FixIt internal · credential infrastructure

Install Onyx

The encrypted vault for credentials, API tokens, and AI-safe secret use. Your agents borrow secrets at run time — they never see the values.

One line in Terminal installs the app, the MCP server and your AI client configs:

curl -fsSL https://onyx.lovinka.com/downloads/install.sh | bash

01Downloads3

Vault

Mac app

Create or unlock your encrypted vault, approve sensitive actions with Touch ID, and sync ciphertext with the Onyx server.

Download Onyx for macOS

Bridge

MCP server

The local MCP server — one launchd agent per Mac serving MCP 2026-07-28 at http://127.0.0.1:3212/mcp — that lets AI tools use Onyx refs without putting token values into chat history. The one-line installer sets it up; standalone, @lovinka/onyx on npm fetches the signed native build, verifies its SHA-256, starts the service and writes your client configs. No Node? Use the zip.

npx -y -p @lovinka/onyx onyx-mcp

Download onyx-mcp zip

Autopilot

AI setup files

Give these to Codex, Claude Code, or another assistant so it installs the app and MCP without asking for secret values.

AI install prompt Claude MCP JSON

02Access tiers4

Every secret picks its exposure — four tiers govern what an AI agent can do with each item in your vault, the same color language the app uses everywhere.

AI-Usable

injectable

Agents can use this value at run time. It’s injected server-side and never shown to the model.

Network-bound

network_bound

Agents use it freely while your Mac stays on the network you unlocked on. After the network changes, the next use asks for Touch ID once. The default for new secrets.

Gated

human_gated

Visible to agents as metadata only. Revealing the value requires your Touch ID approval.

Hidden

ai_hidden

Invisible to every agent. This secret never leaves your vault through the MCP.

03Install steps4

Run curl -fsSL https://onyx.lovinka.com/downloads/install.sh | bash in Terminal. It installs the app and the MCP server as a launchd agent (npm launcher when Node can reach it, else the zip), then writes your Claude Code / Codex configs. Idempotent — re-run it to repair.
In the Onyx window that opens: First Mac: enter a master passphrase → Create vault → save the recovery code (and escrow phrase) → Continue to vault → toolbar Connect → enter a handle → approve Touch ID to create your passkey. Another Mac already has your vault: first make sure Onyx on the first Mac is updated (re-run the installer; it quits and reopens Onyx) and has reached Synced once since, then choose Restore an existing vault from the server with your account handle (exact, case-sensitive), your master passphrase, recovery code or escrow phrase, and the passkey iCloud Keychain synced to this Mac on the same Apple ID — never create a second vault or connect with the same handle.
MCP by hand instead: npx -y -p @lovinka/onyx onyx-mcp (Node 20+), or download the zip, move the whole folder to /Applications/Onyx MCP and run install-mcp-service.sh --bin "/Applications/Onyx MCP/onyx-mcp". Either way every client talks to http://127.0.0.1:3212/mcp with the bearer token copied from ~/Library/Application Support/Onyx/mcp-http-token — never paste it. Other clients: type http, that URL and an Authorization: Bearer <token> header, MCP 2026-07-28.
Store credentials in Onyx and choose the AI access tier per item: injectable, network-bound (the default), Touch ID gated, or AI hidden.