API key security for Claude Code · Cursor · Windsurf · Codex

Let AI coding agents use APIs. Keep provider keys out of their context.

Phantom is an open-source, local-first credential boundary. It moves managed project secrets behind value-blind phm_ placeholders, then injects route-owned credentials through an authenticated local proxy for explicitly supported HTTP routes.

Choose macOS, Windows, or LinuxStar Phantom on GitHub
MIT licensedRust sourceRelease v0.7.8Six native targetsSHA-256 manifestSPDX SBOMsThreat model
Open the repository and star Phantom

17 provider identities in Phantom's closed trusted-route registry

OpenAIOPENAI_API_KEY=phm_a8f2c4d9
xAIXAI_API_KEY=phm_4a91c70b
MistralMISTRAL_API_KEY=phm_b6c1f827
ReplicateREPLICATE_API_TOKEN=phm_e8c40b71
Hugging FaceHUGGINGFACE_API_KEY=phm_c0478ab2
SupabaseSUPABASE_SERVICE_ROLE_KEY=phm_4f1c8ae3
StripeSTRIPE_SECRET_KEY=phm_2ccb5a91
ResendRESEND_API_KEY=phm_f1a82b57
GitHubGITHUB_TOKEN=phm_99a8d2bf
AnthropicANTHROPIC_API_KEY=phm_e1b773c0
GeminiGEMINI_API_KEY=phm_38d2e6a4
PerplexityPERPLEXITY_API_KEY=phm_05fa9d3e
CohereCOHERE_API_KEY=phm_6d213fa4
CloudflareCLOUDFLARE_API_TOKEN=phm_ae15f627
PineconePINECONE_API_KEY=phm_b71204e5
TwilioTWILIO_AUTH_TOKEN=phm_9d4b3e12
SendGridSENDGRID_API_KEY=phm_2940bf16

A registry entry defines an available exact HTTP route, not automatic setup, endorsement, or support for every provider operation. Some routes require explicit configuration; unsupported destinations and protocols fail closed. Phantom is not a sandbox, and upstream traffic still reaches the provider.

Your stack, without the plaintext

Every logo has a defined place in the boundary.

Phantom can move detected project secrets into a local vault and leave managed placeholders behind. The trusted-route identities are above; these rows cover selected editor/deployment credentials and additional vaulting examples, so visual breadth never becomes a support claim.

Selected editor, source-control, and deployment credentials
CursorCURSOR_API_KEYphm_77b3e5f1
WindsurfWINDSURF_API_KEYphm_1c9e2a40
VercelVERCEL_TOKENphm_d9f1c102
RailwayRAILWAY_TOKENphm_8b4d6f93
GitHubGITHUB_TOKENphm_99a8d2bf
Additional vault-detection examples
AWSAWS_SECRET_KEYphm_5e2a8d61
GCPGCP_API_KEYphm_c7f9b203
PostgresDATABASE_URLphm_3a2e7c81
MongoDBMONGODB_URIphm_6e0fb529
NeonNEON_API_KEYphm_aa9d34f0
UpstashUPSTASH_REDIS_TOKENphm_3fc0e851
SlackSLACK_BOT_TOKENphm_71e0d493
DiscordDISCORD_BOT_TOKENphm_e74cb201
ClerkCLERK_SECRET_KEYphm_8af216c3
PostHogPOSTHOG_API_KEYphm_d2bf1e95
SentrySENTRY_AUTH_TOKENphm_3187a4d0
DatadogDATADOG_API_KEYphm_f5e290bc
DockerDOCKER_TOKENphm_b5817d4c
NotionNOTION_API_KEYphm_d04c1f86
LinearLINEAR_API_KEYphm_e2f37a91
FigmaFIGMA_TOKENphm_82bd5a14

Logos identify products, not endorsement. Exact-route registry entries can still require explicit configuration. Detection depends on the key name or value shape; vaulting, client setup, deployment sync, and runtime injection remain separate capabilities.

The visible change

The workflow stays familiar. The values move out.

One local command stores detected values in the selected vault and atomically rewrites managed dotenv entries. These examples are synthetic; no provider credential appears in this page or its source.

.envBefore
OPENAI_API_KEY=example-redacted-openai-value
ANTHROPIC_API_KEY=example-redacted-anthropic-value
STRIPE_SECRET_KEY=example-redacted-stripe-value
GITHUB_TOKEN=example-redacted-github-value
Synthetic examples of plaintext-shaped project configuration.
.envAfter phantom init
OPENAI_API_KEY=phm_a8f2c4d9e1b7
ANTHROPIC_API_KEY=phm_2ccb5a91f604
STRIPE_SECRET_KEY=phm_491e6dc8a273
GITHUB_TOKEN=phm_99a8d2bf17e0
Agents and application processes receive managed placeholders.
Current local workflowSynthetic trace
  1. phantom initMoves detected values into the selected local vault.
  2. phantom setup --client codexPreviews then writes Codex's local MCP entry.
  3. phantom exec -- codex "<your task>"Starts the agent through the supervised local session.

One project, three separate surfaces

Codexvalue-blind tools
Phantomlocal boundary
GitHubplaceholder diff

Codex sees managed names and status. GitHub can receive a diff with aphm_ placeholder—not a copied provider credential.

Follow one request without following the key.

This synthetic OpenAI trace shows the active local proxy boundary. It is an explanatory example, not a live event or an externally trusted attestation.

A value-blind agent request passes through an authenticated, configured route and returns only after response credential material is inspected and redacted when detected.

  1. Agent sends intent

    Provider value absent

    POST /openai/_phantom/[session]/v1/responses
    Fresh session placeholder
    OPENAI_API_KEY=phm_a8f2…
    Request body
    Bounded, then forwarded byte-for-byte
    Placeholder handling
    Never resolved from client headers or body

  2. Authenticated loopback

    Bounded route

    127.0.0.1 → TLS upstream
    • Fresh proxy bearer authenticates this local session
    • Built-in service prefix selects the configured HTTPS host
    • Client control of the route auth header is discarded
    • Route-owned credential is injected only into that fixed header

  3. Agent receives scrubbed bytes

    Leak intercepted in this example

    {
  "id": "resp_example",
  "debug": "[REDACTED:vault-secret]"
}
    response
    identity bytes inspected
    location
    body
    pattern
    vault-secret
    matches
    1

    No credential value is shown in this synthetic trace.

Invalid bearers, unknown service definitions, missing route credentials, oversized request bodies, and encoded upstream responses fail before normal forwarding.

First passage

Install on your OS. Then protect one project.

The output below is illustrative output. Ports, routes, vault backends, and local findings vary by machine and configuration. Direct downloads use the exact v0.7.8 GitHub release assets linked in the repository.

macOS

Keychain when available

Uses Keychain when available. The verified source installer auto-detects Apple Silicon or Intel.

Apple Siliconarchive v0.7.8SHA-256 sidecar
Intelarchive v0.7.8SHA-256 sidecar
Download, verify, install, and check both binariesView exact installer source

The release is not notarized. Inspect the pinned script and verify its checksum before any policy-dependent unblock.

Windows

Credential Manager when available

Uses current-user Credential Manager when available. PowerShell selects ARM64 or x64.

ARM64archive v0.7.8SHA-256 sidecar
x64archive v0.7.8SHA-256 sidecar
Download, verify, install, and check both binariesView exact installer source

Windows archives are not Authenticode-signed. Unblock only after checksum verification and only when local policy permits it.

Linux

Keyutils initially

Published GNU targets enforce a glibc 2.35 symbol ceiling; musl and Alpine are not published.

ARM64archive v0.7.8SHA-256 sidecar
x64archive v0.7.8SHA-256 sidecar
Download, verify, install, and check both binariesView exact installer source

The default keyutils vault is session-persistent, not reboot-persistent. Desktop users can migrate to Secret Service; headless environments need a managed passphrase for the encrypted-file backend.

Every archive is produced by the release workflow with native smoke tests, an SPDX SBOM, and a published SHA-256 manifest. That evidence covers the release artifact—not every local shell, policy, or credential-store state. The command panels download the installer source from the exact v0.7.8source commit, verify the fixed script digest, and only then execute the local file. The scripts verify the selected archive's adjacent checksum, exact two-binary shape, and versions before promoting it into a user-owned install directory. The Linux encrypted-file path needs its managed passphrase configured before phantom init; keep that passphrase out of agent process inheritance. Review the full platform installation guide and the pinned script before running it. The retired phm.dev/install.* endpoints remain non-executable until a matching public release is independently accepted.

  1. Verify both v0.7.8 binaries

    After the platform-specific install, confirm that the CLI and MCP server report the pinned public version.

    illustrative receipt
    phantom 0.7.8
phantom-mcp 0.7.8

  2. Protect one supported project

    From an owned Git repository, keep an independent provider recovery copy and begin with a supported HTTP API key—not a database connection string.

    illustrative receipt
    vault write completed
managed dotenv rewritten
no plaintext project backup

Client connection

Put the value-blind tools where agents work.

After installing both pinned v0.7.8 binaries, preview the supported client's local MCP entry before writing it. Setup uses a local Phantom runtime and has no network package-runner fallback.

Read the complete installation and verification guide
Writes
.claude/settings.local.json
Scope
project
Runtime
installed local binary

Preview the exact MCP entry. This command does not write the client configuration.

After review, apply the same client choice from a trusted terminal.

Inspect the written file before restarting Claude Code. Registration does not activate cloud service or production execution authority.

Restart Claude Code, verify the local boundary, then launch that same client through the supervised proxy session.

The trust boundary

A narrow passage, not ambient secret access.

Phantom addresses one specific risk: credentialed HTTP work in supported agent workflows. Files, unmanaged processes, user permissions, and unsupported protocols remain outside this boundary.

Agent contextIntent and placeholderAuthorization: phm_a8f2…POST /v1/responses
127.0.0.1route gatedeny by default
Credential planeVault and fixed mappingsecret: OPENAI_API_KEYheader: Authorization

What may cross

  • Method, path, bounded body, and ordinary request data
  • A fresh proxy bearer held by the launched child process
  • The configured route's fixed authentication header, after admission

What does not cross

  • Provider credential values in the managed agent context
  • Client authority to choose which secret or auth header is injected
  • Placeholder substitution in request headers or bodies

Operator surface

Small commands. Explicit effects.

The CLI, local proxy, vault, and MCP server are open source. Each surface reports what it can do and keeps consequential actions behind their own confirmation or trusted-terminal boundary.

Protectphantom init

Moves detected values into the selected local vault, then atomically rewrites managed dotenv entries as phm_ placeholders.

Delegatephantom exec -- <agent>

Launches a child with fresh session placeholders, a separate proxy bearer, and supported SDK base-URL overrides.

Connectphantom setup --client <name>

Writes local MCP configuration for Claude Code, Cursor, Windsurf, or Codex and fails closed when no local runtime is available.

Inspectphantom check --staged

Checks staged dotenv content and added lines in other staged files for a bounded set of credential prefixes.

Explainphantom agent report --json

Reports value-blind readiness evidence for the current project without turning that report into execution authority.

Auditphantom audit verify

Verifies the local HMAC chain and checkpoint against the machine-local audit state; it is not an external attestation.

Why not just use what you have?

Phantom addresses a narrow boundary: supported agent-driven HTTP requests can use configured credentials without placing provider values in the agent's dotenv context. This compares Phantom's managed path with giving an agent a plaintext dotenv value; it is not a vendor feature benchmark.

Boundary comparison: Phantom's managed path versus direct plaintext dotenv access.
CapabilityPhantomPlaintext agent .env
Value-blind managed agent pathYesNo
Open sourceYes—
Local-first vaultYes—
MCP-native (supported clients)YesNo
Staged dotenv and prefix checksYesNo
Fresh proxy authorization per exec sessionYes—
Configured-upstream boundary for supported HTTP routesYesNo

Built for humans and coding agents

Documentation with an evidence trail.

Start with the supported path, then inspect the source, threat model, platform matrix, and release receipts. Machine-readable summaries at llms.txt and llms-full.txthelp coding agents retrieve the same boundaries.

Start with one project

Install a pinned public release, verify its receipt, protect one project, inspect the boundary, and launch a supported client.

Open the quickstart

Connect your coding agent

Exact setup paths for Claude Code, Cursor, Windsurf, and Codex, including the files each command writes.

Choose an agent guide

Audit the security model

Read the trust boundary, attacker assumptions, residual risks, disclosure path, and release evidence.

Review security

Adopt with a team

Evaluate local workflows first, define acceptance evidence, and keep hosted commissioning separate.

Plan an evaluation

Evidence before assurance

Inspect the proof. Keep the claims bounded.

Source, tests, a release receipt, a deployed service, and an accepted organizational control prove different things. Phantom's public documentation keeps those gates separate.

Release supply chain

Exact archives, checksums, SPDX SBOMs, and provenance verification contracts

Review release evidence

Adoption decision

A bounded pilot, named owners, acceptance criteria, and separate activation gates

Plan an evaluation

Enterprise and public sector

Adopt the open core. Scope the rest in writing.

Organizations can evaluate the MIT-licensed local product without a contract. Hosted, team, deployment, procurement, support, and public-sector requirements are available for bounded evaluation by written agreement with Ashlr AI. No certification or authorization is represented. SSO/SAML is not shipped, and no contractual SLA is represented as active.

Scope an evaluation

Open-source core. Commercial help when you need it.

Phantom's local-first core is MIT-licensed. Organizations can separately contract for a bounded evaluation, integration work, and written support terms without surrendering those open-source rights.

Open source

$0

Use, modify, and distribute Phantom's local-first core under MIT.

  • CLI, local vault, proxy, and MCP server
  • No seat count or local-secret limit imposed by Phantom
  • Community support through GitHub
  • Self-directed deployment and validation
View the repository
Written scope

Enterprise

Scoped

Contract for evaluation, integration, and support around the MIT core.

  • Written pilot scope and acceptance criteria
  • Architecture and security-boundary review
  • Integration with named repositories and supported clients
  • Support commitments only as written in the agreement
Scope an enterprise evaluation

Government

Scoped

Evaluate a local-first workflow against a named public-sector environment.

  • Bounded technical evaluation with explicit exclusions
  • Evidence packet for the reviewed source and test scope
  • Environment-specific integration and risk review
  • Procurement and support terms only by written agreement
Discuss a government evaluation

A commercial agreement buys defined services and commitments—not permission already granted by the MIT License. No payment is collected here.

Not represented as available

No generally available Phantom Cloud service or hosted control plane · No shipped SSO, SAML, or SCIM integration · No regulatory certification, authorization, or compliance attestation · No contractual SLA unless one is expressly included in a signed agreement · No supported self-hosted enterprise control plane

Review questions

Ask where the boundary ends.

Security claims are useful only when their assumptions and failure modes are visible. For a question not covered here, open a GitHub issue or email mason@ashlr.ai.

Does Phantom slow down my AI requests?
Phantom adds a local Rust HTTP proxy bound to 127.0.0.1. Request bodies are collected under byte and time limits; response streams remain bounded and incremental. Measure overhead in your own workload before adopting it on a latency-critical path.
What does a supported child process see after phantom init and phantom exec?
Installation alone changes nothing. After successful initialization, your .env file contains phm_xxxxxxxx tokens instead of real values. In the managed workflow, supported clients read those placeholders rather than provider values from the rewritten dotenv file. phantom exec gives the child fresh placeholders and a separate proxy bearer. On an exact supported route, the proxy injects only that route's vault value into its fixed auth header; client headers and bodies never resolve placeholders. Other files and unmanaged processes remain outside that boundary. Human plaintext reveal is a separate trusted-terminal action with no noninteractive bypass.
What if a phm_ token leaks from AI logs?
A managed .env placeholder persists until you rotate it; it is not the provider credential and is not sufficient by itself to use the authenticated local proxy. phantom exec separately creates fresh session phm_ values and a fresh PHANTOM_PROXY_TOKEN for the child process. Treat a leaked placeholder as sensitive metadata and run phantom rotate.
How are real keys stored?
macOS uses Keychain Services and Windows uses Credential Manager. Current Linux desktop builds use the kernel keyring, which does not provide reboot persistence; Linux users who need durable storage should select the encrypted-file vault with a protected persistent passphrase. The file backend uses ChaCha20-Poly1305 with Argon2id key derivation. Vault retrieval uses Zeroizing<String> buffers that zero those allocations on Drop. This is defense in depth, not a guarantee that every plaintext copy is erased from process or OS memory. Phantom's managed init path writes the vault before atomically replacing dotenv values and does not create a plaintext project-local backup. Existing backups, logs, and unmanaged tools are outside that boundary.
Can the proxy be tricked into revealing the real key?
The proxy discards client control of the matched route's auth header and injects only that route's vault value there; client headers and bodies never resolve placeholders. It redacts recognized credential formats in responses. This reduces accidental exposure; it is not a substitute for provider scoping, rotation, or OS user-presence controls. Proxy session tokens use constant-time comparison.
What about secrets in HTTP request bodies, not just headers?
Client headers and bodies never resolve phm_ placeholders. Bodies are collected under explicit byte/time limits and forwarded byte-for-byte. Only an exact matched route can inject its own vault value into its fixed authentication header.
Can my team share secrets without sharing the .env?
The repository includes Pro-gated team-vault source with envelope encryption for fixed-membership pilots. Each member has their own keypair; the vault is encrypted to every member's public key, and the service path accepts ciphertext. Hosted availability still requires a commissioned Phantom Cloud deployment. Member removal and automatic vault-key rotation are not shipped, so do not treat this as an offboarding control.
What if I want to leave Phantom?
Phantom intentionally does not leave a plaintext .envbackup during init. Keep an independent provider recovery path before migrating. phantom unwrap only reverses package-script wrapping; it does not restore dotenv values. To leave, recover or rotate credentials through the provider, update your dotenv file in a trusted terminal, then remove Phantom configuration.

Start locally

Run supported API work through the local credential boundary.

Follow the install pathStar or fork on GitHub

MIT licensed · Local-first open core · Commercial evaluations by written agreement