Your phone decides what your computer may do.

1. Something asks

   sudo, ssh, git signing or an AI agent's tool call reaches a small daemon on your computer, signetd, instead of going straight through.

2. Your phone shows it

   The request is sealed to your phone and delivered within a second or two: the command, the server, the commit, whichever applies.

3. You answer

   Approving signs the answer with a key that never leaves the phone's secure hardware. Keys for SSH and Git can live on the phone or on a YubiKey you tap against it.

What it covers

sudo

A PAM module, so your phone or a local YubiKey can approve, whichever answers first.

SSH

An SSH agent that signs with keys held on the phone, pinned to the servers you set up. Add a server from the phone with its password once; after that the password is never needed.

Git and GPG

A gpg-agent that shows the commit you are signing before your phone signs it.

AI agents

An MCP server and shell hook that put an agent's riskier tool calls in front of you first.

Signet 0.2 beta, for Android 13 or newer on 64-bit phones and for x86-64 Linux.

• Android app APK, about 21 MB
• Linux daemon and tools signetd, signet-agent, signet-cli, the PAM module and adapters

Check the files against SHA256SUMS. The app's signing certificate has the SHA-256 fingerprint

40:4C:1F:54:6D:BB:35:0C:73:A2:BA:25:1D:59:2B:87:C8:0C:00:05:73:5E:89:7A:D3:46:08:53:D2:AC:FD:89

Getting started

1. Install the app. Android will ask you to allow installs from your browser.
2. On the computer, unpack the archive, then run signetd and show a pairing code with signet-cli pair device.
3. In the app, scan the code. The phone and the computer now know each other's keys.
4. Point sudo, SSH or Git at Signet. The README in the archive covers each one.

This is a beta. It runs our own computers every day, but expect rough edges, and keep another way into anything you put behind it until you trust it.