Module credentials 

Where Leviath’s long-lived secrets live.

Two backends, chosen at runtime by [security] credential_store:

• file (the default) - provider API keys sit in ~/.leviath/config.toml and MCP OAuth tokens in ~/.leviath/mcp-auth.json, both written 0600 by leviath_sys::write_private so they are never briefly world-readable. This is what Claude Code and Codex do, and it is a reasonable default: it works headless, in containers, over SSH, and on a CI runner, none of which have an unlocked keychain.
• keychain - the OS credential store. Secrets never touch disk in Leviath’s own files, so a stolen ~/.leviath directory yields nothing, and on macOS the OS gates access per-application.

file stays the default deliberately. A keychain that is unavailable is not a degraded experience, it is a broken one - every inference fails with no obvious cause - and the environments where Leviath is most useful are exactly the ones least likely to have a working credential store. Opting in is one line; being unable to opt out would be a support burden.

This module is the platform-neutral half: the vocabulary (which backend, what an account is called) and the CredentialStore trait everything is written against. The OS binding lives in leviath-sys, with the rest of the platform-specific code and its own no-store fallback.

Structs

MemoryStore

An in-memory CredentialStore, for tests and for callers that want the keychain code paths without a keychain.

Enums

CredentialStoreKind

Which backend holds secrets.

Constants

SERVICE

The service name every Leviath credential is filed under.

Traits

CredentialStore

A place secrets can be put and taken back out.

Functions

mcp_account

The account name for an MCP server’s stored OAuth grant.

provider_account

The account name for a provider’s API key.