Blindkey v1.0.0 — local-first credential broker for AI agents

Blindkey v1.0.0 — the first tagged release under the Blindkey name: a local-first credential broker your AI agents can use but never see. No server, no account, one encrypted file. 66 testable security constraints, Rust.

Full, itemized changes: see CHANGELOG.md. Highlights: the Vault→Blindkey rename + AI-agent repositioning, the blindkey mcp server (status-only broker for Claude Code / Cursor), cross-platform CI (macOS · Linux · Windows-core · audit · reproducible), and a full supply-chain + legal/compliance pass.

Install (verify the checksum first)

Download the binary for your platform plus SHA256SUMS.txt, then verify just your file:

# example: Linux x86_64 — swap FILE for your platform's asset name
FILE=blindkey-x86_64-unknown-linux-gnu
curl -LO "https://github.com/leocelis/blindkey/releases/download/v1.0.0/$FILE"
curl -LO https://github.com/leocelis/blindkey/releases/download/v1.0.0/SHA256SUMS.txt
grep "$FILE" SHA256SUMS.txt | shasum -a 256 -c -    # expect: <FILE>: OK
chmod +x "$FILE" && sudo mv "$FILE" /usr/local/bin/blindkey

⚠️ macOS: not notarized yet

The macOS binaries are not Apple-notarized in this release, so Gatekeeper will block them on first run ("unidentified developer"). After downloading, clear the quarantine flag on the file you got:

xattr -d com.apple.quarantine ./blindkey-*-apple-darwin

Or build from source: cargo install --git https://github.com/leocelis/blindkey --tag v1.0.0 --locked blindkey-cli

Status

Functional; on-disk format v1 stable. Not yet independently third-party audited — keep a backup of anything you store. See SECURITY.md.

---

Thanks to @jgm972 for contributions (PR #11).

v0.1.0-alpha.3 — OSS launch sweep

Pre-alpha OSS launch. CP-5 closed (stanzas + headless exit 7). Docs aligned with code. Minimal CI on push.

Install (macOS x86_64): verify SHA256SUMS.txt, chmod +x, move to PATH.

Not audited. Format may change before 1.0.

This release

• vault stanzas list|add|remove (C21)
• Headless vault get refuses with exit 7 when no clipboard (C27)
• Constraint index honesty; README release-first install
• Free-tier CI: fmt + clippy + tests

CHANGELOG

v0.1.0-alpha.2 — first public OSS release candidate

Pre-alpha open-source launch. Functional CLI + desktop GUI; 60/60 security constraints PASS.

Install (macOS x86_64): download vault-x86_64-apple-darwin, verify SHA256SUMS.txt, chmod +x and move to PATH.

Build from source: see README — ./scripts/setup-rust.sh && ./scripts/install.sh

Verify: docs/VERIFYING_RELEASES.md

Not audited. On-disk format may change before 1.0. Keep your own backup.

Highlights

• Zero-plaintext local-first vault for the AI era
• Argon2id + XChaCha20-Poly1305 STREAM + age-style multi-stanza envelope
• Model-blind clipboard delivery, 60 falsifiable constraints with tests
• CLI, TUI, and egui desktop app on shared vault-core

Full changelog: CHANGELOG.md