I kept running into the same problem: either I’d have the agent give me the command, run it myself with the credentials, and copy-paste the output back, or I’d let the agent run it and keep finding secrets in its output.
I looked into alternatives and asked friends, but the only workable approach I found for my workflow was writing custom wrappers around CLIs to handle authentication. I got tired of the back-and-forth, rotating leaked tokens, and maintaining wrappers, so I built Keyclasp.
Keyclasp stores credentials in a local encrypted vault. The agent works with secret names and selects what a command needs:
keyclasp run --project myapp --environment dev --env API_KEY -- npm test
Enter fullscreen mode
