FixIt internal · credential infrastructure

Install Onyx

The encrypted vault for credentials, API tokens, and AI-safe secret use. Your agents borrow secrets at run time — they never see the values.

One line in Terminal installs the app, the MCP server and your AI client configs:

curl -fsSL https://onyx.lovinka.com/downloads/install.sh | bash

01Downloads3

Vault

Mac app

Create or unlock your encrypted vault, approve sensitive actions with Touch ID, and sync ciphertext with the Onyx server.

Download Onyx for macOS

Bridge

MCP server

The local MCP server — one launchd agent per Mac serving MCP 2026-07-28 at http://127.0.0.1:3212/mcp — that lets AI tools use Onyx refs without putting token values into chat history. The one-line installer sets it up; standalone, @lovinka/onyx on npm fetches the signed native build, verifies its SHA-256, starts the service and writes your client configs. No Node? Use the zip.

npx -y -p @lovinka/onyx onyx-mcp

Download onyx-mcp zip

Autopilot

AI setup files

Give these to Codex, Claude Code, or another assistant so it installs the app and MCP without asking for secret values.

AI install prompt Claude MCP JSON

02Access tiers4

Every secret picks its exposure — four tiers govern what an AI agent can do with each item in your vault, the same color language the app uses everywhere.

AI-Usable

injectable

Agents can use this value at run time. It’s injected server-side and never shown to the model.

Network-bound

network_bound

Agents use it freely while your Mac stays on the network you unlocked on. After the network changes, the next use asks for Touch ID once. The default for new secrets.

Gated

human_gated

Visible to agents as metadata only. Revealing the value requires your Touch ID approval.

Hidden

ai_hidden

Invisible to every agent. This secret never leaves your vault through the MCP.

Need the full setup flow? Open /install.