Phantom

Delegate more to AI without putting real keys in agent context.

Phantom replaces project secrets with scoped phm_ placeholders. Applications use those placeholders through an authenticated local proxy, while agents use value-blind MCP tools for inventory, diagnostics, and governed requests.

Quick start · ⭐ Star Phantom · Delegate safely · Why Phantom? · MCP setup · Docs · Contribute · phm.dev

▶ Historical v0.4 demo — current behavior differs  ·  🛡 Security model  ·  📋 Threat model  ·  💬 Discussions

[!IMPORTANT] Release-state snapshot (verified 2026-09-05): the immutable v0.7.8 GitHub release at source commit f065b13462f9eaf27e0443f8911f021575b7c409. Its 19-asset release set, checksums, archive-specific SPDX SBOMs, GitHub provenance and SBOM attestations, and all six native release rows are bound to that immutable release record by tag-bound workflow 33952398697. Exact public registry endpoints were requeried on 2026-09-05. Homebrew independently publishes reviewed v0.7.8; npm latest remains 0.6.0, and the npm 0.7.4 wrappers remain quarantined under release-candidate after failed npm-channel acceptance. The GitHub receipt alone does not prove the separately verified Homebrew formula, an npm or crates.io package, MCP Registry entry, hosted-service commissioning, provider activation, signing/notarization, certification, or customer acceptance. See release readiness and platform support.

Start here

Choose the smallest path that answers your next question. The first path uses no credential, makes no network request, and does not install or configure Phantom.

Why Phantom?

AI coding agents routinely work in repositories that also contain local credentials. Once a real API key enters an agent context, transcript, tool call, or generated file, you have lost control of where that value may persist.

Traditional secrets managers focus on keys at rest and in transit. Phantom adds a boundary for agent context:

• 🔒 Reduces one credential-exposure path — managed project dotenv files contain sensitive phm_ mappings, MCP responses remain value-blind, and exact proxy routes inject their own configured authentication values. Unmanaged files, broader shell authority, and same-user processes remain in the threat model.
• ⚡ Fast local setup — after installing the reviewed v0.7.8 GitHub release, phantom init protects a project without requiring an account, DNS changes, or a custom CA.
• 🧰 Agent-native integrations — setup helpers and value-blind MCP workflows for Claude Code, Cursor, Windsurf, and Codex, plus project instructions for GitHub Copilot.
• 🦀 Open source, local-first, MIT — secrets use the native OS credential store when it is available, with an explicit encrypted-file fallback. Optional cloud sync encrypts vault payloads client-side before the server stores them.

Project status and trust boundary

Phantom's implemented user-facing surfaces are the CLI, vault, authenticated local proxy, MCP server, and optional cloud/team workflows documented below. Cloud and team behavior additionally depends on the deployed service, account plan, and provider configuration; source code alone is not deployment or customer-acceptance evidence. The conversation facade is intentionally narrow:

• phantom_do is proposal-only. It canonicalizes a closed Cargo action and reports its digest, effect, and activation blockers; execute is hard denied.
• phantom_setup_workspace can propose setup, create a bearerless request, and report authenticated status. Applying a request remains a separate trusted-terminal operation.
• Advanced MCP tools remain a compatibility catalog, disabled by default, with separate explicit confirmation and informed terminal-approval gates. They are not governed by the conversation facade's capability card.
• phantom grant retains value-blind lifecycle metadata and design-source foundations, but 0.7.8 hard-denies every live provider issuance/renewal path before credential or network access. A provider grant is not an execution-kernel authority grant, broker lease, or permission for an agent to execute work.
• The authority, broker, runtime, session, and evidence crates are inactive, fail-closed foundations. They do not establish live Locus authority, broker credentials, execute agent actions, or produce externally trusted receipts today.

See the documentation map, architecture, security policy, and threat model for the evidence behind those boundaries.

Quick Start

Install both binaries from the reviewed v0.7.8 GitHub release. The Homebrew formula separately publishes the reviewed v0.7.8 binaries:

$ brew tap ashlrai/phantom
$ brew trust --formula ashlrai/phantom/phantom
$ brew install ashlrai/phantom/phantom

For exact v0.7.8 on macOS, Linux, or Windows, use the matching release asset in Installation. Then protect and verify the project:

$ phantom init
# Auto-detects .env, .env.local, or .env in subdirectories
# Stores real secrets in the native credential store or encrypted vault,
# then rewrites .env with phantom tokens
# Auto-configures Claude Code MCP server if detected

$ phantom agent doctor
# One human-readable readiness check for AI-agent safety

$ phantom exec -- claude
# Authenticated proxy running on an ephemeral 127.0.0.1 port
# App/test processes use phantom tokens; agents use value-blind metadata

For a task contract you can hand to Claude Code, Codex, Cursor, Windsurf, or Copilot, use the safe delegation quickstart and the copyable policy and task templates. Teams evaluating a controlled rollout can start with the enterprise adoption guide.

Windows

The same core command surface is implemented for native Windows, with remaining native acceptance limits tracked in the platform matrix. Install the exact v0.7.8 Windows ZIP for your architecture from Installation, verify its published .sha256 sidecar, and place both executables on PATH. WSL is a separate Linux environment with its own filesystem and credential-store context.