You Just Shared Your API Key With an AI. You Didn’t Even Notice.

A developer has released concealer, an open-source, local-only AI secret manager that keeps API keys encrypted on the user's machine while still allowing AI coding agents to use them. Built as a single Python 3 script with no pip dependencies, it wraps SOPS and age for encryption and exposes an MCP server so agents can request secrets by name and run commands with them without the plaintext ever entering the model's context. The tool adds typed secrets, project and environment scoping, a web console, and an HMAC-chained tamper-evident audit log.

TL;DR — Coding assistants read your repository to help you. The moment an API key lands in a .env file, it can end up in a chat transcript, a log, or a bug report. concealer is a local-only, open-source AI Secret Manager that keeps secrets encrypted and on your machine — while still letting your agents use those secrets without ever seeing them. For a decade, the .env file was a reasonable compromise. Plaintext, sure — but it sat on your machine, git ignored it, and you were the only one reading it. Then our editors grew a brain. An AI coding assistant has to read your files to be useful; that's the whole job. It scans the repo, suggests fixes, runs commands, pipes the output back into a model. And somewhere in that repo sits a file that starts like this: OPENAI API KEY=sk-live-... AWS SECRET ACCESS KEY=wJalr... DATABASE URL=postgres://user:hunter2@db:5432/prod That key is now one cat .env away from a context window. You can guess the rest: All of these are real leak paths, and none of them existed when .env was invented. The threat model moved. Our tooling stayed put. If you don't write code for a living, picture this instead. You've hired a wonderfully capable house assistant. They tidy up, remind you about bills, find any document in seconds. One small detail: for years you've been writing all your passwords on a sticky note on the fridge. The assistant doesn't need to be malicious — they do their job by reading your house , and that note is part of the house. What concealer does is, at its core, exactly this simple: it takes the note off the fridge and puts it in a locked drawer. The assistant can still ask what's in the drawer — "is the electricity account on file?" — and hears "yes, it's on file." They can say "pay this bill" and the bill gets paid, but the card number never leaves the drawer. And every time anyone opens the drawer, it goes into a ledger. The rest of this post is the technical version of that drawer. Even if you never touch a terminal, the idea carries: let the assistant do the work, without ever showing it the secrets. The reflex answer is "just use a secret manager." Look at what that actually means in practice: .env files What I wanted was narrower, and I think more honest about how we actually code now: Local-only. No cloud, no account, no telemetry. Portable — copy the files, type one password, decrypt anywhere. And designed with agents in mind, so an assistant can use a secret without the value ever entering its context. Nothing on the shelf did all four. So I sat down and wrote it. concealer is a single Python 3 script standard library only, no pip dependencies wrapping two battle-tested tools: On that foundation it adds what you'd actually want from a secret manager : typed secrets, scoping by project and environment, a web console, a tamper-evident audit log, and — the part I care about most — an MCP server so AI agents can use secrets safely . All the encryption is deliberately left to SOPS and age; concealer doesn't invent its own cipher. The only crypto it does itself is verifying your password with the standard library's scrypt and chaining the audit log with HMAC. Boring, I know. In security, boring is a compliment. The whole system on one page: five interfaces funnel into a single-file core that shells out to SOPS + age. Neither the encrypted vault nor the keys ever leave your machine. This is the part that separates concealer from just another vault — the part that makes it an AI-era tool. concealer ships with an MCP server Model Context Protocol — the standard way agents talk to tools . An agent can do two things: The plaintext never enters the agent's context. Not on the way in, not on the way out. The agent asks for names, then asks concealer to run a command with a named secret. The value lives only inside the child process; the output comes back redacted; the whole exchange lands in the audit log — names and actions only, never values. And since "an agent that can read secrets" is a risk all by itself, concealer stays on the cautious side and guards against bulk theft too: Think of a valet key: the valet can park your car but can't open the trunk. The agent never holds the key — concealer turns the lock, and the agent only sees the result. Here it is live — Claude Code using a Home Assistant token through concealer MCP; the value never enters the agent's context: Same vault, whichever way you like to work. Set, read, run-with, and deploy secrets from the terminal, scoped by tenant / project / environment / repo. cer run injects values into a child process and scrubs them from its output — the value never touches your terminal. cer set --name OPENAI API KEY --project web --env prod 'sk-DUMMY-123' cer run --project web --env prod npm run deploy Run concealer web and open http://127.0.0.1:8787 . Forms that adapt to the secret type, searchable filters, per-secret deploy templates, clipboard copy that clears itself, dark / light / matrix themes, full TR/EN localization. localhost only — this is your console, unlocked with your master password. The main vault view: secrets filtered by project and environment, values masked until you reveal them. Secrets are typed , not just key/value blobs: database credentials, cloud keys, web logins, custom multi-field records — each with the right fields and the right masking. A database record with structured fields. Masking is record-aware: a value that looks like user:pass@host gets masked even in a "plain" field. A secret manager should also help you find your risk. That's what the risk dashboard in the Web UI is for: values reused across secrets, overly broad scopes, even a scan of your shell history for keys you forgot there. And every action shows up in a tamper-evident audit viewer : Each line is appended to an HMAC-SHA256-chained log with a monotonic sequence number and a tail anchor — deletions and reordering stand out. Names and actions only, never values. If you'd rather stay in the terminal, concealer tui opens a full-screen browser: arrow keys, instant filtering, type-aware editing, add / delete / reveal — no browser tab in sight. Covered above: register an agent, hand it a revocable token, and it can use secrets it never sees. concealer agent register <name . Sometimes you just need to paste a value into a web form. The Chrome extension opens your vault and copies values straight from the toolbar. Multi-field records expand for per-field copy and reveal; the popup locks itself when idle. Without overselling it — concealer's security comes down to a few deliberate choices: age-key.txt.age , gets decrypted in memory, and is handed to SOPS through an environment variable — not a temp file. CONCEALER TOKEN ; disk holds just its scrypt hash and a token-wrapped copy of the key. Tokens can be revoked and can expire. Humans get a short-lived one via unlock ; agents get a long-lived but revocable one via agent register . init prints eight one-time codes, shown once. Rotating the master password No security model is magic. But everything here is written down, readable, and the actual cryptography is left to tools that have earned their trust. Your vault is just a handful of files. Copy keys/ and secrets.enc.yaml to a new machine, type your master password, carry on. No Keychain migration, no TPM binding, no "recover your account" flow. That portability is a choice, not an accident: your secrets belong to you, on hardware you control. concealer is one readable Python script, MIT-licensed. No black box, no account, no telemetry. Run it behind a firewall and confirm for yourself that it never phones home — because it doesn't. That's the whole point of a local-only tool: you don't have to trust me. Read the code, watch the network. install pulls in sops, age and expect brew install fxerkan/tap/concealer macOS / Linux or: pipx install concealer · scoop install concealer Windows create the vault — prints recovery codes + a CLI token, once concealer init unlock your shell session ~8h token eval "$ cer unlock " store & use a secret — the value never touches your terminal cer set --name OPENAI API KEY --project web --env prod 'sk-DUMMY-123' cer run --project web --env prod npm run deploy That's it. Encrypted, organized, portable — and safe to hand to an agent. We opened our codebases to models because they genuinely make us faster. I still think that was the right call. But "the assistant can read everything" and "my secrets sit in plaintext right next to my code" are two sentences that should never have been allowed to be true at the same time. concealer is my attempt at making them coexist safely: keep the secrets encrypted, keep them local, keep them out of every transcript — and still let the agent do its job. Stop pasting keys into chat windows. concealer will take it from there. Links brew install fxerkan/tap/concealer · pipx install concealer · scoop install concealer If this post was useful, a ⭐ on GitHub genuinely helps others find the project — the name collides with a makeup product, so discovery is half the battle. Questions or feedback: concealer@fxerkan.com .