touch ID when required

Local Sallyport boundary

Agent processOperation, target, and payload

Live process identity

Authorization ladder

Durable audit intent

HTTP or SSH executor

Encrypted vaultCredential supplied internally

Requested / configured targetHTTP URL or configured SSH host

operation requestinternal credential pathagent-visible tool resultstored credential is not intentionally added

An agent asks Sallyport to perform a built-in HTTP or SSH operation. Sallyport verifies live process identity, applies approval controls, writes a durable audit intent, and sends the operation to the channel executor. The vault supplies the credential to that executor. The target result is returned without content inspection or rewriting and may contain sensitive data.

Execution channels

Each admitted invocation uses one gate

HTTP, SSH, remote MCP, and local stdio have different trust boundaries. Their tool invocations pass through the same vault, approval, lifecycle, and audit checks.

HTTP

http.request → method + URL + body

For a matching host and path, Sallyport can attach bearer, basic, custom-header, AWS SigV4, or OAuth2 client authentication. A request without a match runs without credentials.

Credentialed requests do not follow redirects. Uncredentialed requests may follow a bounded same-host, same-port chain without an HTTPS downgrade. Results and errors are returned within size limits without content inspection and may contain sensitive data.

SSH

ssh.exec → host + visible command

The app signs authentication requests for the stateless sp-ssh helper. The private key stays in Sallyport.app, and the helper can return a recording for the app to seal.

The default accept-new policy records the first host key and rejects later changes; strict mode requires a known key. Returned SSH output and sealed recordings can contain sensitive data.

Remote MCP

server.tool → typed arguments

Sallyport calls the remote server over streamable HTTP and attaches its configured API key or OAuth 2.1 token. That server is the authorized credential recipient.

The server is a trusted credential recipient. Tool results, errors, and authenticated catalog metadata are returned without credential-content filtering, subject to documented size and description limits, and may contain credentials or other sensitive data.

Local stdio MCP

server.tool → typed arguments

The child receives bound credentials in its environment and inherits Sallyport's process environment. Treat the server code and its dependencies as trusted.

A non-per-call child can stay warm until lock, reconfiguration, or app exit. A per-call child starts after approval for one invocation, then stops.

Remote streamable HTTP MCP

Local stdio MCP

Agent invocation

Invocation gateIdentity, approval, durable intent

Authenticated requestStreamable HTTP

Remote MCP serverTrusted recipient of API / OAuth credential

configured API key / OAuth tokenauthenticated initialize + tools/listmetadata bypasses invocation audit; returned as received

Agent invocation

Invocation gateIdentity, approval, durable intent

Local stdio childReceives bound secrets + inherited app environment

Vault lifecycleReady, lock, reconfigure, exit

credentials enter child environmentnon-per-call: may stay warmper-call: approve, start, invoke, stoptrust the upstream server code and dependencies

For remote MCP, an admitted invocation passes through Sallyport, which attaches API or OAuth authentication to the remote request. The remote server is a trusted credential recipient. Tool results, errors, and authenticated catalog metadata are returned without credential-content filtering, subject to documented size and description limits, and may contain sensitive data. Initialization and catalog metadata still return outside the invocation ladder. For local stdio MCP, the child receives bound credentials and the app environment. Non-per-call children may remain warm while the vault is ready; per-call children run once after approval.

Hard limit: initialize and tools/list manage the upstream catalog outside the invocation ladder. Sallyport does not apply credential-content filtering; documented size and description limits still apply. Tool names, descriptions, and schemas remain arbitrary upstream-controlled content and may contain sensitive data.

Authorization

One fixed path for every admitted tool invocation

There is no user-authored policy language. Initialization and catalog discovery are management traffic, not admitted invocations, and do not receive invocation intent rows.

01 · state

Require a ready vault

Locked, unlocking, or quarantined vaults deny agent actions. Locking also clears sessions, pending approvals, credential requests, and stdio MCP processes.

deny or continue

02 · resolve

Resolve the target and credential

Sallyport rejects calls whose required target or credential metadata cannot be resolved.

deny or continue

03 · per call

Ask for every use when flagged

A key or upstream marked for per-call approval requires a click or Touch ID, even inside an approved or allowlisted session.

ask or continue

04 · process

Check session, allowlist, or observe mode

A live session binds PID and kernel start time to executable and code-signing data. It admits that process, not each package or byte source. An allowlist match skips only the session card.

ask or continue

05 · intent

Write before the side effect

Every tool invocation requires a durable encrypted audit intent before its executor runs. If that write fails, the operation does not start.

deny or execute

06 · result

Execute and close the row

Sallyport runs the channel, attempts to append the result row, and returns the bounded executor result without content inspection or rewriting. Results may contain sensitive data.

return result

The ladder and audit intent cover tool invocation, not upstream initialization or catalog discovery. A lifecycle change before execution denies admission. A change during execution discards the result but cannot undo a completed side effect.

Vault and journal

Secrets and evidence use separate paths

The vault opens through a hardware-gated key. The audit journal can accept encrypted rows while the vault is locked, but reading them still requires unlock.

unlock and record decryption

write-blind audit path

Secure EnclaveTouch ID-gated P-256 key

Sealed vault identity

Vault DEK

Encrypted recordsDerived key and authenticated context per record

Intent + result

ECIES-sealed rows

Signed hash chain

Signed local checkpoint

Audit public key

chain + checkpoint verification

The Secure Enclave key opens a sealed vault identity, which unwraps the data-encryption key used for encrypted records. Separately, an audit public key seals intent and result rows. The signed ciphertext chain detects edits, reordering, internal gaps, and signer substitution. A separate signed local checkpoint detects rollback behind that checkpoint.

01 · No reveal or export: Sallyport has no credential reveal, export, or recovery route. Lost vault keys require reissuing the credentials at their providers.
02 · Encrypted metadata: Names, providers, host bindings, SSH inventory, and settings are sealed along with secret values.
03 · Defined rollback boundary: The chain detects edits, reordering, internal gaps, and signer substitution. The local checkpoint detects rollback behind it; a post-checkpoint tail can be lost after an unclean shutdown. A complete local rollback needs an off-device witness.

Install Sallyport

Install the signed Mac app, add a credential, and connect your MCP client.

$brew install --cask olegsotnikov/tap/sallyport

Download for Mac

macOS 14+ · Apple Silicon