v0.4.0

The big distribution release. klef now ships as a single Homebrew install bundling the CLI and the macOS menu bar GUI, plus an MCP server for Claude Desktop / Claude Code.

Install

brew install slewinus/tap/klef && xattr -dr com.apple.quarantine /Applications/klef.app

That's the whole onboarding. CLI lands on $PATH, GUI in /Applications/klef.app (icon in the menu bar). Linux users: cargo install klef --features mcp.

Headline features

klef mcp — let AI agents use your keys without seeing them

A Model Context Protocol server that exposes two tools:

• klef_list — names + metadata, never values.
• klef_run — spawns a process with klef: refs injected as env vars; the agent sees the program's stdout/stderr (with best-effort redaction) but never the secret value.

Authorization is policy-driven via ~/Library/Application Support/klef/mcp-policy.toml (or ~/.config/klef/... on Linux). NDJSON audit log with pre-spawn fail-closed gate. Hard shell denylist on argv[0]. Process-group kill on timeout.

Configure Claude Desktop / Claude Code:

claude mcp add klef klef mcp        # Claude Code
# Or for Claude Desktop, add to ~/Library/Application Support/Claude/claude_desktop_config.json:
# { "mcpServers": { "klef": { "command": "klef", "args": ["mcp"] } } }

See docs/mcp.md for the full setup + threat model. Closes #24.

klef keychain configure — stop the macOS password re-prompts

If you've been getting "type your login password" prompts every 10–30 minutes, this disables the macOS keychain auto-lock timeout (one-shot, idempotent, with the exact revert command printed). klef detects the issue automatically and prints a one-time banner pointing you at the command.

klef keychain configure
# macOS keychain configured: no timeout, no lock-on-sleep.
# To revert, run:
#     security set-keychain-settings -u -t 600 -l /Users/you/Library/Keychains/login.keychain-db

See docs/macos-keychain.md. Opt-out via KLEF_NO_KEYCHAIN_AUTOCONFIG=1.

GUI improvements

• Single Homebrew install: cask klef includes both .app and CLI binary.
• New monochrome shield icon, designed to read at every size (menu bar tray, Dock, DMG installer).
• .env import file picker button (drag-drop also still works from Finder).
• Quit button in the popover header.
• Drag-drop no longer auto-hides the popover when dragging from another app.

Caveats

The macOS DMG is not yet code-signed with an Apple Developer ID — Gatekeeper will quarantine the .app on first launch. The install command above runs xattr -dr com.apple.quarantine to clear it. Proper signing + auto-update is tracked in #123.

Apple Silicon only for the GUI in this release. Intel macOS support is bundled into #123 (CI build matrix).

Distribution channels

Channel	Command	Includes
Homebrew (macOS)	brew install slewinus/tap/klef	CLI + GUI
Cargo (any)	cargo install klef --features mcp	CLI
Direct download	Releases page	DMG + tarballs

Crates published: klef 0.4.0 + klef-core 0.2.0.

Full changelog

See CHANGELOG.md and the auto-generated PR list below.

---

Auto-generated PR list:

• fix(envfile): export prefix + inline comments (#50, #51) — #56
• feat: encrypted file backend via age (#12) — #57
• fix(age-backend): metadata stored inside encrypted vault — #64
• fix: status backend, trim_end, drop stale Linux hint — #65
• fix: atomic add/rename + reverse desync detection — #67
• fix: inter-process locking on vault and index — #68
• docs: GUI app design — #66
• refactor: cargo workspace split — #70
• feat(core): DTOs for GUI/MCP API surface — #76
• feat(gui): Tauri scaffold + Svelte 5 + menu-bar tray (S2.2a/b/c) — #77 #78 #80
• feat(gui): search bar — #82
• feat(gui): MVP v0.1.0 — full CRUD + hotkey — #99
• fix(gui): modal positioning — #100
• feat(gui): open at login + Keychain access help — #121
• feat(gui): drag-drop .env import — #119
• feat(gui): UI redesign — Raycast-inspired light theme — #122
• feat(mcp): full MCP server in 14 commits — closes #24
• feat(keychain): klef keychain configure + auto-detect banner

Full diff: v0.3.0...v0.4.0