mayfly CLI

The agent never holds the key.

Ephemeral, task-scoped credentials for AI agents and CI. Free and open source.

Zero raw secrets in the child

The workload runs with no credential in its environment. mayfly holds it and injects it at the network boundary.

Deny-by-default egress

Only allow-listed hosts, methods, and paths get out. A hijacked agent posting to an attacker host gets a 403.

Proof, not a promise

Every decision lands in a hash-chained audit log, and mayfly attest signs a receipt anyone can verify offline, or at /verify on this site.

60-second quickstart

cat > mayfly.yaml <<'EOF'
providers:
  anthropic:
    secret: env://ANTHROPIC_API_KEY
policy:
  default: deny
  ttl: 15m
audit:
  path: .mayfly/audit.jsonl
EOF
export ANTHROPIC_API_KEY=sk-ant-...   # held by mayfly, never by the child
mayfly init                            # local interception CA, once
mayfly run -- claude                   # the agent runs with no key in its env
mayfly audit verify                    # the hash chain covers every decision

Install

Homebrew
brew tap whusted/mayfly && brew trust --formula whusted/mayfly/mayfly && brew install mayfly
Container
docker run --rm ghcr.io/whusted/mayfly:latest --version

The repository opens publicly at launch. Until then, request early access

The containment demo, verbatim

[1/4] The child holds no secret
    DEMO_API_KEY=<not set>
[2/4] The allowed path works, brokered through the egress proxy
    {"data":[{"id":"demo-model-1"}],"object":"list"}
[3/4] A hijacked child tries to exfiltrate its environment: denied
    curl: (56) CONNECT tunnel failed, response 403
[4/4] The audit log recorded both decisions, and the chain verifies
    ok: .mayfly/audit.jsonl verified, 2 record(s), hash chain intact
PASS: nothing leaked

Runs on every CI push with a stub API and a dummy key.

Source on GitHubFor teams: mayfly-cloud
mayfly CLI