What is keymitt

keymitt lets AI agents use your credentials without the credential values ever entering the agent's context. It is an MCP server plus a command-line tool, and it runs on your own machine.

The problem

Sooner or later an agent's task needs a credential: an API token, a database password, a deploy key. Today there are three options, and none of them is good:

Option	What goes wrong
Paste it into the chat	It now lives in the transcript, forever, wherever transcripts go.
Put it in a file the agent can read	The agent reads it — and quotes it back in a summary or a log.
Do that step yourself	You become the agent's hands, and the automation stops being automatic.

keymitt is a fourth option: the agent uses the secret by name, and never sees its value.

How it works

1. The agent writes a placeholder such as {{secret:github}} in a request — in a header, in text for a program's stdin, in an environment variable or in a temporary file.
2. keymitt checks the policy: may this secret go to this program, or to this host?
3. keymitt asks you to approve the exact request, with Touch ID or your password on macOS, Windows Hello on Windows, or polkit on Linux.
4. keymitt reads the value from the OS keychain and substitutes it at the last moment.
5. Everything that comes back — stdout, stderr, response headers and body — is redacted before the agent sees it.

What the agent can do

keymitt exposes five tools:

Tool	Purpose
list_secrets	What secrets exist and how each may be used — never values
run_with_secrets	Run a program with secrets in stdin, env or temp files
http_request	Let keymitt send an HTTP request to an allowed host
read_file_redacted	Read a config file with credentials masked
request_secret	Ask you to store a secret it needs, with a ready-made command

There is deliberately no tool that returns a value, exports secrets or changes the policy.

Redaction

Before anything is returned to the agent, keymitt replaces the values of all registered secrets — not only those used in the request — with [REDACTED:NAME]. It also catches the forms a value takes most often in output: base64 (at any alignment inside a larger blob), URL encoding, hex and JSON escaping. Redaction happens before output is truncated, so a value sitting on the cut cannot leak half of itself.

read_file_redacted adds a second layer for config files: anything that looks like a password, token, private key or a password inside a connection string is masked too.

What keymitt is not

keymitt prevents accidental exposure and makes every use of a secret visible and approved. It is not a sandbox against an agent that is deliberately malicious and can run any command as your user. The security model spells out the difference.