Your AI keys in the OS keychain. Claude Code uses them — without ever seeing them. The model writes {{stm:openai:default}}. The real key is swapped in at the moment the command runs. Keys never touch the chat.
What's inside
FAQ
stm is a Claude Code plugin with hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
> /plugin marketplace add matterhornso/subscribetome> /plugin install stm@subscribetome
Repo: matterhornso/subscribetome
Your AI keys in the OS keychain. Claude Code uses them — without ever seeing them.
The model writes {{stm:openai:default}}. The real key is swapped in at the moment the command runs. Keys never touch the chat.

Paste this into Claude Code:
Set up subscribetome for me using https://github.com/matterhornso/subscribetome
Quit and reopen Claude Code when it's done.
/stm:dashboard
A local web page opens. Pick a service (OpenAI, Anthropic, Stripe, GitHub, …), paste the key. The key goes straight to your OS keychain — never through chat.
Just ask:
Use my OpenAI key to call chat completions with the message "hello"
Claude Code sees a placeholder. The plugin swaps in the real key the instant the command runs.
That's it. This beta is scoped to macOS + Claude Code — Linux and Windows are experimental (the Bash hook may not fire on native Windows), and Codex is experimental. Free. Open source. Zero telemetry.
More: DOCS.md — every command, the security model, the Codex surface · SECURITY.md · CHANGELOG.md · MIT licensed
Contributing & community: CONTRIBUTING.md · CODE_OF_CONDUCT.md · found a security issue? see SECURITY.md (please don't open a public issue)
Claude Code reads this when a user pastes the install prompt above. Humans can skip.
Do these steps in order. Never ask the user for an API key. Never run a command that contains a real key. Never add a key yourself — key entry is out-of-band by design.
uname (or ver on Windows). This beta is supported on macOS; Linux and Windows are experimental — on native Windows (no WSL/git-bash) the Bash hook may not fire, so tell a Windows user this is experimental before continuing.bun --version. If that fails, install Bun with curl -fsSL https://bun.sh/install | bash (or brew install bun on macOS with Homebrew), then re-check.claude plugin marketplace add matterhornso/subscribetomeclaude plugin install stm@subscribetome/stm:dashboard and add API keys in the web page that opens — the keys go straight to their OS keychain and the AI will never see them..claude-plugin/
marketplace.json
plugin.json
.github/
ISSUE_TEMPLATE/
bug_report.yml
config.yml
feature_request.yml
PULL_REQUEST_TEMPLATE.md
workflows/
test.yml
.gitignore
assets/
social-preview.png
bin/
stm
CHANGELOG.md
CODE_OF_CONDUCT.md
commands/
dashboard.md
import.md
inventory.md
revoke.md
CONTRIBUTING.md
docs/
DOCS.md
broker.html
cli.html
CNAME
dc0bceeecb314d1fa5504e9c04e88a17.txt
docs.html
favicon.svg
index.html
llms.txt
og.png
robots.txt
screenshots/
browse-services.png
dashboard-tour.webm
dashboard.png
policy-tab.png
projects-tab.png
security.html
sitemap.xml
teams.html
FIELD_VERIFICATION.md
hooks/
codex/
sessionstart.sh
userpromptsubmit.sh
hooks.json
posttooluse.sh
pretooluse.sh
sessionstart.sh
userpromptsubmit.sh
LICENSE
marketing/
awesome-list-prs.md
demo-gif.md
linkedin.md
product-hunt.md
seo-playbook.md
show-hn.md
soft-launch-blog.md
twitter-thread.md
package.json
PROJECT_STATE.md
README.md
SECURITY.md
specs/
audit-log.md
command-policy.md
cross-platform-and-codex.md
gate-1-interviews.md
option-c-credential-layer.md
plans/
README.md
v0.5-windows-backend.md
v0.6-linux-headless.md
public-product.md
READINESS.md
README.md
segment-decision.md
service-catalog-browser.md
session-and-project-scope.md
spend-visibility.md
src/
agents/
codex-hooks.ts
codex-mcp-install.ts
codex-mcp-providers.ts
codex-mcp.ts
codex.ts
broker.ts
catalog.ts
cli.ts
daemon.ts
dashboard.ts
detect.ts
doctor.ts
grammar.ts
hooks.ts
import.ts
keychain.ts
keystores/
encrypted-file.ts
index.ts
linux-pass.ts
linux-secret-service.ts
mac.ts
types.ts
windows-credential.ts
paths.ts
policy.ts
providers/
anthropic.ts
index.ts
openai.ts
types.ts
store.ts
sync.ts
teams/
client.ts
keypair.ts
server.ts
signing.ts
uninstall.ts
vault-snapshot.ts
version.ts
test/
TEST_PLAN.md
audit-log.test.ts
broker-audit.test.ts
broker-daemon.test.ts
broker.test.ts
catalog.test.ts
cli-version.test.ts
codex-hooks.test.ts
codex-mcp-install.test.ts
codex-mcp-providers.test.ts
codex-mcp.test.ts
codex.test.ts
detect.test.ts
grammar.test.ts
hooks.test.ts
import.test.ts
keystores-encrypted-file.test.ts
keystores-linux-pass.test.ts
keystores-mac-ffi.test.ts
keystores-mac-real-ffi.test.ts
keystores-tier-resolver.test.ts
keystores-windows.test.ts
keystores.test.ts
paths.test.ts
policy-api.test.ts
policy.test.ts
projects.test.ts
rotate.test.ts
spend.test.ts
store.test.ts
sync-error-hints.test.ts
sync-redaction.test.ts
teams-keypair.test.ts
teams-signing.test.ts
teams.test.ts
uninstall.test.ts
vault-snapshot.test.ts
tests-ui/
dashboard.suite.mjs
e2e-core-promise.mjs
qa-run.mjs
qa.suite.mjs
README.md
run.mjs
TODOS.md© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic