# Slinky

> Slinky keeps secrets out of files. A free, open-source, native Mac app (Apple silicon, macOS 15 Sequoia or later) for API keys and tokens, each project's .env variables, two-step backup codes and recovery keys. Everything is in one encrypted file on the Mac, opened with Touch ID (Secure Enclave), with a printed Recovery Key as the backup. No account, no server, no sync.

## What it does

- **Add Item (⌘N):** paste anything secret; the value turns into dots, Slinky recognizes the service (Stripe, OpenAI, Anthropic, GitHub, Supabase, Resend, AWS and more) and suggests where it goes. Warns about duplicates. Refuses crypto wallet phrases.
- **Projects:** drop a project folder; Slinky reads its .env files (read-only), sorts them into Local, Preview and Production, checks .gitignore, and uses .env.example to show what's missing. Copy an environment as .env lines, or save a names-only .env.example.
- **Recovery:** backup codes that cross themselves off when copied, low-code warnings, and recovery keys with a printed-copy reminder.
- **Quick Access (⌥⌘K):** find and copy from any app. Copies are marked private (concealed/transient), skipped by clipboard history apps, and cleared after 60 seconds.
- **Locking:** Touch ID to open; locks with the screen, on sleep, when idle, and after 12 hours.
- **Import:** 1Password .1pux or CSV (Apple Passwords, Bitwarden, a sheet of keys). Passwords are skipped.
- **Shortcuts:** Add to Slinky, Copy from Slinky (Touch ID every time; never returns the value), Open Quick Access, Lock Slinky.
- **The `slinky` command:** `slinky run -- npm run dev` injects a project's variables after Touch ID (no .env on disk); `slinky env --export`, `slinky xcconfig`, `slinky run --file NAME` (secret file as a 0600 temp file), `slinky check`, `slinky guard` (pre-commit check), an optional zsh hook that loads variables on cd. The command is the app's own signed binary; the app checks the caller's signature.
- **AI agents:** an MCP server (`slinky mcp`) for Claude Code, Cursor, Codex and Claude: list_secrets, check_env, request_secret, describe_policy. Names only, never values. Agents run commands through `slinky run`, approved with Touch ID showing the command; live keys, never-for-agents items, shells, inline code, env/printenv, curl/ssh, git push and publishing are refused. Connect in Settings › Command Line & Agents.
- **Health:** exact-match search for saved values in linked projects and their git history, Claude Code/Codex/Cursor conversations and shell history, on the Mac, names and places only; one-click fixes; keys unused for 60 days and values saved twice.
- **Apple developer files:** App Store Connect .p8 keys, certificates, service-account JSON (up to 256 KB) in the vault; save a notarytool keychain profile; app-specific passwords recognised.
- **Rotation and hosts:** "Make New Key on <service>" opens the service's key page and replaces the key wherever it's used; Send to Host pushes a project's variables to Vercel, Netlify, Cloudflare Workers/Pages or Fly.io via their CLIs (values on stdin).
- **Activity:** what was copied or used, when and by whom; names only, inside the vault.

## What leaves the Mac

Nothing about the person or their vault. Once a day Slinky asks GitHub for the latest release (can be turned off). Only if the person turns on Load icons from websites, it asks each saved website directly for its icon (no third-party icon service). Updates install in place only if signed by Slinky's developer (team B3U6BXA8KP). When the person chooses Send to Host, that host's own command-line tool sends the values they picked to that service.

## Coming next

A Raycast extension, and sync between Macs once Slinky has a Developer ID.

## Download

- Latest DMG: https://github.com/heyderekj/slinky/releases/latest
- Homebrew: `brew tap heyderekj/slinky https://github.com/heyderekj/slinky && brew install --cask slinky`
- Source (MIT): https://github.com/heyderekj/slinky
- Signed but not yet notarized: first launch needs System Settings › Privacy & Security › Open Anyway.

## Family

- Dinky makes files smaller: https://dinkyfiles.com
- Binky sorts your files: https://binkyfiles.com
- Made by Testament Made, LLC: https://testamentmade.com · derek@testamentmade.com