How subscribetome actually works.
subscribetome (CLI: stm) keeps every API key in the OS keychain and lets an AI
coding agent use your keys without the model, the chat transcript, or your logs ever holding one.
This section is the technical reference: the security model, the credential broker, self-hosting the
Teams server, and the full command list. It is reference, not a pitch — every command and
guarantee below is drawn from the source.
The model in one paragraph#
A real key value lives only in your OS keychain. In chat you refer to a key by a placeholder like
{{stm:openai:default}}. When Claude Code is about to run a shell command that contains a
placeholder, a PreToolUse hook substitutes the real key into that one command the instant before it runs —
so the model never sees the value and the transcript keeps only the placeholder. Three more hooks back this up
(blocking pasted secrets, flagging leaked output, teaching each new session). For HTTP APIs, the
credential broker goes further: the request is routed through a local daemon that injects the real auth on
the outbound call, so the key never enters the command at all. STM Teams extends the same
keychain-only principle to a team with a zero-knowledge, self-hostable server that stores only ciphertext.
The core plugin has no server, no cloud, no telemetry, and no sign-up. Keys live only in your OS keychain;
a SQLite inventory stores metadata and a keychain reference, never a key value. The only optionally-networked
pieces are stm sync (spend, outbound to providers you configured) and — if you run one — a Teams
server you host yourself.
Where to start#
Pick the page that matches what you need. Each is self-contained.
Architecture & threat model
Keychain-only keys, the placeholder + PreToolUse substitution, the four hooks, the command-policy engine, the honest argv limitation, and the Teams cryptography — with an equal-weight list of what is out of scope.
Read the security model → BrokerThe credential broker
Route HTTP API calls through a local daemon that injects the real key on the outbound request. The
/proxy model, a curl example, the loopback capability token, and the SSRF / redirect / scrub /
size-cap invariants.
Self-hosting STM Teams
Run the zero-knowledge server, create a team, push and pull an encrypted vault, enroll members by public key with no shared passphrase, and read a cryptographically-attributed team audit log.
Read the self-hosting guide → CLICommand reference
Every stm command grouped by task — keys, policy, audit, projects, vault, broker, and teams —
each with a one-line purpose and usage pattern.
Platform scope#
The runtime hooks that rewrite commands are strongest on macOS + Claude Code; other platforms and agents are experimental (see the security page and DOCS.md). The credential broker and the Teams server are plain Bun programs and run anywhere Bun does.
Beyond these pages#
- DOCS.md — the long-form reference for keystores, platforms, and the Codex surface.
- SECURITY.md — the threat model and how to report a vulnerability privately.
- CHANGELOG.md — release history.
- GitHub — source, MIT licensed.