Local-first credential broker

Your AI agents get access. Never the keys.

Tokenvoy is a local encrypted password and secrets vault for Linux, macOS and Windows. One file holds logins, SSH keys, tokens, databases, Wi‑Fi, cloud consoles and more. Programs get secrets injected into the process; AI agents get titles and redacted output — never the keys.

Download Tokenvoy → See every feature

No cloud, no account Never writes .env files MIT licensed Linux · macOS · Windows

~/shop-api — zshcaller: Claude Code

$ tokenvoy run -- npm start
# .tokenvoy.toml maps env vars to vault items
inject DATABASE_URL   ← shop/prod-db
inject STRIPE_KEY     ← stripe/live
inject SENTRY_DSN     ← sentry/api
> shop-api listening on :8080
> db connected postgres://app:[redacted]@db

$ tokenvoy get stripe/live
refused: agent callers cannot read values

INJECTED

3 secrets went into the child process only. Nothing written to disk. ptrace blocked, child is non-dumpable.

REFUSED

Direct read by an AI agent. The agent sees the item title, never the value.

0 secrets reached the agentvault unlocked by you · idle lock 15 min

Shields your secrets from the AI tools you already use

Claude Code Cursor GitHub Copilot Aider Codex Any MCP client

The problem

Your AI agent can read everything your terminal can

Agents run commands, read files and see output. Every secret that lands in any of those places ends up in a model's context window, and you can't take it back.

.env files sit in plain text

One cat .env from an agent and your production database password is in a prompt, a log, and possibly a training set.

Output leaks what code hides

Connection strings in startup logs, tokens in error traces, keys echoed by a debug flag. Agents read all of it.

Pasted keys live forever

Once a token is in a chat, it's in the history. Rotating it is the only fix, and nobody rotates on time.

How it works

Tokenvoy stands between the agent and the key

Think of a diplomatic pouch: the courier carries it across the border but has no right to open it. Your agent gets the work done; Tokenvoy holds the keys.

You
Unlock once
Type your master password. The session daemon holds the vault open and locks it after 15 idle minutes.
tokenvoy unlock
Agent
Ask by name
The agent asks to run a command. It knows item titles like stripe/live, never their values.
tokenvoy run -- npm start
Tokenvoy
Check who's asking
The daemon identifies the caller from kernel peer credentials, not from anything the caller claims about itself.
SO_PEERCRED → pid
Process
Inject and redact
Secrets go straight into the child's environment. For agent callers, output is redacted and the child can't be memory-dumped.
KEY=value → child only

The rule

One table decides who gets what

Every request is checked against the caller. An AI agent gets far less than you do, and a Sealed item goes to nobody.

Caller	Read a valueget · env · copy · totp	Inject into a programtokenvoy run	MCP server	Browser fill
You, at a terminal	Allowed	Secret + Tool-inject items	—	Allowed
You, via a pipe or script	Only with `--allow-pipe`	Secret + Tool-inject items	—	Allowed
AI agent	Refused, always	Tool-inject items only, output redacted	Titles + run only	Refused
Anyone, Sealed item	Refused	Refused	Refused	Refused

One switch in settings, "Let AI agents inject Tool-inject items", turns the agent's injection access off completely.

Features

A full vault for everything a developer holds

Logins, SSH keys, API tokens, database and server credentials, Wi-Fi, licences. All in one file, reachable from the CLI, terminal UI, desktop app and browser.

One encrypted file

No database, no server, no account, no cloud.

Copy vault.tokenvoy between machines
Opens only with your master password
Argon2id + XChaCha20-Poly1305
Import merge or replace, with a safety copy first

Process injection

Replaces .env files entirely.

Map names in .tokenvoy.toml
tokenvoy run -- npm start
Node, Python, Docker, shell, CI
Nothing written to disk

AI agent shield

Agents work with secrets without seeing them.

Detected by env markers and process ancestry
Kernel peer pid, not a self-report
Output redacted, including base64/hex
MCP server: titles + inject only

Git, SSH and sudo

Helpers for the tools that ask for passwords.

Git credential helper, exact host match
tokenvoy ssh with a vault key or password
tokenvoy sudo -- apt update
Look-alike hosts are never served

Browser helper

Chrome, Chromium, Brave, Edge and Firefox.

Inline fill, two-step email → password
Save / Update / Never for this site
Continue with Google / Microsoft / Apple / GitHub
Generate & fill on sign-up pages

Four ways in

Use whichever fits the moment.

CLI for scripts and daily use
Terminal UI: tokenvoy tui
Desktop app + built-in user guide
Browser helper via native messaging

Backup & sync

Only the encrypted vault is ever copied.

Local folder, USB and synced drives
rclone / S3 / WebDAV via {file}
After each change, hourly or daily
systemd, launchd, Task Scheduler

Watchtower

Audits the vault, not a cloud service.

Weak, reused and missing 2FA
Stale or failed backups
Green / amber / blue status dots
Click a finding to jump to the item

Export for coding

Wire a repo without leaking values.

Readable .tokenvoy.toml (names only)
AGENTS.md playbook for other AIs
Cursor rule + optional CLAUDE.md
Password-protected Excel export

Item types

Everything a developer actually stores

Each item is a free-form list of fields. A few names are load-bearing — url for browser fill, host for git and SSH, totp for 2FA — so features keep working when you stay with the standard names.

Login user · password · url · totp Password Secure note Server password / SSH / PEM SSH key Email Database Wi‑Fi API token Software license Env variable Sudo password Git credential Docker registry

24 cloud types, one template

Console, root / owner, IAM user, access keys, role / service account, SSO, account / project, VM, serverless, Kubernetes cluster, object storage, managed database, NoSQL, container registry, secrets manager, config, KMS, TLS certificate, DNS, CDN, API gateway, app identity, transactional email, billing. Fields you leave blank are not created.

ConsoleIAMAccess keysSSOVMClusterS3 / objectsKMSCertificateSMTPBilling

Exposure levels

Per item, not per vault.

Secret — default; never printed to agents or pipes
Tool-inject — may enter tokenvoy run children
Sealed — never shown, copied, injected or exported

Field kinds

Text, secret (masked), URL, and TOTP.

Custom fields with + Add field
Your own categories, rename or delete
Favorites collected in one view
Demo data titled [DEMO] to try the UI

Keys that span lines

PEM, OpenSSH, PKCS#8, PuTTY — stored byte for byte.

Choose key file reads the file, never a path
Binary .p12 / .pfx refused
tokenvoy add ssh --key-file ~/aws.pem

Desktop app

A native window on Linux, macOS and Windows

Tauri + a local webview. The webview never holds the vault key. Copy runs in Rust. One instance — a second launch focuses the window you already have.

Everyday use

Create or unlock on the lock screen (min 8 characters, strength meter, Caps Lock hint)
Profile setup (name, email) stored only on this device
Change master password re-wraps the vault key
Idle auto-lock (default 15 min, 0 = never) plus daemon idle lock
Unlocking the app keeps CLI, sudo and the browser helper alive
In-app Help & User Guide, Developer docs and Developer settings

Find, edit, copy

Quick find ⌘K / Ctrl+K — titles, users, types
List search ⌘F · add ⌘N · edit ⌘E · lock ⌘L
Reveal ⇄ Hide with a 30s auto-mask; Copy flashes “Copied ✓” and clears
TOTP live code + countdown ring; Copy code never copies the seed
Generate + strength meter on password fields
Unsaved-changes guard; drag to reorder fields

Servers and Wi‑Fi

Server Sign in with Password / SSH key / PEM key
Copy ssh command runs tokenvoy ssh
Wi‑Fi Connect to this network (nmcli / networksetup / netsh)
Live SSID status, Save other, Save nearby
Green row dot when this item is the connected network

Move the vault

Import Merge (keeps yours) or Replace, with Check file first
Timestamped safety copy before every import
Export vault — same ciphertext, needs the master password
Export to Excel — password-protected .xlsx
Export for coding — folder picker, names only

Browser helper

Fill and save without typing the password

Install from Profile → Browser helper, then load unpacked. Tokenvoy stays unlocked. Nothing is typed or saved without your click. HTTPS only (localhost exempt).

On the page

Suggestions under username / email / phone / password fields
Title, search, name and address boxes are ignored
Click, or ↑/↓ + Enter, to fill — two-step pages remember the pick
Save bar: Save, Update, Not now, Never for this site
Captured passwords live 2 minutes in the extension, then drop

Popup and SSO

Fill / Continue with… for matching logins
Generate & fill (8–64 chars, symbols on/off) on sign-up pages
Save this page updates the same site + username
Remembers Sign in with Google, Microsoft, Apple, GitHub
Next visit: Continue with Google as you@…

Offered only on the saved host or its sub/parent domains. Shared platforms such as github.io never match across sites. Sealed items are never offered. Firefox loads as a temporary add-on until a signed build exists.

Developer tools

The CLI your agents are allowed to call

Commands that print values refuse AI callers. Commands that run programs inject into the child and redact its output.

`tokenvoy run`

Inject from .tokenvoy.toml or --item / --map.

tokenvoy run -- npm run dev
tokenvoy run -- docker compose up
Agents: Tool-inject items only

`tokenvoy ssh`

Key → 0600 temp file + ssh -i. Password → short-lived askpass. File deleted on exit.

tokenvoy ssh aws-prod -- uptime
--dry-run prints, writes nothing
IdentityAgent=none so the OS agent cannot steal the answer

`tokenvoy sudo`

Unix only. Prefers classic sudo -A; on sudo-rs feeds -S.

tokenvoy sudo -- apt update
tokenvoy-sudo wrapper, or source it so plain sudo uses the vault
TOKENVOY_SUDO_ITEM picks the item

Git helper

git config --global credential.helper '!tokenvoy git-credential'

Exact host or dotted subdomain — never a substring
Uses the unlocked session; no master-password prompt
GitHub needs a PAT in password, plus optional commit email

Env, shell, MCP

eval "$(tokenvoy env NAME)" is TTY-only.

tokenvoy shell — injected child shell
tokenvoy agent-server — list titles, run_with_secrets
Never returns secret values

Unattended & shield

TOKENVOY_PASSWORD_FILE for cron and CI (preferred over an env var).

tokenvoy --once ssh prod -- uptime
tokenvoy shield writes .cursorignore, .aiexclude, …
Ready samples in examples/ + tokenvoy demo

Backup, import, export

Move machines without a cloud account

The master password never leaves the machine. Backups, exports and the Excel sheet are all ciphertext or password-protected.

Backup & sync

Primary folder + any mix of USB / Syncthing mirrors
Online push: rclone, S3, WebDAV — {file} only
Keep last N; skip if the vault is unchanged
Manual, after each change, hourly, daily
tokenvoy backup now | list | restore

Import / export

Export the encrypted .tokenvoy file
Import Merge or Replace; preview with Check file
Safety copy before-merge-… / before-import-…
Excel / LibreOffice export, same master password
Sealed items show [sealed] in the sheet

Export for coding

Folder: type, paste or OS Select folder
.tokenvoy.toml — ENV = "item/field"
AGENTS.md, Cursor rule, optional CLAUDE.md
Email / SMTP maps host, port, username, password
Optional .env.example or encrypted subset

Platforms

One code base. Native installers per OS.

Behaviour is selected at compile time. You build on that OS — or let CI do it. Linux .deb / .rpm / .AppImage / tarball, macOS .app / .dmg, Windows .msi / NSIS.

Capability	Linux	macOS	Windows
Vault, CLI, TUI, desktop, browser helper	Yes	Yes	Yes
Session daemon	Unix socket 0600 + token	Short socket in `/tmp/tokenvoy-<uid>/`	Loopback TCP + token
Agent detection	`/proc` walk + `SO_PEERCRED`	`ps` + `LOCAL_PEERPID`	Process snapshot + env markers
Anti-debug	Non-dumpable + no cores	`PT_DENY_ATTACH`	User isolation
Sudo helper	sudo.ws or `-S`	`sudo -A`	No sudo
Scheduled backup	systemd user timer	launchd	Task Scheduler
Wi‑Fi connect / status	`nmcli` + nearby scan	`networksetup` (current SSID)	`netsh wlan`
Default vault path	`~/.local/share/tokenvoy/`	Application Support	`%APPDATA%\Tokenvoy\`

Why Tokenvoy

Built for developers who work alongside AI

How Tokenvoy compares to the two things most developers use today.

What you need	Tokenvoy	.env files	Typical password manager
Secrets never sit on disk in plain text	Encrypted file, injected at run time	Plain text in your project	Encrypted
AI agents can't read the values	Refused, and output is redacted	One `cat` away	CLI will print them to any caller
Programs get secrets without code changes	`tokenvoy run -- <cmd>`	Yes	Needs scripts or plugins
Works offline, no account	Always	Yes	Usually needs a cloud account
Git, SSH and sudo helpers	Built in	No	Some
Browser fill, save, SSO memory	Chromium + Firefox helper	No	Yes
Watchtower + rotating backups	Local, USB, rclone / S3	No	Cloud-first
Export a coding kit (names only)	`.tokenvoy.toml` + AGENTS.md	The values are the file	No

Security by design

Nothing leaves your machine. Not even to us.

Tokenvoy has no servers, no telemetry and no account system. The vault is sealed with modern, memory-hard cryptography, and the daemon that holds it open is hardened against the tools most likely to go looking.

Argon2id + XChaCha20-Poly1305The master password is stretched with Argon2id; every item is sealed with authenticated encryption. A tampered file fails to unlock.

Hardened session daemonNon-dumpable on Linux, PT_DENY_ATTACH on macOS. Unix socket 0600 + token, or loopback TCP + token on Windows.

Locks itselfIdle lock after 15 minutes (app and daemon). Override with TOKENVOY_IDLE. Clipboard auto-clears in 30s. Clipboard never goes to an agent.

Roadmap

From vault to broker between agents

Today Tokenvoy guards your secrets from AI agents. Next, it becomes the go-between that lets agents share access safely, with nobody ever holding the key.

Available now

Vault and agent shield

Encrypted single-file vault, process injection, redaction, and the caller rules above.

Planned

Agent-to-agent sharing

One agent grants another access to a resource for a task. Tokenvoy carries the grant; the secret never passes between them.

Planned

Unlock on the agent's behalf

Tokenvoy goes to the resource, opens it with the credential, and lets the agent through. Scoped, time-limited, and logged.

Pricing

Start with a week. Then $2 a month.

Register for a 7-day trial of every desktop feature. After that, Individual keeps the vault unlocked. Enterprise is coming later.

For one person

Individual

$2 / month

7-day free trial after you create an account. Then the desktop app needs this plan — including Wi‑Fi.

All item types on the desktop app
CLI, TUI, and browser helper
Cancel anytime

Start free trial

Teams

Enterprise

Coming soon

Shared billing and seats. Not for sale yet — we will add checkout when this plan ships.

Multiple people on one bill
Admin and seat management
Same local-first vault

FAQ

Questions developers ask first

Can my AI assistant really not read my passwords?

Direct reads by an agent are refused every time. When an agent runs a program through tokenvoy run, only items you've marked Tool-inject are passed in, the program's output is redacted, and the process can't be memory-dumped. Items you mark Sealed are refused to everyone. Unsetting an env var does not bypass the shield — the daemon checks the kernel peer pid and process ancestry.

Does anything go to the cloud?

No. There's no account, no sync service and no telemetry. Your vault is one file on your disk. Optional backup push commands (rclone, S3, WebDAV) are ones you write; Tokenvoy only ever copies the encrypted file.

What happens if I forget my master password?

There is no back door. Nobody can reset it, us included. Keep the master password somewhere safe; backups and the Excel export are encrypted with it too.

How do I stop using .env files?

Add each value to the vault, list the variable names in .tokenvoy.toml, and start your app with tokenvoy run -- <command>. Or use Export for coding to write the toml + AGENTS.md into a project folder. Your app sees the same environment variables it always did.

Which platforms are supported?

Linux, macOS and Windows from one code base. Desktop (Tauri), CLI, TUI and the browser helper all ship. Sudo is Unix-only. Firefox loads the helper as a temporary add-on until a Mozilla-signed build exists.

Can I move the vault to another machine?

Yes. Export the encrypted file, copy it (USB, scp, Syncthing), then Import with Merge or Replace. Override the path with TOKENVOY_PATH. Default locations: Linux ~/.local/share/tokenvoy/, macOS Application Support, Windows %APPDATA%\Tokenvoy\.

Is it free?

The source is MIT. Using the desktop app: register for a 7-day trial of every feature. After that, Individual is $2/month. Without a website account you can still unlock the vault and use Wi‑Fi only. After a trial ends, the app locks every feature until you subscribe — even offline.

Give your agents access, not your keys

Download Tokenvoy for your OS. Windows is a per-user installer, macOS a .dmg, Linux a tarball you unpack and run ./install.sh (no root).

windows

Windows (x64)

macos

macOS

linux

Linux (x64)

After install: tokenvoy init then unlock. Replace the files in public/downloads/ and redeploy to ship a new version — the links stay the same.

Your AI agents get access. Never the keys.

Your AI agent can read everything your terminal can

.env files sit in plain text

Output leaks what code hides

Pasted keys live forever

Tokenvoy stands between the agent and the key

Unlock once

Ask by name

Check who's asking

Inject and redact

One table decides who gets what

A full vault for everything a developer holds

One encrypted file

Process injection

AI agent shield

Git, SSH and sudo

Browser helper

Four ways in

Backup & sync

Watchtower

Export for coding

Everything a developer actually stores

24 cloud types, one template

Exposure levels

Field kinds

Keys that span lines

A native window on Linux, macOS and Windows

Everyday use

Find, edit, copy

Servers and Wi‑Fi

Move the vault

Fill and save without typing the password

On the page

Popup and SSO

The CLI your agents are allowed to call

tokenvoy run

tokenvoy ssh

tokenvoy sudo

Git helper

Env, shell, MCP

Unattended & shield

Move machines without a cloud account

Backup & sync

Import / export

Export for coding

One code base. Native installers per OS.

Built for developers who work alongside AI

Nothing leaves your machine. Not even to us.

From vault to broker between agents

Vault and agent shield

Agent-to-agent sharing

Unlock on the agent's behalf

Start with a week. Then $2 a month.

Individual

Enterprise

Questions developers ask first

Give your agents access, not your keys

`tokenvoy run`

`tokenvoy ssh`

`tokenvoy sudo`