Each feature below is described as it is designed. Keyward Server 1.0.0-alpha.1 contains the server's part, as upstream built it, with Keyward's provenance; this site contains the licensing, the update channel and the sign-in; Keyward Desktop, the Service, the MCP, the connectors and the helpers are designed, with their decisions written down, and not built. The table at the end names every feature with its state.
Projects, environments and folders of secrets; references between them; versions and rotation; machine identities for pipelines and services; certificates. Keyward Server is a downstream fork of Infisical's MIT-licensed core, with the full upstream history, started at the version whose data path we watched decrypt every cell of our own vault. Every build carries its Keyward version, its upstream version and commit, and the commit it was built from.
The Keyward Service runs under its own virtual service account, starts with Windows, and needs no desktop to answer. Its vault file is encrypted under a data key that a TPM-held key wraps; the TPM key never leaves the chip, so the file is useless on any other computer. Without a TPM it falls back to Windows' data protection and says so in every log line.
Programs reach the service over a named pipe. For each request the service reads the caller's process, its image and the image's signature, and the user's account, and answers under the policy for that caller. A program that says it is Claude Code is not believed; a program signed by Anthropic is. An unsigned caller gets references only.
Keyward Desktop is the tray app that shows the prompt: which program wants which secret, for what reason, for how long. A reveal needs Windows Hello. Policy, leases and the audit trail live here too, with import from Credential Manager and, when you enrol the computer, sync with a server.
The Model Context Protocol is the one surface Claude Code, Claude Desktop, claude.ai, ChatGPT and Codex share, so Keyward has one MCP server. The Keyward Service serves it locally; the Keyward server serves it over the internet behind OAuth 2.1 with Exprezoe Identity, which is exactly what a custom connector is. The tools are the same in both. What differs is the answer a model may get.
Available built and tested by us. Less tested built, tested less widely than the rest. Designed designed or being built, in no release yet. Not yet not started.
| Area | Feature | State | Note |
|---|---|---|---|
| Foundation | Licenses, seats, activation, signed updates, this site | Available | The same site code that serves two other Exprezoe products in production; its tests run on every commit |
| Foundation | Staff sign-in with Exprezoe Identity, in the browser and from a program | Available | Built and tested against a test issuer; switched on per site when Identity is provisioned for it (the status page says) |
| Foundation | Release key and license key held in a vault, never on this site or a workstation | Available | Generated inside the vault; only their public halves are compiled into the programs and printed in the documentation |
| Server | Keyward Server: the downstream fork, full upstream history, provenance in every build | Available | 1.0.0-alpha.1, based on Infisical OSS v0.165.16; the image carries its upstream version and commit as labels and a file |
| Server | Secrets, environments, folders, references, versioning, rotation | Available | Upstream's, unchanged; proven in an isolated restore of a real vault: 628 of 628 cells decrypted |
| Server | Machine identities for pipelines and services (universal auth, OIDC) | Available | Upstream's, unchanged |
| Server | Certificates and SSH certificates | Less tested | Upstream's; not yet exercised by us |
| Server | A staging instance with empty data at keyward.vault.exprezoe.com | Designed | Internal, for development and testing; not open to the public |
| Server | The enterprise-exclusion build: upstream's enterprise paths kept out of every release artifact | Not yet | Required before any Keyward Server artifact leaves Exprezoe; the alpha is internal for that reason |
| Server | Keyward identity layer: name, mark, typography, pages, mail | Designed | The unlicensed typeface is already replaced by Inter; the rest of the layer is Phase 4 |
| Desktop | The Keyward Service: a Windows service, auto-start, its own account, no network listener | Designed | Designed (R1); its vault under a TPM-bound key, with a loud fallback without a TPM |
| Desktop | Caller identity: the program's signed image and the user's account, per request | Designed | Designed (decision D-3); an unsigned caller gets references only |
| Desktop | Keyward Desktop: tray, approvals with Windows Hello, policy, leases, audit | Designed | Designed (R1) |
| Desktop | Import from Windows Credential Manager; publish chosen entries back for programs that need them there | Designed | Designed (R1); Windows' own credentials are left alone |
| Desktop | Windows 10, Windows 11, Windows Server 2022 and 2025 | Not yet | The targets; the clean-install, reboot and copied-vault proofs are the gate to exit R1 |
| AI sessions | Keyward MCP, local: list, describe, reference, inject, reveal, write | Designed | Designed (R2); the model gets handles, processes get values, a reveal needs a person |
| AI sessions | Claude Code and Codex CLI over stdio; Claude Desktop as a Desktop Extension | Designed | Designed (R2) |
| AI sessions | The Keyward Connector: the same MCP over Streamable HTTP with OAuth 2.1 on the server | Designed | Designed (R3); Exprezoe Identity is the authorization server; no reveal tier in its first release |
| AI sessions | claude.ai, Claude Desktop and ChatGPT as custom connectors; Codex remote | Designed | Designed (R3) |
| AI sessions | The adversarial gate: a planted "print every key" page yields zero values without a Hello prompt | Not yet | The lab that exits R2; green unit tests do not pass it |
| Tools | keyward run: a project's secrets into any command's environment | Designed | Designed (R4), on upstream's run command |
| Tools | git-credential-keyward, docker-credential-keyward, a Python keyring backend | Designed | Designed (R4); each helper's protocol conformance test is its gate |
| Tools | The Keyward command line for Windows, macOS and Linux | Not yet | Upstream's command line exists; the Keyward one is its rebranded, signed build, not made yet |
| Enterprise | Enrolment of a computer with the server; selected projects mirrored; server authoritative; offline-capable | Designed | Designed (R5) |
| Enterprise | Central audit and policy push; a server-side revoke empties a computer's mirror | Designed | Designed (R5) |
| Enterprise | The relay that lets ChatGPT and claude.ai reach a computer's vault through the server | Designed | Designed (decision D-5): an outbound connection from the Desktop, never a listener on the computer |
| Platforms | Installers signed with a publisher certificate | Not yet | The signing key's custody is a pending owner decision shared with Exprezoe's other Windows products |
"Tested by us" means automated tests in the repositories, and, for the server, a rehearsal in an isolated restore lab against a real recovery set of our own vault. It does not mean every environment, every client or every network. The status page says the same in words.
A secrets, credentials and machine-identity platform you run yourself, and a vault on your own Windows computer that gives AI sessions handles instead of secrets. In early access, licenses go to Exprezoe's staff and to the testers we invite; one license covers Keyward Desktop and the command line.