Open source · MIT

Self-host clavitor

One binary. No Docker. No Postgres. No Redis. Runs anywhere Go runs. You'll need a server with a public IP, DNS, and TLS if you want access from outside your network.

1

Download

The install script detects your OS and architecture, downloads the latest release, and puts it in your PATH.

$ curl -fsSL clavitor.com/install.sh | sh

Or download directly:

linux/amd64 darwin/arm64 darwin/amd64
2

Set your vault key

The vault key encrypts your Agent field data at rest. If you lose this key, Agent field data cannot be recovered.

# Generate a random key
$ export VAULT_KEY=$(openssl rand -hex 32)
# Save it somewhere safe
$ echo $VAULT_KEY >> ~/.clavitor-key
3

Run it

A SQLite database is created automatically in ~/.clavitor/.

$ clavitor
clavitor running on http://localhost:1984
Database: ~/.clavitor/vault.db
4

Configure MCP

Point your AI assistant at the vault. Works with Claude Code, Cursor, Codex, or any MCP-compatible client.

~/.claude/mcp.json

{
  "mcpServers": {
    "clavitor": {
      "url": "http://localhost:1984/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MCP_TOKEN"
      }
    }
  }
}

Generate an MCP token from the web UI at http://localhost:1984 after first run.

5

Import your passwords

The LLM classifier automatically suggests Agent/Sealed assignments for each field. Review and confirm in the web UI.

# Chrome, Firefox, Bitwarden, Proton Pass, 1Password
$ clavitor import --format chrome passwords.csv
$ clavitor import --format bitwarden export.json
$ clavitor import --format 1password export.json

Run as a service

For always-on availability, run clavitor as a systemd service.

/etc/systemd/system/clavitor.service

[Unit]
Description=clavitor
After=network.target

[Service]
Type=simple
User=clavitor
EnvironmentFile=/etc/clavitor/env
ExecStart=/usr/local/bin/clavitor
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
$ sudo systemctl enable --now clavitor

Expose to the internet

Put clavitor behind Caddy for TLS and remote access.

Caddyfile

vault.yourdomain.com {
    reverse_proxy localhost:1984
}

Rather not manage it yourself?

Same vault, same features. We handle updates, backups, and TLS. $20 $12/yr.

See hosted option →