01
Find the key you need.
Group keys by project, search by name or provider, and check expiry dates in one place. Spend less time hunting through old files.
PROJECTS · SEARCH · EXPIRY OPEN SOURCE. ON YOUR MAC.
let your agents build.
keep your keys close.
Keep your API keys in one place on your Mac.
Give coding agents the access they need, without pasting your keys into chat.
an approved handoff
your coding agentMCP
request inject_secretsproject “example-app”keys [“API_KEY”]
requesting access
request
VAULT.OSon your Mac
approved keys
your projectLOCAL
.env.localAPI_KEY=••••••••••••# ready for your app
approved destination
The tool response contains names and counts. No secret values.ILLUSTRATED WORKFLOW
[ 01 ] THE IDEA
another project.
less setup.
New project. Same keys. Another .env file. VaultOS keeps your keys organized and lets your agent write the ones you approve into the right project. You can get on with building.
You choose which projects and folders each agent can access through VaultOS.
[ 02 ] THE ACTUAL APP
all your project keys.
one place on your Mac.
Find a key, check its details, and manage agent access from one desktop app. Your secrets stay organized as your projects grow.
- Organize credentials by project.
- Approve access before an agent gets it.
- Reveal a key when needed. Lock when you’re done.
Apple Silicon & Intel · macOS 13+
Unsigned preview. Start with test credentials.
VaultOS Preview
[ 03 ] YOUR RULES
give each agent
the access it needs.
Keep the keys in your vault. Choose what each agent can do with them. Change its access when the work changes.
02
Choose what each agent can use.
Give each agent its own access. Choose the projects it can use, the folders it can write to, and the actions it can take through VaultOS.
PER-AGENT PERMISSIONS03
Skip the copy and paste.
Let your agent write approved keys into an environment file through MCP. Choose dotenv, JSON, or shell format. The tool response reports what was written without including the values.
SCOPED SECRET INJECTION04
Keep the final say.
An agent needs your permission to edit credentials you own. If it adds a new key, you approve that key before it can write it into a project.
HUMAN APPROVAL05
Keep your vault on your Mac.
Your vault is encrypted and stored locally. There is no account to create, no telemetry, and no automatic cloud upload. You can choose to remember your password in Keychain.
LOCAL STORAGE · OPT-IN KEYCHAIN06
Back it up. Keep it useful.
Make encrypted backups, export a PDF, change your vault password, or review and undo supported changes. Optional encrypted Git sync lets you connect another machine when you need to.
BACKUPS · RECOVERY · OPTIONAL SYNCWHAT IT PROTECTS
less exposure.
clear limits.
VaultOS keeps secret values out of injection responses. The files it writes still contain plaintext secrets, and an agent with filesystem access can read them.
Think of it as a way to organize your keys and control how agents use the vault. It cannot isolate an agent from files on your Mac.
Read the security model[ 04 ] FROM DOWNLOAD TO FIRST PROJECT
three steps.
then get back to building.
Install the preview.
Download the preview for your Mac. Verify its checksum, open it, and create a vault with a passphrase you’ll remember.
Get the previewChoose the access.
Add a project. Enroll your agent. Choose its permissions and the folders it can write to. Save its token in a private file.
Connect your agentLet your agent help.
Give it the setup prompt. It can prepare the MCP bridge and verify a test injection. You handle passwords and approvals.
[ 05 ] A FEW GOOD QUESTIONS
before you
hand over a key.
A few things to know before you get started.
[ 06 ] YOUR NEXT PROJECT
good tools give you
one less thing to think about.
Try it with one project and a test key.
See how it fits the way you work.