Solo dev
pipx install worthless. Done in 90 seconds.
Make API keys worthless to steal.
Split-key proxy with hard spend caps. Leaked .env? Useless.
Pick how you install
Docker
Signed multi-arch image from GHCR. No build.
Claude Code, Cursor, Windsurf
MCP server. Point your editor’s SDK at the proxy.
GitHub Actions
Protect keys during CI runs. Scan for leaks.
How it works
Three invariants. No exceptions.
- Client-side splitting. Your key is split on your machine. The server only ever sees half.
- Gate before reconstruction. Budget exceeded? The key never forms. Zero provider calls.
- Direct upstream. The reconstructed key calls the LLM provider directly. It never returns to the proxy.
Read the security model and wire protocol for the full picture.