t next · Shift+t previous
VIGIL
$ self-custody wallet · in the terminal
Keys stay on your disk. Every send is shown to you before it is signed. Anything Vigil cannot verify, it refuses.
- ✓ Recovery phrase encrypted on your disk — AES-256-GCM over scrypt · how it is stored
- ✓ Structured review before every signature — signed in a separate signer process with no network authority
- ✓ Native balances + reviewed sends — EVM, Bitcoin-family, Solana, Cosmos Hub, TRON
- ✓ Limit + trailing alerts — durable, they survive daemon restarts
- ✗ Swaps, DCA and automatic trading are on HOLD — see what is available
Start your session.
Install → start daemon → open wallet.Verification is automatic. Homebrew checks the archive's SHA-256 and its minisign signature before extraction. A failed check stops installation; no manual verification is needed.
The second command starts the daemon.
Homebrew keeps vigil-api
running in the background. vigil opens the wallet; it does not start the service.
If the daemon is offline
And if it ever stops, you are not left guessing: the footer carries a live
● API
state on every screen —
● API offline
when nothing answers — and every daemon-backed screen names the cause,
Vigil daemon is not running, with the remedy under it. From a shell this reports the same
verdict — exit 0 running and trusted, 1 nothing running, 2 running but not one this build trusts.
Start the daemon before opening Vigil.
The installer prints the launchd/systemd recipe for vigil-api; it does not start the
service. Save the printed service file and run its enable command.
Service setup ↗
install.sh
verifies the sha256 sidecar and the minisign signature before installing. Once configured, your
service manager keeps the daemon running even after you close Vigil.
If the daemon is offline
Until you do, nothing is hidden from you: the footer shows ● API offline on every
screen, and every daemon-backed screen names the cause,
Vigil daemon is not running, with the remedy under it. This reports the same verdict from
a shell.
Each archive includes vigil and vigil-api.
Set up and start the daemon before opening the wallet.
Set up the binaries
Download the archive for your OS (Windows ships a
.zip), extract it (tar -xzf), put
bin/vigil
and bin/vigil-api
on your PATH. Supervise bin/vigil-api with launchd or systemd before launching the
TUI (install.sh
prints a ready-to-run recipe); the TUI never starts it. Each archive ships two sidecars: a
.sha256
for transport integrity, and a minisign .minisig signature made with an offline
release key for provenance —
install.sh
verifies the signature fail-closed once a key is pinned.
Verify a direct download
Homebrew and the shell installer verify downloads automatically. Use this check if you download an
archive yourself, before extracting or running it. Fetch the archive and its
.minisig
from the release origin, then check the signature against the pinned release key. The same key is
embedded in install.sh.
curl -O https://releases.r5n.dev/vigil/v0.11.6/vigil-<os>-<arch>.tar.gz curl -O https://releases.r5n.dev/vigil/v0.11.6/vigil-<os>-<arch>.tar.gz.minisig minisign -V -m vigil-<os>-<arch>.tar.gz -P RWS2NEa30Rmk0m4rvEJRhcel7J/TZhybn4Zof9yM3HGHqdpDR8c7sm+g
Pinned minisign public key (id D2A419D1B74634B6):
RWS2NEa30Rmk0m4rvEJRhcel7J/TZhybn4Zof9yM3HGHqdpDR8c7sm+g
Signed releases. No account to create.
## swaps, orders & providers
Track native assets, receive payments and review sends today. Trading features have their own availability checks. Here is where each stands in this release.
- Swaps
-
Not available yet. The swap screen explains the HOLD; quotes and trading inputs stay disabled.
The proposed first route is Ethereum ETH to USDC through 1inch. It still needs complete quote, signing and settlement verification.
- Orders & DCA
-
Limit and trailing alerts are available. Set a USD price target, trailing stop or trailing take-profit alert. The daemon keeps your alerts across restarts.
DCA means buying at regular intervals. DCA creation and automatic trading remain disabled; existing alerts notify you without moving funds.
- Providers
-
Market and network data are connected. CoinGecko supplies prices and charts. Price monitoring also checks Coinbase where coverage is available. Blockchain RPC services handle balances and transaction submission.
Swap providers are separate: 1inch, Jupiter, THORChain and MAYAChain are listed in the provider catalogue, but none is connected for trading in this release.
## why a terminal wallet?
Keep balances, receive addresses and reviewed sends in the workspace you already use. Choose the custody model that fits you.
| Alongside | What Vigil adds | Keep in mind |
|---|---|---|
| Keystore file | A wallet around your encrypted keys: balances, receive addresses and a review before sending. | Your computer and recovery backup still need protection. A terminal alone does not make keys safer. |
| Hardware wallet | Direct access from your terminal, with no separate device to connect. | Vigil signs on your computer. Hardware wallets isolate keys on another device. Hardware-wallet support is not available yet. |
| Centralised exchange | You hold the keys and send directly to the network, without an exchange account. | You manage recovery and network fees. There is no recovery desk, fiat on-ramp or exchange trading. |
Vigil is alpha software with no independent security audit yet. Read the security limits →
## why trust this
-
Signed releases: every archive carries a minisign signature made with an offline release key, plus a
SHA-256 sidecar. Homebrew and
install.shverify automatically; a missing or bad signature stops installation. - The site ships no analytics script of its own and the app sends none by default; Cloudflare's edge may add bot protection. No auto-update, no silent release check. Privacy details →
- Separate processes: the daemon holds the wallet, the TUI only talks JSON to it, and the signer child can stage a reviewed operation only — it has no arbitrary-message or raw-bytes signing API.
- No third-party audit yet. Read the operating limits and security risks.
- FSL-1.1-ALv2 — converts to Apache-2.0 two years after each version is first made available. Source access is planned for beta.
## alpha expectations
- macOS and Linux are the supported platforms. Windows x86-64 is experimental and untested.
-
Release builds send on mainnet by default. Start small, or switch
Settings › Mainnet Executionoff to keep every send on HOLD. - HOLD by design: swaps, DCA, auto-execution, swap providers, affiliate routing, hardware wallets, Zcash signing, NEAR and Harbor execution. Vigil reports these as unavailable rather than guessing.
- Please report: a review that did not match what was sent, anything that verified when it should not have, a stale balance, an alert lost across a restart, or a crash. Use with the Beta report type.
Built for people who feel at home in a terminal.
▸ Scripted walkthrough of the real screens with demo values — not a live wallet, not a recording.
features.md public alpha
Your wallet, at a glance.
Wallets, portfolio charts, reviewed transfers and persistent alerts. Open a section for details, including what remains on HOLD.
On your machine
Your recovery phrase stays encrypted on your disk. There is no remote Vigil wallet account.
- Create or import a 12- or 24-word recovery phrase; switch between wallets and account profiles
- Recovery phrase encrypted with AES-256-GCM over scrypt
- Password protection and optional TOTP with recovery codes
- Touch ID on supported Macs
Hold & send
See native balances and review the exact operation before anything gets signed.
- Native balances and sends: EVM, Bitcoin-family, Solana, Cosmos Hub and TRON on supported paths
- Review the recipient, amount and maximum network fee before signing
- Receive with QR codes and copyable addresses
- Save and search recipients in each wallet’s address book
Alerts that stick
Set a limit or trailing alert. Your orders survive daemon restarts.
- USD price targets, trailing-stop and trailing-take-profit alerts
- Alert records and acknowledgements survive daemon restarts
- Notification only; alerts cannot move funds
- DCA creation and automatic order execution remain on HOLD
At home in your terminal
A keyboard-first interface with room for your own preferences.
- Keyboard navigation, contextual key hints and built-in help
- 16 themes, light and dark
- Calm motion with static fallbacks
- macOS and Linux; Windows is experimental and untested
Portfolio & activity
Follow your native assets and revisit transfers submitted through Vigil.
- Native-asset balances, market prices and portfolio snapshots
- Price history over 24 hours, 7 days and 30 days where data is available
- Submission status for transfers made through Vigil
- Partial balance results stay visible when a network cannot be reached
Agent access, with limits
Connect Codex, Claude Code, Hermes or another local MCP client to read wallet data or propose a
transfer for your approval.
- Enable access in Settings › Agent Access; read-only for 15 minutes by default
- Choose a 15- or 60-minute grant and revoke it at any time
- Transfer proposals need your review and typed approval in Vigil
- MCP tools cannot unlock, reveal secrets, approve, sign or broadcast
- Your connected client may send permitted wallet data to a remote model
Data providers & swap availability
Price feeds, blockchain connections and swap routing are different services. Availability is specific to each one.
- Prices & charts
- CoinGecko provides native-asset prices and historical charts. Price monitoring compares Coinbase data where coverage is available. Missing or stale data is reported instead of presented as current.
- Network connections
- Blockchain RPC services read balances and transaction status and submit signed transfers. Operators can see the public addresses queried and the requests sent to them. Coverage depends on the selected chain and configured endpoint.
- Swap providers
- 1inch, Jupiter, THORChain and MAYAChain appear in the provider catalogue. None is connected for live swaps in this release. The proposed first route is Ethereum ETH to USDC through 1inch; each route needs separate verification before it opens.
- DCA & trading
- DCA spreads purchases over regular intervals. Order storage, scheduling and recovery foundations exist, but DCA creation and automatic trading remain disabled. Available limit and trailing alerts only notify you.
Every signature has a review.
Follow the signing path and its boundaries.
- 01 Prepare
- 02 Review
- 03 Sign
- 04 Submit
Wick owns crypto, backed by Noble / Scure primitives. The signer child has no network authority and no arbitrary raw-bytes or message signing API. Missing balance composition returns a HOLD.
Read the signing and review boundaries ↗Outside this alpha
These capabilities are unavailable. Vigil keeps them on HOLD when the required evidence is incomplete.
- Discovery
- Token discovery. The portfolio is native-only.
- Automation
- DCA creation, order confirmation and automatic trading.
- Routing
- Swaps, swap providers and affiliate routing. Price and RPC providers are already in use.
- Signing
- Hardware wallets, Zcash signing, NEAR and Harbor execution.
Catalog: 56 canonical identities · 36 adapter-ready entries. Catalog presence never implies a live product path.
Private by default.
Analytics are off by default. The optional activity log stays on-device. There is no automatic release check. RPC and price providers see the requests sent to them.
Take a look around before you install.
$ cat roadmap.md
What comes next.
Vigil is in alpha. Open a phase to see its goals and release requirements. No promised dates.
-
Alpha foundations now Verified installation, a separate local daemon, encrypted wallets, and native-asset balances, receive and reviewed sends on supported paths. Clear reasons when a capability is on HOLD.
Before this phase is complete
- Fresh-install and restart checks for predictable daemon setup.
- Readable first-run, portfolio, send, receive and status screens.
- Accessible controls, clear failure states and accurate capability labels.
-
A fuller portfolio next Token discovery, verified balances and token sends. The current portfolio is native-only; listing a chain never promises every operation on it.
Before token support can open
- Canonical asset identities and decimals, with bounded token discovery.
- Explicit partial results when a balance or discovery request is incomplete.
- A complete, reviewed product path for each supported transfer.
-
The first reviewed swap planned One tightly scoped provider route, with validated quotes, exact transaction review, minimum received and confirmed settlement. Swaps are unavailable today.
The proposed first route
- Ethereum native ETH → pinned USDC through 1inch; affiliate routing stays disabled.
- Strict provider schemas, exact route and fee validation, and retained review.
- Independent signer checks and chain finality before availability.
-
More routes, carefully planned Additional assets and providers after route-by-route verification. Token approvals need explicit limits and their own review before they can be used.
Before another route is enabled
- Finite ERC-20 approvals with a separate review and fee ceiling.
- Confirmed allowance before the route can proceed.
- Provider-specific preparation, settlement, refund and adversarial evidence. Each route opens separately.
-
Safe automation planned Limit, DCA and trailing execution with bounded authority, fee limits and recovery after interruptions. Automatic execution stays on HOLD until those protections are proven.
Before orders can move funds
- Immutable fee ceilings and an independent minimum-receive policy.
- Bounded signer authority for the exact future operation.
- Verified crash and reorg reconciliation. Existing notifications never gain execution authority implicitly.
$ cat changelog.md
The latest releases.
The three latest releases, with the newest open below. Expand a version to see what changed.
Read the full changelog ↗v0.11.6 Latest release
Version 0.11.5 was not published.
Added
- Client-specific MCP setup. Agent Access copies Codex TOML, Claude Code or generic JSON, and Hermes YAML, with private configuration, reconnect and status-verification instructions in the app, public guide and repository.
- MCP launches use the matching installation. Configuration resolves the installed API beside Vigil, or the current source checkout with an explicit Bun bootstrap configuration. Missing launch files and clipboard failures offer a retry without issuing another grant.
Fixed
- Release verification handles stale formula responses. The Homebrew check retries public GitHub responses while still requiring the publisher's exact formula checksum before accepting the release.
- MCP connections keep independent request budgets. Verified grants no longer share the anonymous loopback rate-limit bucket. Revoked and forged tokens stay unauthorised, and each grant retains its thirty-request-per-minute limit.
v0.11.4
Fixed
- Recovery phrase regeneration handles rate limits. Setup waits for the daemon's retry delay, then automatically retries the latest selection once. Failed or rate-limited generations clear obsolete words and addresses; the screen no longer invites verification of an unavailable phrase.
- Portfolio balances, values and charts recover independently. Bitcoin discovery reads required addresses in bounded parallel batches. Ethereum defaults to PublicNode with Llama RPC as fallback. Display prices start alongside balances, measured zero amounts remain visible, and native charts no longer depend on a successful balance read.
- Selection highlights clear correctly. Moving through assets, transactions or orders removes the previous row's highlight.
Changed
- Widened the landing page and made wallet comparisons readable on mobile. Expanded feature, swap, DCA, data-provider and MCP access explanations to match current availability.
- Shorter, immediate sidebar navigation. Moving the sidebar selection changes the visible view; Enter or Right focuses its content. Limit, DCA and Trailing share an Orders entry with type tabs. About remains in Settings and on the guest menu. Lock and Switch Wallet still require activation.
- About keeps diagnostics secondary. Healthy connections show a short status, with build details available through Diagnostics. Compatibility problems remain visible immediately; the licence label matches the project.
Security
- Homebrew now checks release signatures before extraction in addition to its automatic SHA-256 checks. The 0.11.3 formula revision reuses the existing signed binaries; release publication verifies the consumer key and the exact published formula.
v0.11.3
Fixed
- Portfolio refresh resumes automatically. Unlocked wallets refresh balances every 30 seconds by default. Polling honours its settings, keeps one read in flight and stops on lock, wallet switch or disposal.
- Charts preserve daemon failure categories. Unsupported assets are cached without repeated background retries, missing history routes explain that the daemon needs updating, and temporary upstream failures remain retryable.
- Order navigation releases obsolete reads. Leaving a list or detail view cancels its pending reads; late responses cannot overwrite newer results. Moving down while a list loads keeps its first row selectable.
- Manual theme changes animate on the landing. Choosing a palette or using
t/Shift+tnow starts the existing soft wave, just like the optional demo. Reduced-motion and flat-intensity preferences still use an immediate change. - Clean-checkout tooling starts before installation. Runtime checks and release preflights use an explicit Bun configuration without application preloads or automatic dependency installation.