Case studySECURITYPERSONAL

Keyveil

A local-first macOS secrets management ecosystem for developers, scripts, and AI agents, built around Apple Keychain.

Problem

Developers, scripts, automations, and increasingly AI agents all need access to secrets — API keys, tokens, passwords — but sharing raw secret values across that many consumers is a real exposure risk, especially once an agent (not just a human at a terminal) is one of the consumers.

Architecture

Apple Keychain is the actual secure storage layer. A native macOS app manages secrets directly; a CLI exposes the same secrets to terminal and automation workflows; an MCP bridge lets AI agents interact with secret references rather than raw values, launching locally on demand over stdio; a Raycast extension adds quick add/access. All four surfaces read from the same Keychain-backed store.

What I Built

A native macOS application for managing secrets.

A CLI for terminal and automation workflows.

An MCP bridge exposing secret metadata and references (not raw values) to AI agents, launched locally on demand via stdio.

A Raycast extension for quickly adding and accessing secrets.

Engineering Decisions

Reference-based access over passing raw secrets

An AI agent that needs a secret gets a reference it can request an injection for, never the value itself. Cost: every consumer has to support the reference model instead of reading a plain environment variable.

Apple Keychain over a custom encrypted store

Reuses OS-level secure storage that's already battle-tested rather than building and maintaining another one. Cost: macOS-only.

Local-first, no server component

Secrets never leave the machine. Cost: no cross-device sync unless it's added later, deliberately, as its own tradeoff.

Challenges

Designing an MCP architecture that only ever exposes metadata and references — never raw values — while still being useful enough for an agent to actually act on.

Keeping the CLI, Raycast extension, and MCP bridge on one consistent access model instead of three divergent implementations of the same idea.

Outcome

Actively used personal tool; under active development (native app, CLI, and MCP bridge all still evolving).

What I Learned

Least-privilege access design gets harder, not easier, once an AI agent is one of the consumers — an agent can't be extended the same implicit trust a human terminal session gets, so the reference model isn't optional, it's the whole point.

Personal · Active

Get in touch All projects