kylrix

🔐 Zero-Knowledge Secrets & Persistent Agent Memory

Kylrix establishes true zero-knowledge secret access and persistent memory for AI agents (Claude Code, Cursor, AutoGPT, CLI, VS Code, REST API, WebMCP, Discord/Telegram).

How Agent Enclave Tokens (AET) Work

An agent key looks like kyl_aet_<8 hex>_<32 b64url>.etk_<64 hex>. Only the part left of the dot ever reaches the server (it is hashed and used as the bearer credential); etk_… is a 32-byte unlock key that stays on your machine.

1. Client-Side DEK Wrapping: In Settings → Developers → Create Token, enable "Agent key with access to private items". The browser asks you to unlock your vault (MEK/Passkey PRF), generates the etkSecret, and re-wraps the DEKs of your chosen vault items and 2FA codes under an HKDF-SHA256 wrapping key (AES-256-GCM, per-entry AAD bound to the row id).

2. Envelope Storage: The server stores only the wrapped-DEK envelope in apikey.metadata.aet — it never possesses the MEK or the etkSecret, and the envelope is hidden from all public token listings.

3. Two Unlock Modes:

   • Client-side (default, zero-knowledge): the CLI/VS Code fetch the envelope via GET /api/v1/token/enclave plus sealed ciphertext via ?sealed=1 reads, and unlock locally.

   • Server-assisted (opt-in): send the full key in the X-Kylrix-Agent-Token header over https and the server decrypts granted rows in-memory for one request. Convenient, but no longer zero-knowledge — use only if you trust the server.

4. RAM Hygiene: Unlock keys live as zeroable Uint8Array buffers that are cleared after use. Decrypted field values are JS strings and cannot be wiped — references are dropped, which is an honest platform limitation.

Quick Start Examples

Claude Code / Cursor

export KYLRIX_AGENT_KEY="kyl_aet_a1b2c3d4_XXXX.etk_7f8a9b..."
kylrix agents connect --claude-code   # or --cursor, or --check to verify only

CLI Exec

Inject granted secrets transiently into a child process without leaving traces on disk:

kylrix exec --token kyl_aet_... -- "npm start"   # a specific item: kylrix exec <id> -- npm start

WebMCP & REST API

curl -X GET "https://www.kylrix.space/api/v1/vault/secret-id" \
  -H "X-Kylrix-Agent-Token: kyl_aet_..."

Related MCP server: Coding Tools MCP

⚡ Quick Connect

🎁 Contributor Program

Kylrix Pro is free forever for anyone with a merged pull request in the past 30 days.

• Automatic Activation: Sign in with GitHub. Merged PRs unlock Pro automatically.

• Perks: Free Pro tier, high-priority triage on TODO.md / ROADMAP.md, and Contributor badge (/u/username).

• Start Here: Read CONTRIBUTING.md and pick an issue or open a PR.

⚡ CLI & Local Agent Bridge (@kylrix/cli)

Install once for sovereign offline local-first execution (embedded SQLite):

npm install -g @kylrix/cli

Essential Commands

Start local stdio MCP server for Cursor / Claude Code / Windsurf:

kylrix mcp

Unlock zero-knowledge vault & inject secrets safely:

kylrix vault unlock

kylrix vault get <secret-id> --pure > .env

Auto-connect IDE agents:

kylrix connect

kylrix connect --client claude --directory ./my-project

Create sovereign local memory (embedded SQLite):

kylrix ideas create "Auth refactor design" --content "Zero-cloud agent memory"

kylrix goals create "Ship agent v1" --target 100 --unit %

Local agent execution session:

kylrix agents start "Audit auth flow" --prompt "Inspect login handlers"

Sync local offline SQLite silo to cloud or self-hosted server:

kylrix sync

kylrix login --url http://localhost:5003

📖 See docs/cli.md for full CLI docs.

🔌 MCP Server

Connect IDE agents (Cursor, Claude Code, Windsurf) in 1 click:

npx -y @smithery/cli install kylrix/kylrix

Or install skills directly:

npx skills add kylrix/kylrix --skill mcp --skill api --skill agents

In-Browser Agent Bridge (WebMCP)

Expose workspace memory directly to browser-driven AI agents (ChatGPT, Chrome AI) via navigator.modelContext:

await navigator.modelContext.executeTool('kylrix_create_idea', { title: 'Agent Idea', content: 'In-browser modelContext', tags: ['webmcp'] });

Wiring reference: docs/webmcp.md

🐳 Self-Host

Run a sovereign Kylrix instance on port :5003:

docker run -d -p 5003:3000 --name kylrix ghcr.io/kylrix/kylrix:latest

Or via Docker Compose:

git clone https://github.com/Kylrix/kylrix.git && cd kylrix

docker compose up -d

📖 See SELFHOST.md for multi-container compose & backups.

🛠️ Develop

Clone & setup:

git clone https://github.com/Kylrix/kylrix.git

cd kylrix

cp env.sample .env

Install Ota execution contract:

curl -fsSL https://dist.ota.run/install.sh | sh

Run development server:

ota doctor

ota up --workflow dev

Run lint, tests & verification:

ota up --workflow verify

🔗 Integrations & Bots

📦 Features at a Glance

💳 Pricing

❤️ Sponsor & Security

Bug Reports · Architecture · Trademark