keyclasp

Keyclasp is a secure solution for managing runtime secrets in coding agents, designed to keep API keys and sensitive credentials out of prompts and project files. By utilizing a local encrypted vault, Keyclasp allows developers to inject selected secret values into commands without exposing them to potential leaks.

Key Features

• Local Credential Management: Keyclasp stores secrets in a secure local vault using AES-256-GCM encryption, ensuring that no credentials ever leave the user’s machine.
• Specific Command Access: Works exclusively with secret names, facilitating safe execution of programming commands while minimizing the risk of accidental output leaks.
• Explicit Permission Handling: The agent can only access the credentials it is explicitly granted permissions for, offering greater control over sensitive data.

Getting Started

To demonstrate Keyclasp's features, a simple command execution procedure can be followed:

1. Initialization: Create a demo vault on your local terminal with these commands:

   demo_vault=$(mktemp -d)
   export KEYCLASP_HOME="$demo_vault"
   keyclasp init --machine-only
   

   This creates a temporary Keyclasp vault for demonstration purposes.
2. Storing Credentials: Store a dummy credential using:

   printf '%s' 'dummy-key-for-keyclasp' | keyclasp set DEMO_KEY --project demo --environment local
   

3. Command Execution: Run a command with access to the stored credential:

   keyclasp run --project demo --environment local --env DEMO_KEY -- node -e 'console.log("Credential available:", Boolean(process.env.DEMO_KEY))'
   

   This command checks credential availability without exposing its value.

What Keyclasp Protects

Keyclasp offers robust security features:

• Locally encrypts sensitive credentials with strong encryption algorithms.
• Implements guard mechanisms to detect and redact leaked credentials in real-time, preventing them from being forwarded.
• Protects against common risks associated with credential exposure.

Comparison with Other Tools

Unlike 1Password’s op run, which relies on hosted accounts and predefined environments, Keyclasp provides a local-first approach allowing developers to manage secrets on a per-command basis, ensuring maximum security without cloud dependencies. Keyclasp is optimal for developers seeking explicit control over their coding workflow and credential management.

Resources

• Getting Started Guide
• Security Model
• Command Reference

Keyclasp presents a suitable solution for local development environments, offering security and simplicity for managing API keys and sensitive metadata directly through code.