Documentation
Caddi is the caddie for your coding agents: an end-to-end encrypted credential broker and one MCP gateway. You paste API keys into your vault once; your agents get scoped tools, never raw keys.
Getting started
Install the CLI, sign in, make your first connection, and wire up your coding agent.
Connections
The catalog, native vs secrets-only, browser-side sealing, custom connections, and health states.
Agents
Per-agent setup for Claude Code, Cursor, Windsurf, and Codex CLI, plus the manual fallback.
Skills
Add reference and private skills to your library, and sync them into your agent’s skills directory.
caddi.json
The schema behind allow, env, and get_secret: what a repo can ask your gateway for.
CLI reference
Every caddi command and option, extracted straight from the CLI’s own command definitions.
Security model
The crypto and threat model behind the vault: sealing, devices, and account recovery.
FAQ
Answers to common questions about accounts, connections, and security.
What Caddi is
Every API key or token you connect is sealed to your account’s vault before it ever leaves your browser or machine. Our servers store ciphertext only. A local gateway (caddi mcp) decrypts credentials in memory, at the moment a connected tool is used, and hands your coding agent a scoped tool call, not the underlying secret. For the full trust model, see the security model.
Where to start
New to Caddi? Start with getting started. Already installed and want to connect a provider? See connections. Setting up Claude Code, Cursor, Windsurf, or Codex CLI? See agents.
See what’s shipped so far in the changelog.