Automic Vault

brew package intelligence

qwen-code

Automic Vault tracks qwen-code because plain text qwen code api keys matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about qwen-code

AI-powered command-line workflow tool for developers

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text Qwen Code API Keys

Qwen Code supports storing provider API keys in ~/.qwen/settings.json under the top-level env object. Our isotope stores that settings file in the macOS keychain and injects it into a temporary QWEN_HOME only while `qwen` runs.

Local README excerpt

qwen-code Radioisotope

Qwen Code can store provider API keys in ~/.qwen/settings.json under the env object. The radioisotope migrates that settings file into the Automic Vault keychain and injects it into a temporary QWEN_HOME while qwen runs.

The source settings file is replaced with an empty JSON object after migration so provider API keys are not left in plaintext on disk.

Caveats

  • This isotope currently protects API keys stored in the top-level env

settings object.

  • Deprecated Qwen OAuth oauth_creds.json tokens are not migrated.
  • Settings changes made while the wrapper runs are written to the temporary

QWEN_HOME and are not persisted back to the keychain.

  • Direct execution of the original binary will not receive credentials.

Source: data/radioisotopes/qwen-code/README.md

Caveats

  • Only top-level env API key settings are migrated.
  • Deprecated Qwen OAuth oauth_creds.json tokens are not migrated.
  • Settings changes made while qwen runs are not persisted back to keychain.
  • Direct execution of the original binary will not receive credentials.

install metadata

Resolver facts

Package keybrew:qwen-code
Last updated2026-05-22T13:08:14Z
Pulseupdated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • Nucleus package database
  • local isotope README
  • radioisotope security manifest