Vahta CLI
Vahta lets an agent use your passwords and API keys from an encrypted vault without ever showing it the values
- 71 ★ on the repository
- Last commit
Broad access
Why this level
- The vault holds working passwords and API keys, and ka run injects them into the environment of processes the agent launches
- The PreToolUse hook changes Claude Code, Cursor and Codex settings and lets the agent run ka run and ka list without prompts
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/vahtaDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The vault holds working passwords and API keys, and ka run injects them into the environment of processes the agent launches
- The PreToolUse hook changes Claude Code, Cursor and Codex settings and lets the agent run ka run and ka list without prompts
This is third-party code. Review the repository files before installing.
What it does
Vahta, formerly key-amnesia, targets the .env problem. Any secret in project files, shell history or MCP configs can be read by an agent, and a key pasted into chat stays in the conversation forever. In Vahta secrets sit in an encrypted vault (Argon2id and SecretBox). The agent only triggers a command, and values are injected into the child process environment out of its sight. If a command prints a secret, the output is censored before the agent sees it. Only you type the vault password: when an agent needs approval, a separate console window opens that the agent cannot read or type into. ka import .env moves plaintext values into the vault, ka scan finds remaining leaks and prints only names, paths and counts, and --deep mode also looks at shell history, MCP configs and agent session transcripts. ka setup installs skills and a guard hook for Claude Code, Cursor, Codex and OpenCode. The hook blocks dangerous ka subcommands such as ka set, ka reveal and ka scan --yes, as well as credential-shaped strings inside commands. The per-call mode asks for the password on every use of a secret, and the cached mode keeps the vault open for 30 minutes after ka unlock.
Who it is for. Developers who give Claude Code, Cursor or Codex working keys and passwords and want the agent to use them without being able to read them.
Good fit when
- A project holds a .env with keys and they have to move into the vault with ka import
- An agent runs a script with an API key and the value has to reach only the process environment
- Before working with an agent you want to find secret leaks in the project, shell history and session transcripts with ka scan --deep
- You need protection from inline keys in agent commands: the hook rejects them before they run
- An agent works autonomously for hours and the vault is opened for 30 minutes with ka unlock
Not a fit when
- You need protection from malware under your own account: any process of the same user can reach a live vault session
- The agent has screen, keyboard and mouse control: the isolation of the approval window weakens
- A command itself encodes the secret before printing: censoring catches only exact copies of the value
- A headless machine: without a display there is no way to approve, and the operation is denied
Example request
Move the keys from .env into the Vahta vault, then run my deploy.py script with the API_KEY secret without showing the value to me or to yourselfLimitations
- The vault password cannot be recovered: Argon2id and SecretBox leave no backdoor.
- Censoring catches exact copies of a value, while a secret encoded by the command before printing gets through.
- Command output reaches the agent in full after the command ends, with no live stream.
- Secret names are stored in plaintext, values are not.
- On macOS the isolated console spawn is experimental, and Windows and Linux are supported. On Linux the password terminal is chosen with ka config set terminal.
- The author announced a move to a new core: key-amnesia stays on PyPI with one final release. The license is Apache-2.0.
How to disable. The hook and skills installed by ka setup live in agent settings: to remove them, delete the secret-guard entries from the Claude Code, Cursor and Codex configs and the skill folders. The package itself is removed with pip uninstall key-amnesia. The vault stays in the profile or the project until you delete it.
FAQ
How do I install Vahta?
The package is on PyPI under the name key-amnesia: pip install key-amnesia. ka setup installs skills and a hook for Claude Code, Cursor, Codex and OpenCode, and the agent session must be restarted afterwards.
Can the agent see secret values?
No. Values are injected into the environment of the launched process and the output is censored. The vault password is typed in a separate console window the agent cannot reach.
What should I do with an existing .env?
Move the values into the vault with ka import .env .env.local, then ka scan shows remaining leaks. The command prints no values and does not delete files by itself.
What is the difference between per-call and cached modes?
In per-call mode the password is requested on every use of a secret. In cached mode you run ka unlock once and the vault stays open for 30 minutes or until ka lock.
Why is the project called both key-amnesia and Vahta?
The authors renamed the project and are moving the code to a new core. The software described in the README still ships as key-amnesia, and the PyPI package will not be yanked.
Discussion
No questions or reviews yet.
Related
CLI toolsagent-secrets lends keys to an AI agent for a limited time: age encryption, TTL leases, an access log and an emergency revoke.
A CLI and MCP bridge over a KeePass-compatible vault: an agent gets one secret only after your answer, and every request lands in a log
A utility keeps keys in the system keychain and injects them at the transport layer, so the agent never sees a value.
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
A skill and CLI around .env.schema: the agent sees variable names, types and rules while secret values never reach its context
The elbab CLI keeps keys and passwords encrypted and lets an agent run commands with secrets without ever showing them.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Vahta (this card) | no | 71 | |
| agent-secrets | no | 114 | a separate project for protecting agent secrets |
| AgentSecrets | no | 197 | a separate agent secrets project with its own vault format and commands |
README in short
The README opens with the announcement that key-amnesia is now Vahta and explains the problem: .env was built for the git threat, while today the threat is the agent inside the project. Next come a short set of ka commands, a prompt for bootstrapping an agent, two session modes and the choice of a terminal for password entry on Linux. A ten-point section on the limits of the protection closes the page.