keymittAgents use the key. They never see it.

An MCP server that lets AI agents use your API tokens and passwords — from your OS keychain, approved by you, redacted from everything they see.

Get started

What is keymitt

GitHub

$ curl -fsSL https://keymitt.walisayu.com/install.sh | sh

macOS · Linux·Windows (PowerShell): irm https://keymitt.walisayu.com/install.ps1 | iex·Until the first release is out, build from source·Installation

Values stay in your keychain

macOS Keychain, Windows Credential Manager or the Linux Secret Service. Agents only ever see names like {{secret:github}}.

You approve every use

Touch ID or your password, Windows Hello, or polkit — a prompt the agent cannot click, showing exactly what will run and where.

Redacted on the way back

Every byte returned to the agent is scrubbed of all your secrets, including their base64, hex, URL-encoded and JSON-escaped forms.

Never on the command line

Secrets travel through stdin, environment variables, owner-only temp files or HTTP headers — never through arguments other processes can read.

A policy per secret

Decide which programs may receive a secret and which hosts it may be sent to. The agent has no tool to change it.

Backups that move with you

One encrypted file holds your policy and secrets, and restores on any platform. Exporting always needs strong approval.