MonoPass

MonoPass is Monolex’s passkey store and WebAuthn/FIDO2 client. It keeps service-scoped P-256 passkeys behind an envelope-encryption key, supports standard navigator.credentials.create() and get() JSON, can drive complete HTTP relying-party registration/login flows, and has explicit interop paths for Chrome DevTools virtual authenticators. The 0.4.0 dispatcher exposes 28 operational root commands plus root help/version aliases. Published contract: monopass 0.4.0, OpenCLIs build 2026-05-27-232315. The executing binary, registry, and public CDN metadata agree on this release. The table below follows the exact 0.4.0 payload; generic token storage belongs to OpenCLIs Vault, not to a monopass cred command in this release.

Quick Start

openclis install monopass

monopass --version
monopass init
monopass status
monopass webauthn-selftest

--service <name> selects a logical store, defaulting to default, and --json enables structured output where supported. Those two global flags are filtered wherever they appear in argv. A missing --service value silently falls back to default, so always supply and verify the intended service.

Store and Integrity Commands

Command	What it does	Effect or boundary
`init`	Initializes the service database and envelope key.	Persistent cryptographic state write; do not initialize over an unknown existing store.
`status`	Reports store/key health.	Read-only; an uninitialized service is reported in output but still exits 0.
`stats`	Prints record counts and storage sizes.	Read-only; no private-key material.
`services`	Lists initialized logical services.	Read-only inventory.
`verify`	Checks every stored passkey’s integrity.	Read-only cryptographic validation; non-zero on integrity failure.
`whereis`	Prints database path and the legacy keyring service/account identifiers.	Read-only, but not proof of the active backend when OpenCLIs Vault is installed.
`self-test`	Runs the complete store/encryption CRUD self-test.	Creates isolated test material; use `verify` for an existing production store.
`dump-schema`	Prints the embedded database schema.	Developer/inspection command; no store mutation.

Passkey CRUD

Command	What it does	Important controls or risk
`list [--rp <domain>]`	Lists passkey summaries, optionally for one relying party.	Read-only; private keys are omitted.
`get <rp-id>`	Shows passkey details for a relying party.	`--include-private` prints raw private key hex—treat output as a secret.
`generate`	Creates a random P-256 passkey.	Requires both `--rp` and `--user-handle`; accepts `--user-name`, `--user-display-name`, and `--account-label`.
`delete --rp <domain> --all`	Deletes every passkey for one relying party.	Destructive bulk operation.
`delete --credential-id <hex>`	Deletes one exact passkey.	Resolve the credential id before deleting.
`delete ... --dry-run`	Lists rows that would match either delete shape.	Safe preview; use before `--all`.
`update-sign-count --credential-id <hex> --count <n>`	Sets the WebAuthn signature counter.	Protocol-state mutation; use only when reconciling a known authenticator state.

Standard WebAuthn and RP Commands

Command	What it does	Inputs and outputs
`passkey-create`	Consumes an RP’s standard creation-options JSON and emits standard credential JSON.	Read request from `--request <file>` or stdin; `--origin`; `--pin` or `--touchid`.
`passkey-get`	Consumes standard request-options JSON and emits a standard assertion.	Same request/origin/user-verification controls.
`webauthn-register <rp-id>`	Builds a lower-level registration ceremony from flags.	`--challenge`, `--b64`, `--origin`, and user/RP metadata controls.
`webauthn-authenticate <rp-id>`	Signs a lower-level authentication challenge.	Requires `--challenge`; accepts `--origin`, `--b64`, and verification controls.
`webauthn-selftest`	Performs in-process registration, authentication, and verification.	Crypto/format proof without an external RP.
`set-pin --pin <pin>`	Enables PIN-backed user verification and its UV bit.	Writes user-verification state; avoid exposing the PIN in history.
`touchid-test`	Tests macOS Touch ID user verification.	macOS biometric prompt; platform-specific.
`se-test`	Creates/tests a Secure Enclave key and biometric signature.	macOS hardware/biometric path.
`webauthn-rp-register --rp-url <url> --user <name>`	Drives a complete registration exchange with an HTTP RP.	Select `--pin` or `--touchid`; network and credential mutation.
`webauthn-rp-login --rp-url <url> --user <name>`	Drives a complete authentication exchange with an HTTP RP.	Network operation; same user-verification choices.
`webauthn-rp-se-demo --rp-url <url> --user <name>`	Demonstrates a Secure Enclave-backed RP passkey flow.	macOS-only hardware path plus network requests.

Assertion and Interop Commands

Command	What it does	Security boundary
`assert <rp-id> --challenge <hex>`	Produces a hand-rolled ES256 assertion from a raw stored P-256 key.	Designed for CDP virtual-authenticator interop; `--origin`, `--b64`, `--verify`.
`verify-assertion <rp-id>`	Verifies assertion JSON supplied on stdin.	Read-only verification against stored public material.
`export [--output <file>]`	Exports every passkey in the selected service, including private keys. Without `--output`, JSON goes to stdout; on Unix the output file is set to mode 0600.	Secret-bearing output. The 0.4.0 handler does not implement an RP filter.
`import <file.json> [--replace]`	Reads passkey JSON from a required file path.	Persistent mutation; stdin is not accepted. `--replace` overwrites duplicates. Run `verify` afterward.

The installed 0.4.0 help advertises export [--rp <domain>], but the handler never parses that flag and exports the whole service. Do not use --rp as a confidentiality boundary.

Parser and Exit Contract

Help is root-only: monopass help, -h, or --help. There is no command-specific help branch. monopass init --help still runs init because the handler ignores the extra token.
Version aliases are version, -v, and --version.
passkey-create and passkey-get always emit standard credential JSON even without the global --json flag.
Unknown/invalid arguments and invalid services exit 2; an uninitialized key exits 3; integrity failure exits 5; not-found exits 6; other errors exit 1.
Service names are 1–64 characters and accept Unicode alphanumerics, hyphen, and underscore. This differs from OpenCLIs Vault’s ASCII-only validator.

Storage and Key Ownership

Each service owns passkeys.db, where each private P-256 PKCS#8 value is encrypted with AES-256-GCM and a per-row nonce. A service-specific 32-byte master key opens those rows. Backend selection is ordered:

MONOPASS_FORCE_KEYCHAIN forces the OS credential store.
MONOPASS_FILE_STORAGE forces a user file (intended for debug/CI).
If the stable OpenCLIs helper exists, MonoPass uses the Vault service monopass-<service>.
Debug builds fall back to file storage; other builds use the OS credential store.

On first Vault use, a legacy keyring master key is copied best-effort into the Vault while the keyring copy is kept as recovery material. init and whereis still print the legacy ai.monolex.monopass.<service> identifier even when the Vault is the active backend; that output is not a backend-selection proof. Losing the master key makes the encrypted database unrecoverable. Export files contain plaintext private keys and are a different, much more sensitive backup boundary.

Published Payload Matrix

Platform	Binary	Published in 0.4.0
macOS Apple Silicon	`monopass`	`darwin-aarch64`
macOS Intel	`monopass`	`darwin-x86_64`
Linux ARM64	`monopass`	`linux-aarch64`
Linux x86-64	`monopass`	`linux-x86_64`
Windows x86-64	`monopass.exe`	`windows-x86_64`

There is no Windows ARM64 artifact. Touch ID, Secure Enclave, se-test, and webauthn-rp-se-demo are macOS-only even though the general passkey store and software WebAuthn paths are cross-platform.

Choose the Right Mode

Need	Use
Browser/RP gives standard WebAuthn JSON	`passkey-create` or `passkey-get`
CLI should complete registration/login over HTTP	`webauthn-rp-register` or `webauthn-rp-login`
Building custom RP plumbing	`webauthn-register` / `webauthn-authenticate`
Injecting a key into Chrome CDP	`assert`, `get --include-private`, or `export`
Storing an API token rather than a passkey	OpenCLIs Vault

Relationships

Tool	Ownership
OpenCLIs Vault	Stable keychain token access; MonoPass adds a structured encrypted passkey database and WebAuthn logic
MonoSurf	Can automate browser/RP flows and CDP virtual-authenticator interop
Kernel CLI	Provides OS/browser observation and actions, not passkey cryptography
OpenCLIs	Installs and updates the published MonoPass payload and agent skill

Get Started

Articles

So Anthropic

User Guide

Philosophy

Applied Philosophy

Architecture

Gestalt Color

Transparency

Terminal Core

Features

VariableMD

Research

CodexMono

OpenCLIs

vpncli

MonoSurf

AI-CLIs

Quick Start

Store and Integrity Commands

Passkey CRUD

Standard WebAuthn and RP Commands

Assertion and Interop Commands

Parser and Exit Contract

Storage and Key Ownership

Published Payload Matrix

Choose the Right Mode

Relationships

​Quick Start

​Store and Integrity Commands

​Passkey CRUD

​Standard WebAuthn and RP Commands

​Assertion and Interop Commands

​Parser and Exit Contract

​Storage and Key Ownership

​Published Payload Matrix

​Choose the Right Mode

​Relationships

Quick Start

Store and Integrity Commands

Passkey CRUD

Standard WebAuthn and RP Commands

Assertion and Interop Commands

Parser and Exit Contract

Storage and Key Ownership

Published Payload Matrix

Choose the Right Mode

Relationships