Automic Vault
GitHub Download for macOS

From the creator of Homebrew

A new kind of secrets manager for a new era of development.

Automic Vault moves developer credentials out of plaintext files, then controls their application through each Tool and Verified Launcher.

Any agent. Any harness. Zeroconf.

Download for macOS See the boundary work
Automic Vault approval gate showing ChatGPT requesting a GitHub token, with Deny and Approve Once controls

Your agent inherits your access

A prompt cannot protect a secret the agent can already read.

  1. Claude

    Hmm… the remote server doesn’t have AWS access.

  2. Claude

    No problem — I’ll upload the keys from here.

  3. Tool call
    Read(~/.aws/credentials)
  4. Tool result 
    [default]
aws_access_key_id = AKIA••••••••••••
aws_secret_access_key = ••••••••••••••••••••••••••••••••
YOUR AWS KEYS LEFT THE MAC The agent found a reusable cloud credential and uploaded it to a remote server.

Automic Vault keeps your keys on your Mac.

  1. Claude

    Hmm… the remote server doesn’t have AWS access.

  2. Claude

    No problem — I’ll upload the keys from here.

  3. Tool call
    Read(~/.aws/credentials)
  4. No plaintext credential exists for the agent to read
  5. Tool result
    No such file
  6. Claude

    I’ll run the export command instead.

  7. Tool call
    aws config export-credentials
  8. The export command still requires your approval
  9. Automic Vault
    Approval Required

The local execution boundary

Automic Vault controls the secret handoff.

Automic Vault moves credentials out of readable tool configs. Agents and untrusted software cannot find protected secrets in the files they inspect.

When a Tool requests a Secret, Automic Vault checks the Target, Verified Launcher, command, working directory, and requested Secret Name.

How it works

Automic Vault stores the Secret in the macOS Keychain. It applies the Authorization Policy when a Verified Launcher starts the Tool, then supplies the Secret to the designated Target for that run. The Secret is not placed in the Launcher’s ambient environment. The Target controls it after receipt.

Automic Vault approval gate showing ChatGPT requesting a GitHub token, with Deny and Approve Once controls
Command, working directory, and requested Secret Name, visible before anything runs.

Access by app

Policy follows the tool and its launcher.

Terminal, Codex, and an unknown process can invoke the same executable. Automic Vault identifies the Verified Launcher and gives each pairing its own Authorization Policy.

Automic Vault Access Levels for the default policy, Terminal, and ChatGPT
Approval Required
The Launcher receives no durable policy grant. Every operation requires Approval.
Write Access
Recognized reads and writes are automically authorized. Secret Disclosure and Elevated Secret Application require Approval.†
Read Only
Recognized reads are automically authorized. Writes require Approval.

Installed packages must cross the same boundary to use protected secrets. Supply-chain attacks such as the 2025 Shai-Hulud npm worm target credentials available to developer tools. Defense in depth still matters: run npm i in a dedicated terminal with low-to-no privileges in both Automic Vault and macOS TCC.

Authorization History stays on your Mac.

Allowed or denied, policy or Approval: requests leave bounded local history with the decision, Launcher, Secret Names, command, and working directory.

  • Decision
  • Launcher
  • Secret Names
  • Working directory
Automic Vault Authorization History showing denied and allowed gh requests with Launcher, Secret Names, and working directory
Denied and allowed requests share the same local history.
Automic Vault Detectors screen showing Homebrew flagged as mutable with trigger conditions, rationale, and a hardening command
Each flag includes its trigger, rationale, and mitigation steps.

Know when your toolchain turns risky.

Automic Vault scans developer Tools across ecosystems. It reports supported Exposures and Hazards and shows how to mitigate each Finding.

Independent of the harness

Control the tool layer beneath every agent.

macOS can code sign apps, sandbox them, and keep them out of one another’s private data. Command-line tools usually run with the authority of whichever app launched them.

That used to mean Terminal.app. Now it may mean an AI harness, editor, or automation app. Automic Vault identifies the Tool and its Verified Launcher, then applies the Authorization Policy you chose for that pairing.

Read why the terminal needs its own security layer
Automic Vault rule allowing direct GitHub token access to gh only when Terminal.app launches it
The same CLI can receive different access from Terminal, an agent harness, or another host app.

Free and open source.

Automic Vault costs nothing. The optional paid iPhone app moves approval gates off the computer running the commands, so a process on your Mac cannot approve its own request.