#secrets-management

A simple MacOS helper for safer exposure of secrets to your agents

Self-host secrets manager with an AI-safety layer. Aliases instead of values; AI agents never see real credentials. Cloud option coming.

Trusty Squire signs up / in to websites for you so you don’t have to.

🕶️ Secrets your AI agent can USE but never SEE — Claude Code skill + zero-dependency macOS Keychain CLI. Env injection, pointer manifest, prompt-injection tripwire.

Lets Claude Code read service API keys/tokens from a running, unlocked KeePass 2 instance via the KeePassNatMsg plugin

Deterministic 3-layer secrets protection for Claude Code: permissions.deny + PreToolUse hook (Read/Edit/Grep/Bash/PowerShell) + CLAUDE.md redaction policy. MCP-safe by design. Born when .claudeignore turned out to be unenforced and prompt-only rules kept leaking secrets into AI context.

Agent Skill for using secrets from a local KeePassXC database — kp:// references, in-process resolution, env injection and output redaction. Works in Claude Code, Codex, Cursor, Gemini CLI and any AGENTS.md harness