Install
brew tap RossNicholson/tap
brew trust --cask rossnicholson/tap/keybar
brew install --cask keybar
Homebrew 7 asks you to trust casks from other taps before installing them. On older versions of Homebrew, skip the brew trust line. The cask also puts the keybar command on your PATH.
Requirements: macOS 14 Sonoma or later, on Apple silicon or Intel.
Updating
Settings → Check for updates → Update KeyBar quits, updates and reopens it. Or run brew upgrade --cask keybar. Installed from the DMG instead, Check for updates opens the latest release's page. Claude Code sessions that were open during an update keep working: their helper notices it's out of date and passes requests through the new one. (Sessions started before 1.4.2 need reconnecting once, with /mcp.)
Connect Claude Code
Open KeyBar, go to Claude Code and click Connect Claude Code. That adds KeyBar's MCP server to Claude Code for all your projects (user scope), using claude mcp add when it can find the claude command and editing ~/.claude.json when it can't. If you leave the option on, it also adds a short marked note to ~/.claude/CLAUDE.md telling Claude to check KeyBar before asking you for a key. Disconnect removes both.
New Claude Code sessions pick it up. Then just ask: "deploy the site with my Cloudflare token". Claude lists the keys, runs wrangler with $CLOUDFLARE_API_TOKEN set, and never sees the token.
To connect by hand:
claude mcp add --scope user keybar -- /Applications/KeyBar.app/Contents/Helpers/keybar mcp
The tools
| Tool | What it does |
|---|
list_secrets | The stored keys' names, services and kinds (e.g. CLOUDFLARE_API_TOKEN: Cloudflare API token), and which are files or expire soon. Never values. |
run_with_secrets | Runs a shell command with the named keys set as environment variables. Returns the exit code, stdout and stderr, with every copy of a key replaced by [REDACTED]. |
request_secret | Asks you for a key KeyBar doesn't have. KeyBar opens Add key with the name filled in and Claude's reason (what it's for, where to make one) above it. You paste the key; Claude only hears that it's stored. |
send_secret | Sends a stored key to a GitHub repo's Actions secrets, or a Cloudflare Worker or Pages project, so a deploy can use it. Always asks with Touch ID, whatever Ask before Claude uses a key is set to. |
Other AI apps
The same screen connects Claude Desktop, Cursor, Windsurf, VS Code (Copilot agent mode), Codex CLI and Gemini CLI: Connect adds KeyBar's server to that app's own MCP settings file and keeps everything else in it. A settings file with comments (which isn't plain JSON) is left alone, and Setup shows the lines to add by hand. Zed is always set up by hand. The activity log names the app that used each key.
| App | Settings file |
|---|
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Cursor | ~/.cursor/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |
| VS Code | ~/Library/Application Support/Code/User/mcp.json |
| Codex CLI | ~/.codex/config.toml (a block between # KeyBar:start and # KeyBar:end) |
| Gemini CLI | ~/.gemini/settings.json |
| Zed | ~/.config/zed/settings.json (by hand) |
Project key lists: .keybar
Put a .keybar file in a project's folder listing the keys it uses, one name per line (Dev tools → Make one… writes it for you). Inside that folder, and the folders under it:
- Claude's
list_secrets only shows those keys, and run_with_secrets refuses any other.
keybar run -- COMMAND sets them, with no --key flags or .env needed.
# The keys this project uses
CLOUDFLARE_API_TOKEN
CLOUDFLARE_ACCOUNT_ID
It holds names only, never values, so it's safe to commit. KeyBar looks for the nearest .keybar going up from the folder, stopping at your home folder.
Find keys on this Mac
Already have keys in .env files? Keys → Find keys looks through the folders you choose for .env files (and .mcp.json), plus export lines in ~/.zshrc and friends, the env of MCP servers in ~/.claude.json, ~/.aws/credentials and ~/.npmrc. It skips node_modules, builds, hidden folders and example files, and only lists things that look like keys.
You tick what to import. The same value found in several projects becomes one key. When two projects use one name for different values, each gets its project's name in front (SHOP_STRIPE_SECRET_KEY, BLOG_STRIPE_SECRET_KEY), and you can rename them. Values KeyBar already has are marked as such.
Then, if you like, KeyBar takes the keys out of your .env files: each value becomes a reference to where it's stored, and other lines stay as they are.
STRIPE_SECRET_KEY=keybar:SHOP_STRIPE_SECRET_KEY
PORT=3000
Run your own commands with keys: keybar run
keybar run -- npm run dev # keys from ./.env's keybar: lines
keybar run --key CLOUDFLARE_API_TOKEN -- wrangler deploy # or name them
keybar run --key TOKEN=SHOP_API_TOKEN -- ./deploy.sh # set a key under another name
keybar run --env-file .env.production -- npm start
KeyBar asks with Touch ID first and shows the command. It asks every time you run it, whatever Settings says about Claude, because its output isn't redacted: a yes is never reused, so nothing can slip a different command in under an earlier approval. Other lines in the .env are set too, unless they're set already, the way dotenv does it, so tools that read .env themselves (Next.js, Vite, dotenv) keep working: the real values are already in the environment. Folder limits apply, and inside Claude Code keybar run refuses and points Claude to run_with_secrets.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
