Blindkey v1.0.0 — the first tagged release under the Blindkey name: a local-first credential broker your AI agents can use but never see. No server, no account, one encrypted file. 66 testable security constraints, Rust.
Full, itemized changes: see CHANGELOG.md. Highlights: the Vault→Blindkey rename + AI-agent repositioning, the blindkey mcp server (status-only broker for Claude Code / Cursor), cross-platform CI (macOS · Linux · Windows-core · audit · reproducible), and a full supply-chain + legal/compliance pass.
Install (verify the checksum first)
Download the binary for your platform plus SHA256SUMS.txt, then verify just your file:
# example: Linux x86_64 — swap FILE for your platform's asset name
FILE=blindkey-x86_64-unknown-linux-gnu
curl -LO "https://github.com/leocelis/blindkey/releases/download/v1.0.0/$FILE"
curl -LO https://github.com/leocelis/blindkey/releases/download/v1.0.0/SHA256SUMS.txt
grep "$FILE" SHA256SUMS.txt | shasum -a 256 -c - # expect: <FILE>: OK
chmod +x "$FILE" && sudo mv "$FILE" /usr/local/bin/blindkey⚠️ macOS: not notarized yet
The macOS binaries are not Apple-notarized in this release, so Gatekeeper will block them on first run ("unidentified developer"). After downloading, clear the quarantine flag on the file you got:
xattr -d com.apple.quarantine ./blindkey-*-apple-darwinOr build from source: cargo install --git https://github.com/leocelis/blindkey --tag v1.0.0 --locked blindkey-cli
Status
Functional; on-disk format v1 stable. Not yet independently third-party audited — keep a backup of anything you store. See SECURITY.md.
