Keypaste

keypaste keeps your logins and your projects' secrets in one KeePass-compatible vault, and gives an AI agent a secret only when you allow it.

The desktop app, built from source. It has no public release yet.

What it does

The published v0.3.0 CLI stores logins and environment variables in a local KDBX vault, runs commands with them, and asks you before an agent receives one. Everything else below is in source until the next release, and the desktop app has no public release; FEATURES records what exists where.

As a password manager

• One KDBX 4 file on your disk, with no account and no network. KeePassXC opens and edits the same file, and CI checks both directions against keepassxc-cli on Linux, macOS and Windows.
• Logins with a title, username, password, URL and notes, in groups. Search covers titles, usernames and URLs and never reads a password.
• A generator for 8 to 256 characters from a shell-safe alphabet, or passphrases of 6 to 32 words from the EFF list. keypaste rotate replaces a password with a generated one and never prints it.
• History for every change, restored in one step, and rolling encrypted backups beside the vault.
• keypaste import copies another KDBX file in, or keeps editing it in place.

For developers and their agents

• MCP approval: an agent asks for one field of one entry and gives its reason. You answer Deny, Allow once or Allow for 1 hour, and every request lands in a hash-chained audit log.

• Inject-only runs: keypaste run puts values in a command's environment and nothing on disk. With --allow-run, an agent can run a command you approve and gets back its output with each value replaced, though a command it can edit can still reveal a value (T-35). PRODUCT §2 bounds it: no shell, and you approve the exact command.

• Projects: one set of keys per project, with a value for dev, staging and prod. Prod always needs a live answer.

• .env.keypaste: KEY=kp://project/profile/KEY references and no values, safe to commit.

• Scoped tokens for CI, such as read:acme-api/staging/*: inject-only, and expiring after 30 days by default.

• Share links: one field, or an entry's login (username, password and URL), encrypted on your machine, opened 1 to 10 times (once by default) before it expires. keypaste.com serves the links; the command is in source until the next release.

The approval, in the terminal

Rendered from the source's output for the next release before its prompt offered Always for, with a scripted MCP client in place of the agent; the published v0.3.0 asks Approve? [y/N] and allows up to 300 seconds. The prompt as text:

────────────────────────────────────────────────────────────
keypaste: an agent is asking for a credential.

  agent    claude-code
  item     env/demo/.env
  field    STRIPE_KEY

  the agent says it needs this because:
    deploy the billing service to staging

  That sentence was written by the agent, not by keypaste. Treat it as a claim.