AI tools: credentials

An agent can wire up a project, log you in and push to git without holding a password or a key. Every use is approved by you and written down with the agent’s name.

Keys per tool

Every tool that talks to Claspt has its own key under its own name, stored only as a hash and shown once. A key is Notes scope (secret values are redacted, secret writes refused) or Secrets scope (values can be read, with approval). claspt mcp install <tool> --secrets issues the second; Settings › Integrations › API Clients lists and revokes them. The agent never gets your master password.

Approval

When a Secrets-scope tool reads a value, the desktop asks. The prompt names the client, shows the page, and shows how many secrets that client read in the last minute. Allow it once, allow every client until the vault locks, or allow this client for this page until you revoke it. Standing approvals are listed under Settings › Security › Secrets.

Separately, each client may decrypt at most 15 secrets a minute (adjustable from 1 to 600). Past that it is told to wait, and the attempt is logged. It is a brake, not a lock.

The access log

Every request to the local API is recorded: when, which client, what it did, on what, and the result. Failed attempts too. Values, never. Settings › Activity and claspt log. The log is an owner-only file, not a signed chain.

Secrets by reference

A secret has an address: claspt://secret/<page>?block=<label>#<field>. The API and the MCP tools hand these back with every credential they list, so an agent can wire a project up with a secret it never held.

.env

DATABASE_URL=claspt://secret/credentials/postgres.md?block=Production#url

claspt run -- npm test          # the value exists only inside that process
claspt inject config.template   # fills a template's references

Every read by reference passes the same approval, brake and log.

Log me in

An agent can ask Claspt to log you in on a site. You approve in the app, the desktop hands the credential to the browser extension for that one fill, the extension fills and submits the form, and the agent is told whether it worked. The password never reaches the agent, the browser with the extension must be open, and the extension refuses non-HTTPS and mismatched domains.

SSH keys that never leave the vault

Turn on Settings › Integrations › SSH agent and point ssh at it with claspt ssh. Keys stay encrypted in the vault; ssh and git ask the agent to sign, you approve (or grant once per key), and the key is decrypted for that one signature and dropped. OpenSSH keys (ed25519, ECDSA, RSA), on macOS, Linux and Windows; the app must be running and unlocked.

The write guard and the audit

A write that reaches the vault through the API is checked first: if it carries a recognisable key outside a secret block (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, Google, private-key headers, JWTs, connection strings with a password, and more), it is refused with the pattern and the line, never the value. It is pattern-based and deliberately conservative, and it does not apply to typing in the editor. claspt audit lists anything already sitting in the vault unencrypted.

Without the desktop app

claspt serve runs the local API on a server, a build box or a CI runner: it unlocks from a key file made once where the vault password is typed, and decides every request from a policy file, deny by default. Same keys, same brake, same log. A machine that can run it can read what the policy allows; the key file and its passphrase belong on that machine only.