keyshroud

keyshroud helps maintain the confidentiality of sensitive credentials when working with coding assistants. Key features include: • Secret storage in Vaultwarden or Bitwarden • Injection of secrets into agent commands • Masking of secret values in output transcripts • Hidden input for new secrets, bypassing chat logs This utility prevents coding agents from directly accessing or logging API keys and other confidential information. It integrates with various coding environments like Claude Code, Codex, Cursor, OpenCode, Gemini CLI, and pi. When an agent attempts to read a secret, keyshroud intercepts the request, provides the necessary value for execution, and then redacts it from the visible transcript, showing only a placeholder like `<redacted:NAME>`. Designed for developers and engineering teams who utilize coding assistants for development tasks but require strict control over credential exposure. It ensures that while agents can perform tasks requiring API access, the underlying secrets remain secure within your self-hosted vault. Installation is straightforward via npm, and it's free and MIT-licensed with no telemetry.