NXD

NXD keeps your secrets out of what AI models see. Keys stay on your machine. Agents get opaque tokens, sealed text or redacted text back instead of plaintext, and reveals go to the operator, not the agent. Note: the agent still sees whatever plaintext it passes in as a tool argument.

Crypto: shield / seal_text / tokens use Fernet (AES-128-CBC + HMAC-SHA256); the vault and secret handles use AES-256-GCM envelopes with per-company keys.

After installation everything runs locally and offline: no account and no Nexplora service is needed. (The optional nxd serve / vault-setup commands are for self-hosting and are off unless you run them.)

Install

pip install nxd          # Python 3.10+
# or via npm (needs Python 3.10+ on PATH; first run downloads the Python package):
npx nxd --help

The npm package is a thin launcher: it creates a private Python virtualenv under your user cache directory, installs this nxd package into it, and runs it. It requires Python 3.10 or newer.

CLI

nxd init            # set up NXD in the current project
nxd init-operator   # create the operator key in your OS keychain
nxd open | lock | status
nxd reveal <id>     # read a reveal an agent queued (operator only)
nxd recover-operator
nxd migrate-vault
nxd --help

MCP server

{ "mcpServers": { "nxd": { "command": "nxd-mcp" } } }

Prefer the OS keychain (nxd init-operator). Only set NXD_OPERATOR_PASSPHRASE in the server's environment where no keychain exists, and keep that config file unreadable to agents. Tools: nxd_shield, nxd_unshield, nxd_redact, nxd_tokenize, nxd_detokenize, nxd_seal_text, nxd_unseal_text, nxd_score, nxd_match and nxd_aggregate. nxd_unshield never returns plaintext to the agent: it queues a reveal that only the operator can read with nxd reveal (same for nxd_detokenize and nxd_unseal_text). Threat model: anything running as your OS user, including an agent with shell access, can run nxd reveal too. NXD protects against the model seeing secrets, not against a fully compromised local account.

nxd_score / nxd_match need the optional FHE extra on Python 3.10-3.11: pip install 'nxd[fhe]'.

Security notes

• NXD's security rests on the cryptography and your own key, not on the core being compiled. Compiling only hides the implementation.
• nxd_redact is best-effort pattern detection, not a guarantee.

License

The CLI, MCP server and tests are Apache-2.0 (see LICENSE). The core ships as compiled binaries under LICENSE-CORE. See NOTICE.