Every SDK, .env file and AI agent asks for the raw key, and once it exists in plaintext it gets pasted into a chat, committed to git, printed in a log, or handed to a contractor you'll never see again. Unseenkey keeps the key in an encrypted vault on your machine and hands out a handle instead. The handle looks like a key to whatever receives it, but it only works through the local broker, which swaps it for the real key at the last moment, checks a policy, scrubs the key out of the response, and writes every call to a tamper-evident log.
A leaked handle costs you nothing. A leaked key costs you until you notice.
Status: v0.1, alpha. Works and is tested on Windows, macOS and Linux. Not yet externally audited: use it with keys you can rotate. Delegating keys to other people through a hosted broker is designed, not built.
How it works
Two minutes with Claude Code
usk init # pick a password; write down the 24 recovery words
usk add anthropic # paste the key at a hidden prompt; provider detected, host-locked
usk env anthropic --policy chat # prints ANTHROPIC_BASE_URL + ANTHROPIC_API_KEY=usk_h_…
claude -p "hello" # Claude Code now calls Anthropic through the broker
usk log # every call, hash-chained
--shell powershell|cmd|dotenv prints the variables for your shell or .env. The daemon starts itself on first use, listens on loopback only, and locks after 15 minutes without a request or when the screen locks or the machine sleeps.
Or give Claude Code the tools. With usk on your PATH and a vault (usk init), the Claude Code plugin connects itself on first use; Claude then calls APIs through Unseenkey and never sees a key:
claude plugin marketplace add Bhagyesh97/unseenkey
claude plugin install unseenkey@unseenkey
Use the plugin or usk mcp install claude-code, not both, or Claude Code gets the tools twice. The plugin needs Unseenkey 0.1.7 or later.
What a handle can do
| |
|---|
| Policy per handle | Presets for each provider (stripe:payments = take payments, no refunds or payouts), explained in plain English. Expiry, request caps, time windows, approvals. |
| Hard caps | --cap 500/day: the 501st request is refused before it leaves the machine. |
| Canaries | --canary: a handle that never works. Plant it in .env.example; any use means someone has your files, and the vault locks. |
| Incident responses | A burst of refused requests throttles, pauses, asks you, or locks the vault — your choice per handle. |
| Approvals | Live prompts in the desktop app or usk approve: allow once, allow always, deny. |
| Camouflage | Handles shaped like the provider's own keys (sk-proj-usk-…) for SDKs that validate formats. Every format carries the usk marker. |
| AWS and OAuth2 | boto3, the AWS CLI and the JS SDK sign with a placeholder; the broker re-signs with the real key. OAuth2 refresh tokens stay in the vault; the broker keeps the access token fresh. |
| MCP server | The Claude Code plugin, or usk mcp install claude-code (or claude-desktop, cursor, windsurf): the agent gets tools, never values. A tool connects itself on first use; taking over or reconnecting an existing one needs your password. |
| Projects | Group keys by the app that uses them. usk project protect (or "Protect a project" in the app) moves a folder's .env keys into the vault in one step; AI tools working in that folder see only its keys, and a daily request limit per project stops a runaway bill. |
.env guard | usk guard fix .env moves real keys into the vault and rewrites the file with handles. |
| Desktop app | Projects with a status panel, keys, agent access, approvals, activity with chain verification, one-click MCP setup, Windows Hello, signed auto-updates. |
More of the same:
usk handle create stripe --policy payments --expires-days 7 --cap 500/day # for a contractor: gone next week
usk handle create stripe --canary # a tripwire for .env.example
usk add aws-dev && usk env aws-dev # boto3 and the AWS CLI through the broker
usk add google-oauth # paste a refresh token or gcloud's ADC file
usk run --with DATABASE_URL=prod-db -- ./app # for what cannot be proxied (audited, scrubbed)
Why not just…
| A .env file | A secrets manager (Doppler, Infisical, 1Password CLI, Vault) | Your own proxy | Unseenkey |
|---|
| Your AI tool never sees the real key | No | No, it is injected into the process | Yes | Yes |
| Works offline, no account | Yes | Usually needs an account or a server | Yes | Yes |
| Rules per call: host, path, method | No | No | If you build them | Presets for 65 providers |
| Asks you before risky calls | No | At most for reading a secret, not per call | If you build it | Yes, confirmed with Windows Hello or your password |
| Removes the key from responses | No | No | If you build it | Yes, streamed and compressed too |
| Spending limits | No | No | If you build them | Per handle and per project |
| Tamper-evident log of every call | No | Logs secret reads, not API calls | If you build it | Yes |
| AWS signing and OAuth refresh | The key sits in the file | The key reaches the SDK | If you build them | Done inside the broker |
Already use a vault? Keep it. A vault stores keys; Unseenkey stops them reaching the agent. Importers for 1Password, Bitwarden and the OS keychain are on the roadmap (#4).
Built your own proxy? So have others: Infisical Agent Vault, fnox and OneCLI share the core idea. Unseenkey focuses on the person who owns the key: a desktop app with approvals, AWS re-signing, OAuth refresh, canary keys, a log that catches deleted entries, and next, lending a key to someone you hire.
Install
scoop bucket add unseenkey https://github.com/Bhagyesh97/scoop-unseenkey && scoop install usk # Windows
brew install Bhagyesh97/unseenkey/usk # macOS, Linux
winget install Unseenkey.Unseenkey # desktop app, Windows (listing under review)
cargo install --locked --git https://github.com/Bhagyesh97/unseenkey usk # from source, Rust 1.85+
Archives and installers for every platform are on the Releases page: CLI for Windows x64, macOS arm64/x64 and Linux x64/arm64; NSIS/MSI, DMG, deb/rpm/AppImage for the desktop app. Every archive has a Sigstore signature, every installer a minisign signature, and each release ships an SBOM. The installers are not yet code-signed, so Windows SmartScreen and macOS Gatekeeper warn on first launch.
Providers
| Provider | Presets | | Provider | Presets |
|---|
| Anthropic, OpenAI | chat, no-admin, full | | GitHub | read-only, contribute, full |
| Groq, Mistral, OpenRouter | chat, no-admin, full | | Stripe | read-only, payments, full |
| Google AI | generate, full | | Slack, Notion, Cloudflare, Vercel | read-only, write, full |
| AWS | s3-read-only, s3, full | | SendGrid, Resend | read-only, write, full |
| Supabase | read-only, data, full | | Twilio | read-only, messaging, full |
Plus 47 more with a safe default, read-only and full each: xAI, Together, Fireworks, Deepgram, ElevenLabs, AssemblyAI, Cohere, DeepSeek, Replicate, Perplexity, Cerebras; Paddle, Polar, Paystack, Mollie, Mercado Pago, Lemon Squeezy, Square; DigitalOcean, Linode, Vultr, Hetzner, Netlify, Render, Heroku, Neon, Supabase management, Hostinger; Postmark, Brevo, Loops, beehiiv, Vapi, Telnyx, Discord bots; Figma, Airtable, ClickUp, Coda, Calendly, Tally, HubSpot, Clerk, CircleCI, Mapbox, YouTube, OpenWeatherMap and Alpha Vantage.
Paste a key and the provider, its allowed websites and a safe default fill in, from the key's shape or, failing that, its name; then one read-only request checks the key works. generic covers any other host, OAuth2 refresh-token clients cover Google and anything RFC 6749, and usk presets lists everything with plain-English explanations. The provider research covers 247 services and is where new presets come from.
Security
- Vault: Argon2id → XChaCha20-Poly1305, one SQLite file, keys locked in memory and zeroised on lock, 24-word recovery phrase, optional Windows Hello.
- Fail closed: each secret is locked to its provider's hosts; unmatched requests, browser-origin requests and anything the broker cannot classify are refused.
- Audit: hash-chained log with a keyed head, so
usk log verify catches edits, gaps, a log cut short and a deleted head; the entry is committed before the response reaches the caller.
- Scrubbing: the real key, its encodings and OAuth access tokens are removed from responses, logs and error messages. The broker negotiates compression itself and unpacks replies before scrubbing; a reply it cannot unpack is refused.
- Owner confirmation: revealing a value, approving a request, enrolling a device unlock, loosening a setting and handing out or changing a policy need an owner token that only an unlock or a fresh password or Windows Hello check gives out. It lives in the CLI's or the app's memory, never on disk. The session token in
daemon.token, which any program running as you can read, is not enough for them.
- Nothing old stays behind: a replaced or deleted value, policy or handle state is erased from the file, not merely superseded.
What it does not do. It stops accidental leaks (chats, git, logs, screenshots, SDK telemetry) and bounds what a dishonest holder of a handle can do. A process running as you with arbitrary code execution can still use an unlocked vault within the care level, add keys, and make care-level handles, and a transparent proxy for tools like gh and git is not built yet. For a hostile agent you also want an OS sandbox. Read the threat model before trusting it with anything; report vulnerabilities privately per SECURITY.md.
Documentation and roadmap
docs/00-README.md indexes the design: vision, decision records, product spec, threat model, architecture, cryptography, broker and policy, data model, API/CLI/MCP reference, implementation plan with as-built notes, testing, operations, UX.
Next is delegation: grant a developer or agency the use of a key with a policy, an expiry, a signed log and a broker they do not control; revoke in one click. Then importers (1Password, Bitwarden, OS keychains), agent-framework plugins, a transparent proxy mode for CLIs, macOS Touch ID, and an attested hosted broker. Order and status in docs/11.
Building and contributing
cargo test --workspace # core, daemon, CLI
cargo install --path crates/usk # puts `usk` and `uskd` on your PATH from this checkout
cd apps/desktop && npm install && npm run tauri dev
See CONTRIBUTING.md. Apache-2.0 for the core, CLI, daemon and desktop app; cloud services, when added, will be AGPL-3.0.
Unseenkey is built by one maintainer. Sponsoring it pays for a first external security audit, code-signed installers and the time to keep fixing security issues quickly.
