Onyx Credential Vault
Notarization pending
onyx.lovinka.com▮

FixIt internal · credential infrastructure

Install Onyx

The encrypted vault for credentials, API tokens, and AI-safe secret use. Your agents borrow secrets at run time — they never see the values.

01Downloads3

Vault

Mac app

Create or unlock your encrypted vault, approve sensitive actions with Touch ID, and sync ciphertext with the Onyx server.

Download Onyx for macOS

Bridge

MCP server

The local stdio server that lets AI tools use Onyx refs without putting token values into chat history. Ships on npm as @lovinka/onyx-mcp — the launcher fetches the signed native build and verifies its SHA-256.

claude mcp add --scope user onyx -- npx -y @lovinka/onyx-mcp
Download onyx-mcp zip

Autopilot

AI setup files

Give these to Codex, Claude Code, or another assistant so it installs the app and MCP without asking for secret values.

AI install prompt Claude MCP JSON

02Access tiers3

Every secret picks its exposure — three tiers govern what an AI agent can do with each item in your vault, the same color language the app uses everywhere.

AI-Usable

injectable

Agents can use this value at run time. It’s injected server-side and never shown to the model.

Gated

human_gated

Visible to agents as metadata only. Revealing the value requires your Touch ID approval.

Hidden

ai_hidden

Invisible to every agent. This secret never leaves your vault through the MCP.

03Install steps4

  1. Download and open the macOS app. On first launch, create or unlock your vault and connect it to onyx.lovinka.com.
  2. Install the MCP server from npm: claude mcp add --scope user onyx -- npx -y @lovinka/onyx-mcp (Claude Code), or npm i -g @lovinka/onyx-mcp for other clients. Prefer a fixed binary? Download the zip, unzip it, and move the whole folder to /Applications/Onyx MCP (command path /Applications/Onyx MCP/onyx-mcp).
  3. Add the Onyx MCP config to your AI client — command npx, args ["-y", "@lovinka/onyx-mcp"]. The MCP server talks to the running Onyx app through the local owner-only socket.
  4. Store credentials in Onyx and choose the AI access tier per item: injectable, Touch ID gated, or AI hidden.