Make API keys worthless to steal.

Your key is split on disk and rebuilt only inside a local proxy, under a spend cap you set. It's an HTTP proxy, so it works with any language — no Python toolchain required.

Install and start the proxy What each path gives you GitHub

Install

This is the path that protects your keys — it installs the CLI and starts the proxy:

curl -sSL https://worthless.sh | sh && worthless

Worthless is an HTTP proxy, so it works with any language. No Python toolchain required.

What just happened: your key was split in two, the proxy came up on 127.0.0.1:8787, and the matching *_BASE_URL in your .env now points at it — so your existing code routes through the spend cap with no code change.

Check it:

worthless status

It reports whether the proxy is running and which keys are protected.

Already use Python tooling? pipx install worthless installs the same CLI — see the solo-dev guide. Also: Docker · GitHub Actions.

Already running? Add editor controls

These add four management tools — status, scan, lock, spend — to your AI editor. They do not route your keys. The CLI proxy above has to be running for keys to route. What each path gives you →

Cursor

One click: Add to Cursor — adds the 4 tools to Cursor’s MCP panel. Does not route keys; the CLI proxy must be running. What’s this? →

VS Code

One click: Install in VS Code — adds the same 4 tools. Key routing still comes from the CLI proxy.

Claude Code

Registers the 4 tools as an MCP server. Your calls route only while worthless is running.

claude mcp add worthless -- npx -y worthless-mcp

Claude Desktop

Add the npx worthless-mcp block to your MCP config — one-click bundle coming. Read and control only; the CLI proxy does the protecting. Steps →

The editor paths run npx worthless-mcp, whose 4-tool mount is proven in CI (WOR-809). Cursor and Claude Code were additionally verified by hand on macOS; Windsurf is unverified.

How it works

Three invariants. No exceptions.

Client-side splitting. Your key is split on your machine. The server only ever sees half.
Gate before reconstruction. Budget exceeded? The key never forms. Zero provider calls.
Direct upstream. The reconstructed key calls the LLM provider directly. It never returns to the proxy.

Read the security model and wire protocol for the full picture.