tethra. Get Tethra

Local-first credential intelligence

tethra.

Every API route. Every key. One private map.

See where credentials live, which projects depend on them, how APIs are used, and what needs attention. Your encrypted vault stays on your device.

Download for macOS Download for Windows Explore Tethra
macOS and Windows desktop + CLI Apache 2.0 No Tethra account

Credential exposure scanning

Project-level API activity

Encrypted local vault

Guided key rotation

Operational clarity

See the credential graph your code already depends on.

Tethra turns scattered env files, provider accounts, gateway traffic, and local project context into one inspectable system. It tracks relationships without uploading your vault to a Tethra service.

Activity Local vault
Local request telemetry

API activity

Track API activity
Requests18,49299% succeeded
Tracked projects123 active in this window
Open alerts3top severity: medium
Observed cost$418lower bound

Gateway route healthyOpenAI traffic observed moments ago

Credential relationship confirmedProject activity mapped locally

Rotation window approachingReview provider steps before expiry

A living system map

From route to rotation.

01

Find exposure before it ships.

Scan selected repositories, env files, configuration, and git history for credential-shaped material. Review findings locally and resolve them with context.

Exposure
02

Connect keys to real project activity.

Map providers and credentials to projects, then observe sanitized request metadata through Tethra's loopback gateway and process runner.

Activity
03

Understand usage and cost.

Combine local request observations with supported provider account sync to see attribution, budgets, price models, and changes over time.

Usage
04

Act with a recoverable plan.

Prepare destination sync, temporary access, alerts, backups, and provider-aware rotation steps before changing a live credential.

Control

Local-first by architecture

Your vault is not our database.

Tethra has no account system and no hosted credential backend. Secret values are encrypted in your local vault. Network access happens only for actions you configure, plus limited measurement analytics under the regional choice described in our policy.

Read the privacy policy
Credential values
Encrypted locally
Master password
Never sent to Tethra
Tethra account
Not required
Product analytics
Regional default with opt-out
Analytics payload
Counts only; no names or secrets
Source license
Apache 2.0

One local control plane

Vault intelligence without a secret sink.

ProjectsSelected folders and manifests
Tethra vaultEncrypted values and local context
GatewaySanitized request activity
ProvidersUser-directed API operations

Standalone CLI

Install from the terminal.

Use the same encrypted local vault from scripts and shells. Download a release archive directly—there is no remote installer script and no Tethra account.

Read the complete CLI docs

macOS Apple Silicon

  1. Download

    curl -fL "https://usetethra.com/downloads/cli/tethra-aarch64-apple-darwin.tar.gz" -o ~/Downloads/tethra.tar.gz

  2. Unpack

    tar -xzf ~/Downloads/tethra.tar.gz -C ~/Downloads tethra

  3. Install and check

    sudo install -m 0755 ~/Downloads/tethra /usr/local/bin/tethra && tethra --version

Windows x64 PowerShell

  1. Download

    Invoke-WebRequest "https://usetethra.com/downloads/cli/tethra-x86_64-pc-windows-msvc.zip" -OutFile "$env:TEMP\tethra.zip"

  2. Unpack

    Expand-Archive "$env:TEMP\tethra.zip" -DestinationPath "$env:LOCALAPPDATA\Tethra\bin" -Force

  3. Add to PATH and check

    $d = "$env:LOCALAPPDATA\Tethra\bin"; $env:Path = "$d;$env:Path"; tethra --version

Make the PATH change permanent →

Tethra for Teams

Team-scale credential intelligence is coming soon.

Join the waitlist for the next chapter of Tethra: shared operational visibility, designed around the same local-first security boundary.

Explore Tethra for Teams

Available for macOS and Windows

Bring every API credential into view.

Install the Tethra desktop app and bundled CLI. No Tethra account, subscription, or hosted vault required.

Download macOS DMG Download Windows EXE
macOS: Apple Silicon, Developer ID signed, and Apple-notarized. Windows: x64 alpha; the installer is currently unsigned and may trigger Microsoft SmartScreen. SHA-256 checksums.