keys-keeper
A secrets manager AI coding agents architecturally cannot leak from.
Stores API keys, SSH keys, server credentials, and domain info in the OS-native credential store (macOS Keychain, Windows Credential Manager, Linux Secret Service — with an encrypted-file fallback on headless servers). Ships with rule files for Claude Code, Cursor, Aider, Codex CLI, Cline — and any other agent via keys init generic. All variants share one safety contract: the agent can put secrets into your files without ever seeing the value.
Status: v0.5.0 · macOS + Windows + Linux · single-user · MIT license
Why this exists
Modern coding agents (Claude Code, Cursor, Aider, Cline, Codex CLI…) need credentials to do real work — OPENROUTER_API_KEY here, STRIPE_SECRET_KEY there, an SSH key to deploy. The standard playbook today:
- You paste the key into the chat.
- The agent calls
Edit or Bash to write it into a file.
- The plaintext is now in the transcript, in the model provider's logs, in your clipboard, in your shell history.
1Password CLI and friends help with storage, but the moment the agent runs op read 'op://…/credential' the secret value still flows through its context window. The leak surface is the agent itself, not the vault.
keys-keeper is built around a different primitive: every Claude-facing command writes secrets to a target (file, clipboard, ssh tempfile) — the value never returns to the agent's view. Plus an os.environ-gated keys reveal that the shipped skill markdown explicitly forbids the agent from invoking.
It's not a policy. It's the command surface.
Install
1. Install the keys CLI
pipx install git+https://github.com/kyzdes/keys-keeper-skill.git
keys doctor # smoke check
No pipx? macOS: brew install pipx && pipx ensurepath. Windows: python -m pip install --user pipx && python -m pipx ensurepath.
2. Wire it into your AI agent
Pick whichever agents you use — run inside the project directory you want the agent to use it in:
| Agent | Command | What it does |
|---|
| Claude Code | Run as two separate slash commands (one at a time):
/plugin marketplace add kyzdes/claude-skills
then /plugin install keys-keeper@claude-skills | Marketplace plugin: skill + SessionStart auto-update hook |
| Cursor | keys init cursor | Writes .cursor/rules/keys-keeper.mdc (auto-loaded) |
| Aider | keys init aider | Writes CONVENTIONS.md; prints how to wire it via aider --read or .aider.conf.yml |
| Codex CLI | keys init codex | Writes AGENTS.md (also read by Cursor / Amp / Jules in 2026 per the AGENTS.md open spec) |
| Cline | keys init cline | Writes .clinerules/00-keys-keeper.md |
| Any other agent | keys init generic | Prints to stdout — redirect wherever your agent reads rules from |
You can mix targets — keys init cursor and keys init codex in the same project both work and stay consistent. The aider/codex writes use HTML-comment markers so re-running just refreshes the keys-keeper section and leaves the rest of the file alone.
Run keys init claude --check from your CI to fail builds on prose drift.
3. Optional shell config
# Lets shell users print plaintext via `keys reveal` (env-gated, agents can't override)
echo 'export KEYS_KEEPER_ALLOW_REVEAL=1' >> ~/.zshrc # macOS / Linux
setx KEYS_KEEPER_ALLOW_REVEAL 1 # Windows (effective in new shells)
Requires Python 3.10+ on macOS, Windows, or Linux.
Linux backend selection
On Linux, keys-keeper picks storage automatically:
- Desktop (GNOME / KDE with a running keyring): uses the OS-native Secret Service via
secret-tool. Install it once with sudo apt install libsecret-tools (Debian/Ubuntu) if it's missing.
- Headless server (no D-Bus / no keyring daemon): falls back to an encrypted file (
~/.config/keys-keeper/secrets.enc, AES-256-GCM) unlocked by KEYS_KEEPER_MASTER_KEY in your environment.
Force a backend explicitly with KEYS_KEEPER_BACKEND=secret-tool or KEYS_KEEPER_BACKEND=file. keys doctor prints which backend is active.
Quick start
# macOS
pbcopy <<<"sk-or-v1-..."
keys add openrouter-cline --type api_key --from-clipboard --tag llm
# Windows (PowerShell)
Set-Clipboard "sk-or-v1-..."
keys add openrouter-cline --type api_key --from-clipboard --tag llm
