AgentSecrets CLI
A utility keeps keys in the system keychain and injects them at the transport layer, so the agent never sees a value.
- 197 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The utility holds real API keys and injects them into requests to external services on the agent's behalf.
- A proxy with a wrong domain list would send a key to the wrong place.
Install
- Works in
Manual install
brew install The-17/tap/agentsecretsThe first README option for macOS and Linux. Others: npm, pip and `go install`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The utility holds real API keys and injects them into requests to external services on the agent's behalf.
- A proxy with a wrong domain list would send a key to the wrong place.
This is third-party code. Review the repository files before installing.
What it does
The agent names only the key, for example `agentsecrets call --bearer GITHUB_TOKEN`. A proxy fetches the value outside the agent, injects it into the request and returns only the API response, so the value never reaches model context, logs or traces. There are six injection styles: bearer, header, query, basic, JSON body and form field. Encryption runs on the client (X25519, AES-256-GCM, Argon2id) and the server stores ciphertext. Domains are allowlisted with `agentsecrets workspace allowlist add`, and the audit log is chained with SHA-256 and has no value field. `agentsecrets mcp install` sets up MCP for Claude Desktop and Cursor.
Who it is for. Teams whose agents call external APIs with real keys and who need keys kept out of prompts and logs.
Good fit when
- An agent calls Stripe or GitHub and the token must stay hidden from the model.
- Dev, staging and prod environments switch with one command without sending keys in clear text.
- Each agent needs separate permissions: allowed domains and methods.
- You need to see who called an API and when, without recording the values.
Not a fit when
- The project is entirely local and calls no external APIs.
- You need a password manager for people, not a proxy for agents.
- The agent must receive the key value in code instead of injection into a request.
Example request
Call the Stripe balance through AgentSecrets with the STRIPE_KEY key and show only the response, never the key value.Limitations
The proxy injects keys only for allowed domains, so each domain is added to the list by hand. A JS and TypeScript SDK is announced as coming, while a Python SDK exists. Clients have no `get()` method: a key value cannot be retrieved, by design. After an upgrade you may need `agentsecrets doctor`, which repairs binary registration and the keychain daemon. Team cloud sync uses the project's own server.
How to disable. Run `agentsecrets proxy stop`, then `brew uninstall agentsecrets` or `npm uninstall -g @the-17/agentsecrets`. Remove MCP entries and keys in the system keychain separately.
FAQ
How do I install it?
Through Homebrew `brew install The-17/tap/agentsecrets`, npm `npm install -g @the-17/agentsecrets`, pip `pip install agentsecrets-cli` or `go install`, pinning a version for supply chain safety.
How do I connect it to Claude Desktop or Cursor?
Run `agentsecrets mcp install`. For other agents run `agentsecrets proxy start` and point the HTTP client at the proxy.
What if the keychain breaks after an upgrade?
Run `agentsecrets doctor`: it checks the trust chain and daemon health and repairs registration mismatches.
What does the server store?
Only ciphertext. The server cannot decrypt it because encryption happens on the client.
Which injection styles are supported?
Six: bearer, header, query, basic, JSON body and form field. The style is chosen with a call flag such as `--bearer`.
Discussion
No questions or reviews yet.
Related
CLI toolsagent-secrets lends keys to an AI agent for a limited time: age encryption, TTL leases, an access log and an emergency revoke.
Vahta lets an agent use your passwords and API keys from an encrypted vault without ever showing it the values
A Mac key vault for agents: Sallyport runs HTTP and SSH with your keys over MCP, and the agent never receives the key itself
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
A Go CLI that runs a coding agent in an OS sandbox with skills and secrets behind a bridge and isolated files and network.
README in short
The project combines a store, a proxy and an audit log, and keeps a model where the key value is absent from every place it could be stolen. The Keychain-Auth subsystem ties access to the hash of the calling binary.