key-amnesia

key-amnesia is an Apache-2.0 secrets manager for coding agents. It lets an agent use an API key without ever reading the value.

A client and a daemon talk over local IPC. The daemon verifies the calling process’s identity at OS level, applies a per-call admission policy, censors the child process’s output so a key cannot leak through logs, and writes an audit trail. A shipped SDK hooks the permission systems of three third-party agent platforms. That is how an agent already in use calls the daemon instead of being handed the secret.

The three platforms are the hard part. They change underneath the SDK constantly. A schema that drifts does not throw an error. It silently stops protecting someone, and the run still looks successful. The test suite is the product as much as the code is, because a silent miss is the failure mode that matters.