Docs

Getting started

Caddi is the caddie for your coding agents: an end-to-end encrypted credential broker and one MCP gateway. You connect your accounts once, and your agents get scoped tools instead of raw API keys.

1. Install the CLI

Install the CLI globally with npm:

npm i -g @caddi/cli

2. Sign in

caddi login

This starts a device-code sign-in: the CLI prints a code, opens your browser to the authorize page with that code pre-filled, and waits for you to click Authorize. On a headless machine, or if you’d rather copy the URL yourself, pass --no-browser and the CLI just prints the URL without trying to open it.

The first time you sign in on any device, Caddi creates your account’s vault: a keypair whose public half lives on our servers (so anything can encrypt secrets into your vault) and whose private half never does. Right after the vault is created, the CLI prints a recovery code, once. That code is the only backup of your vault’s private key outside a device keychain: write it down and store it somewhere safe, because it isn’t shown again. You’ll use it later with caddi login --recovery to approve a new device if you ever lose access to every device you’ve already approved.

3. Connect a provider

Connect your first service from the CLI, which prompts for a token and seals it to your vault before it ever leaves the process:

caddi connect github

Or connect from the dashboard, where pasting a token seals it client-side in your browser before anything is uploaded. Either way, our servers only ever receive ciphertext. See connections for the full catalog and how custom (non-catalog) connections work.

4. Register your coding agent

caddi install

This detects coding agents on your machine (Claude Code, Cursor, Windsurf, Codex CLI) and registers the caddi mcp gateway with each one it finds, without touching any of their other MCP servers. See agents for what each integration looks like and the manual fallback for anything else.

5. Verify

caddi status

Prints your vault fingerprint, this device’s registration state, and every connection’s status. Use it to confirm the vault fingerprint matches what the dashboard shows before you trust a connect flow, and to sanity-check everything is wired up after caddi install.

What’s next

• Connections: the full provider catalog, native vs secrets-only, and custom connections.
• Agents: per-agent setup and the audit trail.
• Security model: what’s encrypted, what we ask you to trust, and what a breach would get.