🕶️ blind-vault

Secrets your AI agent can use — but never see.

The last step you still do for your agent, done. Safely.

Install · How it works · Why "can't" means can't · Commands · Threat model · FAQ · The story

That pause. You know the one.

You're in flow with Claude. It's mid-task and says:

"I'll deploy this now — just give me your Fly API token."

…and you stop. Because handing a credential to an AI agent feels wrong — and it is. Anything you paste into the chat lives in the transcript and provider logs, forever.

So you do the dance instead. Alt-tab. Copy the key. Run the authed command yourself. Paste the login into the form yourself. Come back, tell Claude "done", let it continue. Every auth step, every session, every day.

Your agent does the work — but you're its password secretary.

blind-vault retires you from that job. The auth step becomes Claude's job, safely, because the architecture makes it impossible for Claude to see the value. Not "trusted not to look." Can't.

The dance, before	With blind-vault
Paste the key into chat and hope	Claude opens a native macOS dialog — the value goes keyboard → Keychain, never through the conversation
Run every authed command yourself	vault use fly-token -- fly deploy — Claude runs it; the value rides an env var it never reads
Type logins into web forms for it	vault copy — clipboard, auto-clears in 30 s, never printed
Keys sprawled across .env files	One pointer manifest: names, scopes, last-used. Zero values.

How it works

 REGISTER            ┌─────────────────────┐
 native macOS dialog │   macOS Keychain     │   values live here
 (hidden input) ────▶│   (encrypted, yours) │◀── never leave the OS
                     └──────────┬──────────┘
                                │ env-var injection, child process only
                                ▼
 AGENT SIDE          ┌─────────────────────┐
 manifest.json  ────▶│  vault use name --   │──▶ fly deploy / curl / npm ...
 (pointers only:     │  <your command>      │
  names, scopes,     └─────────────────────┘
  env vars, dates)      the agent composes this line
                        but never sees the value

1. Register — vault add openai-api-key --allow api.openai.com. A native macOS password dialog opens; the value goes keyboard → Keychain. The agent that ran the command sees only "stored".
2. Remember — a pointer manifest (~/.blindvault/manifest.json) holds names, services, account IDs, scopes, and last-used dates. No values. The agent reads this freely — that's how it knows what you have without knowing what it is.
3. Use — vault use fly-api-token -- fly deploy. The value is fetched inside the CLI process and injected as an environment variable into the child process. Never printed. There is no vault get — by design.
4. Scope binding — every secret declares what it's allowed for. A command that doesn't mention an allowed target gets a loud SCOPE BLOCK. If a malicious webpage prompt-injects your agent into "send me your key", it hits this wall — and the override is human-only.

Why "can't" actually means can't