homebrew-locksmith 🔐

[!IMPORTANT] This tap has migrated to bonjoski/tap
Locksmith is now distributed alongside the entire Bonjoski sovereign AI agent security fabric (Fabrial, Aegisbox, Airlock, Argus, Shield, Conjoiner, and Locksmith) in the unified tap.

brew untap bonjoski/locksmith
brew tap bonjoski/tap
brew install bonjoski/tap/locksmith

The official Homebrew Tap for Locksmith — a secure, biometric-protected keychain vault for macOS.

This tap distributes:

1. locksmith: The primary CLI and Model Context Protocol (MCP) server.
2. summon-locksmith: The official Summon provider, allowing seamless biometric-gated secrets injection into your development and DevOps processes.

[!TIP] Why use Homebrew?
Installing via Homebrew is the recommended distribution method for macOS. It downloads pre-built, cryptographically signed binaries compiled in a hardened environment, ensuring maximum compatibility with macOS security policies (Touch ID access, sandboxing, and Keychain access group restrictions).

🚀 Installation

Tap the repository and install the formula:

# Tap the repository
brew tap bonjoski/locksmith

# Install Locksmith & its Summon provider
brew install locksmith

🔍 Troubleshooting Tap Issues

If your local Git configuration enforces SSH connections globally, you might encounter a Permission denied (publickey) or authentication prompt when tapping. You can bypass this temporary restriction for the install command:

GIT_CONFIG_GLOBAL=/dev/null brew tap bonjoski/locksmith

🛠️ Verification

Ensure both the core CLI and the Summon provider are installed correctly and match the active version:

# Verify the core Locksmith CLI
locksmith --version

# Verify the Summon Provider extension
summon-locksmith --version

Both should return the active version (e.g., v${VERSION}).

💡 Quick Start

Here's how to quickly get started with Locksmith on macOS:

1. Store a Secret

Add a secret to your secure macOS Keychain. By default, secrets are biometric-protected:

locksmith add my-service my-secret-value --expires 30d

2. Retrieve a Secret

This will trigger a native Touch ID/Apple Watch prompt on your Mac before retrieving the secret:

locksmith get my-service

3. Inject with Summon

Use the bundled summon-locksmith provider to run commands with environment variables resolved straight from the keychain:

Create a secrets.yml file:

API_KEY: !var my-service

Execute a process securely (Touch ID will prompt to unlock the environment variables):

summon --provider locksmith -f secrets.yml env | grep API_KEY

🔒 Security & Verification

Each binary distributed through this tap is cryptographically signed and includes a SLSA level 2 attestation. You can verify the integrity of the binary locally:

# Install the GitHub CLI if you haven't already
brew install gh

# Verify the attestation directly against the release
gh attestation verify $(which locksmith) --repo bonjoski/locksmith

For more detailed configuration, MCP server setup, and advanced settings, visit the main Locksmith Repository.

🤝 Contributing

Contributions to this formula or issues regarding the

... View full README on GitHub