What Keyward is
Three parts, one product. The server you run, the vault on your own Windows computer, and the one door every AI session and developer tool uses; what each does, why they are separate, and what stays where.
Where things stand. Keyward Server 1.0.0-alpha.1 is the first build, running on an internal staging instance with empty data. Keyward Desktop, the Keyward Service, the command line, Keyward MCP and the Keyward Connector are designed, with their decisions written down, and not built. The status page says what is proven and what is not.
Keyward Server
Keyward Server holds secrets, credentials, certificates and machine identities for people, pipelines and services, organised as projects, environments and folders, with an API, a web console and a command line. It is a downstream fork of Infisical's MIT-licensed core, with the full upstream history and its own provenance in every build, operated by Exprezoe on its own hardware. Keyward Server says what is changed from upstream, what is not, and where the enterprise boundary lies.
Keyward Desktop and the Keyward Service
The Keyward Service is a Windows service that starts with Windows and holds a vault on the computer, encrypted under a key the computer's TPM keeps. Programs ask it for secrets over a named pipe; it identifies each one by its signed program image and answers under a policy. Keyward Desktop is the program in the notification area that shows the approval prompts, sets the policy, shows the audit trail and imports from Windows Credential Manager. No cloud is needed for any of it. Keyward Desktop and the Keyward Service describes the design.
One door for AI sessions and tools
Keyward has one MCP server with two transports: the Keyward Service serves it locally to Claude Code, Codex and
Claude Desktop; the Keyward server serves it over the internet, behind OAuth through Exprezoe Identity, to
claude.ai, ChatGPT and Codex, which is what a custom connector is. The rule is the same on both: the model gets a
handle, the process gets the value, and a value reaches a model's context only when a person approves that one
reveal. AI sessions explains the tiers; Credential helpers
covers git, Docker, keyring and keyward run.
Why three parts
The server, the vault on a computer and the model have three different trust boundaries, and the design keeps them apart:
| Boundary | What is kept out |
|---|---|
| Model ↔ service | A model is untrusted: anything it can read, a prompt injection can send away. It gets references. |
| Program ↔ service | A program is identified by its signature and the user's account, never by what it claims. |
| Computer ↔ server | The computer connects to the server, outbound, with an identity the server issued. The server never connects to the computer. |
A computer that is not enrolled with a server is entirely local. A server with no enrolled computers is entirely a server. The connector reaches a computer only through the server's relay, and only once the computer's owner has enrolled it. Enterprise describes enrolment, mirroring, central audit and the relay.
What stays where
On your computer: the vault, in a file that opens nowhere else. On the server: what the people and machines of an organisation share, in a database Exprezoe operates, backed up nightly and restored weekly to prove the keys still work. Between them: only the projects you chose to mirror. To this site: what Licenses and seats, Updates and Signing in describe, and nothing else; Privacy lists it.
Platforms
Keyward Server runs as a container on Linux. Keyward Desktop and the Service are for Windows 10, Windows 11 and Windows Server (2022 and 2025). The command line is designed for Windows, macOS and Linux. Nothing on this site has been shown for a platform other than the one it names.