From the creator of Homebrew

Your secrets manager should know what the secrets do.

Automic Vault moves supported credentials out of plaintext files. It checks the Tool, Verified Launcher, Target, command, arguments, working directory, and requested Secret Names before applying one.

Your existing commands still work, and agents need no plugin.

Download for macOS See how it differs

Automic Vault approval gate showing ChatGPT requesting a GitHub token, with Deny and Approve Once controls

01One credential, different decisionsgh issue list can run while gh auth token still needs Approval.
02Terminal and Codex get separate rulesPolicy follows each Verified Launcher.
03Use API_TOKEN across projectsThe working directory selects the Project Value.

Most vaults check access. We check the operation.

Most secrets managers check an identity and Secret Name before returning the stored value. Automic Vault evaluates the complete Authorization Request before applying a Secret.

Typical secrets manager

Is the vault open to you?

RequestGITHUB_TOKEN
CheckUnlocked and allowed?
ResultReturn the raw value

Automic Vault

Should this exact operation use it?

Who is asking?: Verified Launcher
What wants it?: Tool and Target
What will it do?: Command and arguments
Where will it run?: Working directory
Which credential?: Secret Names and Value sources

Authorization Gate Evaluate the complete request

Apply to Target
Ask for Approval
Deny

The local execution boundary

The decision happens on your Mac.

Automic Vault moves supported credentials out of readable tool configs. When a Tool requests a Secret, the app evaluates the complete request on the Mac where it will run.

Verified Launcher
Tool and Target
Command and arguments
Working directory
Secret Names and Value sources

The boundary

Automic Vault controls Secret Application. After the handoff, the Target controls the Secret in its memory, helpers, child processes, and output.

Policy follows verified software

Set separate rules for Terminal and Codex.

Terminal, Codex, and an unknown process can invoke the same executable. Automic Vault identifies the Verified Launcher and gives each Tool–Launcher pairing its own Authorization Policy.

Automic Vault Access Levels for the default policy, Terminal, and ChatGPT

Installed packages must cross the same boundary to use protected secrets. Supply-chain attacks such as the 2025 Shai-Hulud npm worm target credentials available to developer tools. Defense in depth still matters: run npm i in a dedicated terminal with low-to-no privileges in both Automic Vault and macOS TCC.

$ av save API_TOKEN
$ av save --project-directory=. API_TOKEN

$ av inject +API_TOKEN -- npm test

Nearest Project Value → Global Value

Project Values

Use the same Secret Name across projects.

A Secret Name can have one Global Value and multiple Project Values. Automic Vault selects the nearest value for the physical working directory. Every project can request API_TOKEN.

The Project Directory selects a value; it does not grant authority. The complete operation still crosses the same Authorization Gate.

This works with tools such as dotenvx: keep its project decryption key in Automic Vault, then apply it only to the reviewed dotenvx operation.

Temporary Access Grants

Give one agent task ten minutes of Write Access.

An eligible Codex task or Claude Code session can receive a visible, in-memory Temporary Access Grant for ten minutes. The grant is bound to the exact Verified Launcher, Tool-specific gate, runtime posture, and agent task.

It ends on expiry, inactivity, display sleep, update, service termination, or when you click End. It never covers direct secret access, mutation, disclosure, elevated application, or unknown operations.

Temporary Access Grant

Ten minutes for one task and one Tool

The task identifier narrows the grant; the Verified Launcher remains the identity boundary.

Blessed Script

Bind exact code to declared capabilities

A Blessing binds the path, contents, Secret Names, and Tool capabilities. Any edit invalidates it.

1 · iPhone

Join through iCloud Keychain

Open Automic Vault on an iPhone using the same iCloud account, enable iPhone Approval, and allow notifications.

2 · Mac

Remove the local allow action

Open Settings → iPhone Approval on the Mac. Once enabled, every human Approval for that Mac goes to an eligible iPhone.

iPhone Approval

Keep Approval controls away from agents on your Mac.

The iPhone carries your decision. The Mac still verifies the complete Authorization Request, rejects stale responses, records the decision, and enforces it. Secret Values and Authorization History stay on the Mac.

Routine requests can offer Approve Once in an authenticated notification. Unknown operation risk, Secret Disclosure, Unconstrained Secret Application, and security warnings require the full app. If the phone or relay is unavailable, the request waits until its Gate Client cancels. The Mac never restores an allow button.

Mind the mirror

iPhone Mirroring and Show on Mac can expose Approval controls on the Mac when biometrics are off. Disable them, or require Face ID or Touch ID on every eligible iPhone.

Current protection paths

Each Tool gets its own credential handoff.

AWS, Docker, Homebrew, and project scripts use different credential paths. Each Hardener changes the path for one Tool.

AWS

Short-lived credentials per invocation

Long-lived default keys leave ~/.aws/credentials. Normal commands receive short-lived STS credentials from a native helper.

Docker

Gate credentials by process and registry

The gate verifies the live vendor-signed Docker process, ancestry, arguments, and requested registry before release.

Launcher Bundles

Identity for a single-file Mach-O CLI

An exact enrolled snapshot is signed, installed root-owned, and revalidated on every request.

Homebrew

Set separate rules for reads and writes

Read & Update can allow inspection and brew update while installs and upgrades still require Approval.

Direct Secret Gate

Allow an exact Secret Name and Launcher

Exact Secret Name and Verified Launcher rules cover rare cases that cannot use a Tool-specific gate.

Detection

Over 100 developer configurations

Continuous Detectors report supported Exposures and Hazards with concrete mitigation steps.

Local request history

Authorization History stays on your Mac.

Allowed or denied, policy or Approval: requests leave bounded local history with the decision, Launcher, Secret Names, command, and working directory.

Decision
Launcher
Secret Names
Working directory

Automic Vault Authorization History showing denied and allowed gh requests with Launcher, Secret Names, and working directory — Denied and allowed requests share the same local history.

Automic Vault Detectors screen showing Homebrew flagged as mutable with trigger conditions, rationale, and a hardening command — Each flag includes its trigger, rationale, and mitigation steps.

Find plaintext and ambient credential access.

Automic Vault scans developer Tools across ecosystems. It reports supported plaintext, environment, Keychain, helper, launcher, and configuration Findings and shows how to mitigate each one.

Security boundary

The boundary ends at the Target.

Automic Vault controls supported Secret Application and sensitive Tool operations at the Local Execution Boundary. macOS handles general process and filesystem security. Root or kernel compromise and arbitrary local destruction remain outside the product boundary.

Code signing proves identity and integrity, not intent. A compromised Target can leak a received Secret. Project paths select Values, and agent task identifiers narrow grants. Neither establishes identity.

Read the security model and CLI manual

Automic Vault rule allowing direct GitHub token access to gh only when Terminal.app launches it — The same CLI can receive different authority from Terminal, an agent harness, or another host app.

Free and open source.

Automic Vault costs nothing. The optional paid iPhone app moves every human Approval off the computer running the command.