keyshroud

Your agents use the keys. They never see them.

keyshroud keeps API keys in your self-hosted Vaultwarden and injects them into the commands your AI coding agent runs. Any secret value that shows up in tool output is replaced with <redacted:NAME> before the model reads it.

Get started Star on GitHub

Free, MIT-licensed, local-only · npm i -g keyshroud

Up and running in three steps

You need Node.js 22.18+, the Bitwarden CLI (bw), and a Vaultwarden or Bitwarden account.

Install

npm i -g keyshroud @bitwarden/cli

One CLI, plus plugins for Claude Code and pi, and an MCP server.

Point at your vault

bw config server https://vault.example.com
keyshroud doctor

Unlock credentials come from your OS keychain. doctor reports what is missing.

Run your agent

keyshroud run -- claude

Or install the Claude Code plugin: /plugin marketplace add dinhkarate/keyshroud

Built for agents, not just shells

Every feature works with names and references, never with values.

Masked output

keyshroud run streams stdout and stderr through a redactor. A secret is never split across chunks and slips through, and masking is on by default when output isn't going to a terminal.

Hooks on tool output

pi tool_result and Claude Code PostToolUse hooks scrub tool results, including commands the agent ran without keyshroud. (Claude Code can't rewrite failed calls, so secret-using commands go through keyshroud run.)

MCP server

keyshroud mcp gives Codex, Cursor and any MCP client secrets_run, secrets_list and secrets_request. None of them return values.

bw:// references

Write GH_TOKEN=bw://GitHub/fields/token in a .env.refs file you can commit. References cover passwords, usernames, notes, TOTP codes, URIs and custom fields.

Inject & scan

inject renders {{ bw://… }} templates into files only you can read (mode 0600). scan finds leaked values in your repo before you commit.

Self-hosted, free

Runs on the Vaultwarden you already host. No SaaS, no account with us, no telemetry. Adding a secret uses a masked prompt, so the value never enters the chat.

Works with your agent

One vault, every coding agent you use. Setup for each is in the docs.

PluginClaude CodeSessionStart and PostToolUse hooks mask tool results; MCP tools and a skill included. Extensionpi / ompHydrates env before provider auth and masks every tool result, failed ones too. MCPCodexcodex mcp add keyshroud -- keyshroud mcp MCPCursor & Claude DesktopOne mcpServers entry. secrets_run returns masked output. MCPCline, OpenCode, Gemini CLIAny client that speaks MCP over stdio. CLIAny shell or CIkeyshroud run -- <cmd> injects env and masks stdout/stderr.

How it compares

The closest tools, side by side. keyshroud is the only one that keeps values out of the model and off someone else’s cloud.

This project

keyshroud

Your vault, masked agent output, plugins for the agents you use.

  • ✓
    Self-hosted vaultVaultwarden or Bitwarden
  • ✓
    FreeMIT-licensed, no account with us
  • ✓
    Masks agent outputEvery tool result, wrapped or not
  • ✓
    Agent pluginsClaude Code, pi, MCP
Commercial

1Password op run

Polished, but your secrets live in 1Password’s cloud.

  • ✕
    Self-hosted vault1Password cloud only
  • ✕
    FreeNeeds a paid plan
  • ~
    Masks agent outputOnly commands wrapped in op run
  • ✓
    Agent pluginsClaude Code, Cursor, MCP
Open source

Bitwarden MCP server

Self-hosted too, but it hands values to the model.

  • ✓
    Self-hosted vaultVaultwarden or Bitwarden
  • ✓
    FreeOpen source
  • ✕
    Masks agent outputReturns plaintext to the model
  • ~
    Agent pluginsMCP only

Also nearby: varlock (env schemas with log redaction) and dotenvx (encrypted .env files). Neither plugs into agent tool output. As of 2026-10-13.

An honest threat model

Redaction is defense in depth, not a sandbox.

Protected

  • Secret values entering the model's context through tool output
  • Secrets pasted into chat while being stored (keyshroud uses a masked prompt instead)
  • Plaintext in agent config and auth.json (only references are stored)
  • Secret values accidentally committed to your repo (caught by keyshroud scan)

Not protected

  • A malicious or prompt-injected agent that encodes a value or sends it over the network
  • Other processes running as your user
  • Values shorter than 6 characters (not redacted, to avoid noise)

Stop pasting API keys into chat

Every key you paste lives on in the transcript, the provider’s logs and every future context window.

Without keyshroud

  • The agent reads .env while debugging and the key lands in the transcript
  • A vault MCP server returns plaintext to the model
  • Keeping keys out of chat means a paid, hosted secrets manager

With keyshroud

  • The agent sees names and bw:// references, never values
  • Any value in tool output becomes <redacted:NAME>
  • Keys stay in your own Vaultwarden, free and MIT-licensed
Get started free Read the docs

npm i -g keyshroud · No account · No telemetry · MIT