key-amnesia

An Apache-2.0 secrets manager for coding agents. The agent uses an API key without ever reading its value.

How it works

• A client and a daemon talk over local IPC. The secret never crosses into the agent’s process.
• Identity is checked at the OS level — the daemon verifies what the calling process actually is, rather than trusting what it claims to be.
• An admission policy runs per call, so a dangerous tool call is stopped before it runs, not audited after.
• The child process’s output is censored, because a key that reaches a log has leaked whether or not anyone read the log.
• Every use is written to an audit trail, which makes a secret’s use attributable.
• A shipped SDK hooks three third-party agent platforms — Claude Code, Cursor and Codex — through their own permission systems. That is how an agent someone already uses calls the daemon instead of being handed the secret.

The part that is actually hard

• The three platforms move underneath the SDK constantly. Three upstream APIs, on their own release schedules, none of them mine.
• A drifting schema does not throw. It silently stops protecting someone, and the run still looks successful. That is the failure mode worth designing against.
• The test suite is the product as much as the code is. 537 tests on every release, against Python 3.10–3.13, on Windows and Linux.

Sixteen releases in nine weeks, 0.3.2 to 0.4.15.