Keyring

A desktop vault for storing and cataloging API keys for AI model providers and MCP servers (Context7, Exa, Firecrawl, DeepWiki, Ref, Tavily, Anthropic, OpenAI, and more).

Built with Electron, React 19, TypeScript, Tailwind CSS v4, and shadcn-style components. Inter for UI text, JetBrains Mono for key material.

Features

• Enhanced key table — sortable columns (name, provider, category, date), an Environment Variable column, provider badges with identity dots, masked key previews in monospace, per-row reveal/copy/edit/delete.
• Environment variable mapping — each provider resolves to its conventional env var name(s) (e.g. Anthropic → ANTHROPIC_API_KEY; neo4j → NEO4J_URI / NEO4J_USERNAME / NEO4J_PASSWORD). The mapping table lives in src/renderer/src/lib/env-vars.ts and is extended by appending entries; unmapped providers show an API_KEY_NAME placeholder.
• Add key modal — label, provider picker (curated catalog + custom), category picker (presets + custom; new categories persist and reappear), secret paste, optional notes. Ctrl+N opens it; Ctrl+F focuses search.
• Categories — built-in "AI Provider", "MCP Server", "General Service" plus user-defined ones, with a toolbar filter alongside the provider filter.
• Provider data — attach an API key creation link, documentation link, and GitHub repository to any provider. Saved links appear as quick actions in each row's menu (only the links that exist are shown) and open in the system browser.
• Encrypted at rest — secrets are encrypted with Electron safeStorage (Windows DPAPI / macOS Keychain / libsecret) before they touch disk (%APPDATA%/keyring/vault.json). The status bar shows the active encryption state.
• Secrets stay out of the renderer — the table only receives masked previews. Copy decrypts in the main process and writes straight to the clipboard, which auto-clears after 30 seconds. Reveal is on-demand and auto-hides after 15 seconds.
• Light & dark themes with native title-bar overlay color sync.

Development

npm install
npm run dev        # launch with HMR
npm run build      # production bundles to out/
npm run typecheck  # strict TS across main, preload, and renderer

First launch seeds four clearly-fake sample entries so the table isn't empty — delete them and add your own.

scripts/capture.mjs is a dev utility that screenshots the running app via the Chrome DevTools Protocol (requires launching with --remote-debugging-port=9222).

Architecture

src/
├── main/        # Electron main process: window, CSP, vault storage, IPC handlers
├── preload/     # contextBridge — the only API surface exposed to the UI
├── shared/      # Types shared across all three processes
└── renderer/    # React UI (sandboxed, no Node access)
    └── src/
        ├── components/ui/   # shadcn-style primitives
        ├── components/      # feature components (table, dialogs, status bar)
        ├── hooks/           # theme management
        └── lib/             # provider catalog, utilities

Security posture: contextIsolation: true, sandbox: true, nodeIntegration: false, strict production CSP, navigation/window-open guards, single-instance lock.