Credentials your assistants can use without the password entering the chat.
An MCP server, a command line and agent vaults. In normal use your assistants and scripts work with handles and short-lived files instead of the secret itself.
MCP server
Assistants that speak the Model Context Protocol get tools to find, use and add credentials. Listings and reads show passwords and other secret fields as [PROTECTED] instead of the value. They do show item names, usernames, website addresses, identity details and notes that don’t look like secrets.
Each tool on its own keeps the secret out of its reply. That doesn’t stop an assistant that sets out to get a value, so treat a connected assistant as able to see everything in the vault you give it. It works with a local vault on your computer or with an agent vault; we recommend an agent vault holding only the logins the assistant needs, and running the assistant as a separate user.
search_itemsFind items. Passwords and other secret fields show as [PROTECTED], not the value.
request_handleGet a single-use handle for one field of one item.
materialize_field_to_fileWrite one field to a private temporary file for a tool to read.
type_handle_into_browserType a handle’s value straight into a field in a browser you opened for remote debugging.
generate_totpCheck that a two-factor seed works. It returns neither the code nor the seed; paste_totp types the code.
create_login_from_fileSave a new login from a file, so the password stays out of the conversation.
Single-use handles
An assistant asks for a handle, not a password. The handle can be spent once and expires after 60 seconds by default. A tool spends it, for example by typing the value into a browser field, so the value stays out of the conversation.
Materialise to file
When a program needs the value, the secret is written to a temporary file with owner-only permissions, and deleted when it expires. The value isn’t put into the conversation, a command line or our logs. Anything running as your user can read the file while it exists, including an assistant with shell access.
Command line
Create, unlock, list and sync a vault from the terminal. Secrets are read from files, never from arguments. The command line runs on Linux. The Linux desktop app opens a local vault, not an account vault.
Agent vaults
Each assistant can work from its own vault with its own key, and that key can’t open your personal vault. Its credential is limited to the agent vaults you name, and you can revoke it at any time. Agent vaults are in beta.
The leak contract
A test passes a marker secret through each of our tools, commands, logs and error messages, and the build fails if the marker shows up in what any one of them returns. A new tool without a leak test fails the build too.
It checks each tool on its own. Today an assistant can still recover a value by chaining several of our tools together; we’re closing that route before we invite testers.
Documentation
Install steps and the full tool reference will be shared with invited testers.