keyshroud

Coding agents cat your dotenv file and the key ends up in the transcript. keyshroud keeps secrets in your own Vaultwarden or Bitwarden vault, injects them into the commands your agent runs, and masks every value before the model reads it. Works with Claude Code, Codex, Cursor, OpenCode, Gemini CLI and pi. New secrets go through a hidden-input dialog, never the chat. Tell your agent Read keyshroud.dev/install.md and set me up. Free, MIT, no telemetry.