scrt4
Let an AI coding agent use your credentials without ever seeing them.
When Claude Code, Cursor, or any agent with shell access reads a .env file,
your keys land in its context window — and in the prompt cache, the logs, and
every error you paste afterwards. Nothing has gone wrong; the value is simply
in more places than you can enumerate.
scrt4 keeps secrets in an encrypted vault. The agent writes a command with a placeholder; the daemon substitutes the real value into that one subprocess and scrubs it back out of the output before anything returns to the model.
$ scrt4 add STRIPE_SECRET_KEY=sk_live_...
$ scrt4 run 'stripe --api-key $env[STRIPE_SECRET_KEY] charges list'
The agent sees the command. It never sees the value.
The key is not a file
The vault key is derived from a FIDO2 authenticator via the WebAuthn PRF
extension (CTAP2 hmac-secret), re-derived each session, and never written
to disk.
That distinction is the whole design. Encrypted-.env tools keep a private
key on disk — anything that can read the filesystem can decrypt. There is no
file to read here: opening the vault needs a tap on your phone, a security
key, or Touch ID / Windows Hello.
Encrypted .env is git-safe. This is agent-safe. Different problems.
Install
That builds two binaries: scrt4-daemon, which owns the vault, and scrt4,
the client that talks to it over a Unix socket (a named pipe on Windows).
Prebuilt, checksum-verified binaries and the full bash client are at
https://llmsecrets.com/downloads. scrt4 verify-self checks a running
binary against the published manifest at any time.
What it does not do
- It cannot help if you paste a secret into a chat window. Nothing can.
- It does not touch your editor. If a completion model has already indexed a file containing a key, that has happened.
- It is not a team secrets manager — one person, their devices, their keys.
- Lose the authenticator with no backup and the vault is gone. There is no reset, because there is no server.
Platforms
macOS (Apple Silicon), Linux (x86_64 / aarch64, glibc 2.34+), Windows
(PowerShell 5.1+), and WSL.
Links
- Source and issues: https://github.com/llmsecrets/llm-secrets
- Documentation: https://docs.llmsecrets.com
- Threat model:
SECURITY.md
AGPL-3.0-only.