Alpha / macOS / Secure Enclave

Your secrets.
Your Mac.
Your call

Your agent shouldn't eat your secrets. Karambit eats them first. Move them out of .env files into an encrypted vault on your Mac. Agents run commands that use them; Karambit redacts exact copies from the output and keeps Touch ID between agents and what matters.

Install from source See how it works

The program you launch still gets the value. Karambit keeps it out of the agent's context.
Know what it does not protect.

SAMPLE OUTPUT · NOT A LIVE TERMINAL
karambit / local session
$ karambit eat
# .env values move into the vault;
# .env.schema keeps the names, no values

$ karambit lease grant 'stripe/*' --hours 1 --cmd ./deploy.sh
[ touch id ]
temporary access granted.

$

How it works

Keep secrets close.
Make access deliberate.

Keys that never
leave this Mac.

Each secret is encrypted with its own key (ChaCha20-Poly1305). Secure Enclave keys that cannot be exported wrap those keys. The Touch ID key guards the secrets that need you; the no-prompt key serves the ones agents may use freely. An offline paper key is the way back.

Hardware protection has boundaries

Four levels. Your choice.

Agents + Touch ID

Agents: after you approve, or within a lease.

Touch ID on each use, or grant a lease limited by time, folder, command and number of uses. The launched program still receives the value.

Select a bar to explore access levels.

An offline way back

Paper is part of the backup.

Setup shows your backup key once. Write it down and type it again to confirm. If you lose your Touch ID keys, karambit recover uses it, and refuses, changing nothing, if the key cannot open every secret. Check the sheet now and then.

karambit backup verify

Eat your .env files.

Move a project's .env secrets into the vault and keep a .env.schema with names only. Your npm scripts keep working through karambit run. secure rebuild puts the originals back.

karambit eat

Leases, not blanket access.

Give an agent temporary access, limited by time, folder, command and number of uses. Pin scripts, not shells. Need everything to stop? Block all agent requests until you unblock.

karambit block --all

AWS without keys in the environment.

Keep AWS access keys or an IAM Identity Center sign-in. The AWS CLI and SDKs fetch credentials from a local endpoint. Optionally trade a long-term key for one-hour sessions.

karambit aws PROFILE -- aws s3 ls

Cheat sheet

The commands
you’ll use.

$ karambit add stripe/key

Add a secret. The value comes from a hidden prompt or stdin, never the command line.

$ karambit run -e KEY=stripe/key -- ./deploy.sh

Start a program with the secrets it asks for; exact copies are redacted from its output.

$ karambit eat

Move a project's .env into the vault. Alias of karambit secure.

$ karambit lease grant 'stripe/*' --hours 1

Grant an agent temporary access. Add --cwd, --cmd or --max-uses to narrow it.

$ karambit call ci-status JOB

One fixed CI build-status request (Jenkins-compatible API). The credential stays in Karambit. Not a general broker.

$ karambit audit --verify

Check the audit log's hash chain. It has no key, so it is not proof against same-user tampering.

$ karambit run --jail -- npm test

Experimental macOS sandbox for the launched program. Not a security boundary.

$ karambit doctor --agent-env

Probe what this environment can reach with a synthetic canary. A pass is not a guarantee.

Know the boundaries

Less secret sprawl.
Not a magic shield.

Alpha software, not independently audited. Read the threat model before you trust it with anything.

The launched program has the secret.

karambit run puts the value in the program's environment. That program can read, copy or send it, and other processes running as you can read its environment while it runs. Karambit keeps the value out of the agent's context; it does not make the program safe.

Redaction is not a sandbox.

Karambit removes exact copies of non-public values from stdout and stderr. It does not catch encoded copies (base64, hex, URL encoding), files the program writes, network traffic, or values the program fetches on its own.

Same-user processes remain a threat.

No-prompt secrets are readable by any program that runs as you. Use a Touch ID access level for anything important: Touch ID is the backstop. This is not a separate-user boundary.

Agent detection is a heuristic.

Karambit recognises agents by process ancestry and environment markers. A process that double-forks and clears its environment can look like a human. Run karambit doctor --agent-env from a plain shell and from inside your agent, and compare.

Build from source / macOS

Seal your
first secret.

Needs git, Rust, the Xcode command line tools and Node. Linux and Windows are on the roadmap.
Run it from a plain terminal, not from an agent session.

Open source · Apache-2.0
git clone https://github.com/AmazingCarbon/karambit
cd karambit
./install.sh
karambit init --paper

Review the installer first. Builds are ad-hoc signed on your Mac, not notarized. Upgrading restarts the daemon and ends active leases.

Start with a paper backup key.
Then tell your agent: docs/agents.md.