Paste a secret once. Your AI agents fetch it by name — never from a plaintext .env file again.
View Source SupportYour accounts, your stores. Local secrets live in this Mac's Keychain. Shared secrets live in your own Google Cloud project (Secret Manager), under your own login. AWS Secrets Manager, Azure Key Vault, and OCI Vault backends plug into the same contract. There is no Agent Keyring server — nothing of yours ever touches ours.
One call — AgentKeyring().get("openai-api-key") or agent-keyring get — returns the secret in memory. No files to scrape, nothing printed to logs by design.
A native macOS app and CLI to add, edit, and delete secrets. Reveal is behind Touch ID, the clipboard clears itself, and lists never fetch values.
Machine-only keys stay in the OS keychain. Keys an agent needs everywhere sync through your own cloud project with per-secret IAM.
Google today; AWS Secrets Manager, Azure Key Vault, and OCI Vault implemented behind the same interface. 1Password, LastPass, and Chrome are on the roadmap.
agent-keyring doctor verifies your keychain, your gcloud login, and your IAM — printing no secrets — before you trust it with real keys.
MIT-licensed, security-reviewed in the open, and honest about its limits: it cannot protect against malicious code already running as you.
macOS 14+ · SwiftUI + Python · free & open source (MIT) · no account, no ads, no tracking