Keys you never
have to hold.
Claude and Codex use your provider credentials without ever receiving them. Keys rotate on a risk-driven cadence, so key hygiene stops depending on human patience.
a41f…9c2 cloudflare 2d ago 28d current
7be0…14d cloudflare 9d ago 21d current
c903…88a command 29d ago 1d due
1d57…3f0 command never — imported
The agent gets the capability.
You keep the key.
An agent asks for an operation, not a secret. Keymaster pulls the credential out of the Keychain, injects it into the subprocess environment, runs the command, and lets it go. The value never lands in a file, a scrollback buffer, or a transcript.
Every call writes to an append-only audit log — which account, which capability, which command, when. keymaster audit --verify checks the chain.
$ keymaster exec --account cf-primary --cap dns \ -- curl -s https://api.cloudflare.com/… → 200 OK zones listed $ echo $CLOUDFLARE_API_TOKEN (empty — it lived in the child process) $ keymaster show cf-primary no such command. enforced by INV-1, a test, not a convention.
Thirteen verbs, none of which reveal anything.
The whole tool is a CLI. There is no server to keep running and nothing listening while you sleep — serve opens a loopback window with a deadline, then closes itself.
- keymaster status
- Backend, counts, chain state, rotation mode.
- keymaster ls --stale
- Tracked credentials and how overdue they are.
- keymaster exec --cap
- Run a command with the credential injected, scoped to one capability.
- keymaster do <operation>
- A typed single-call provider operation, no shell in the middle.
- keymaster rotate --due
- Roll everything past its cadence.
--dry-runshows the plan first. - keymaster scan <path>
- Find unmanaged credentials sitting in plaintext on disk.
- keymaster audit --verify
- Replay the append-only log and check the hash chain.
- keymaster spend budget
- What a credential costs, and the ceiling it can't cross.
Claims a test can settle.
Every security invariant in the threat model has a test that fails if it stops being true. A coverage script refuses to pass if an invariant exists without one.
“There is no command that prints a credential value. That is intentional and is enforced by a test (INV-1), not by convention.”
The part most tools leave out.
Keymaster is not a security boundary against a hostile model on this machine. It runs as your UID and the agent has a shell. Being straight about that is the only way the rest of the claims mean anything.
It does not stop a determined attacker who already has your shell.
- What it does: stops accidental leakage, keeps raw secrets out of transcripts and logs, forces explicit account selection, and leaves an audit trail plus a rotation ledger.
- What it doesn't: real isolation needs a separate UID or a container. That's a documented v2 path, not a v1 claim.
- Why say so: a credential tool that overstates its boundary teaches you to trust it in exactly the situation where it fails.