Keyveil
A local-first way for coding agents to use secrets in commands without putting the secret value directly in the agent’s prompt.
Problem
I wanted a coding agent to run my PR checks with a SonarQube token, without giving the agent the token in plain text. I wanted the solution to work locally, without sending secrets to a service.
Architecture
Secrets live in macOS Keychain. The MCP Bridge can list secret names and run commands through the Keyveil CLI; the CLI resolves "{{SECRET_NAME}}" placeholders locally when the command runs. The Bridge doesn’t retrieve or log secret values. Command output is returned as-is, so a command that prints a secret could still expose it.
What I Built
Outcome
The app, CLI, and MCP Bridge are usable. An agent can trigger a local check without receiving the secret value as part of its prompt; the command’s output still needs to be handled carefully.