Keybox

Cursor, VS Code, Claude, Codex · 0.1.0

Seal a secret before the agent sees it.

The agent can spend it. The model never reads it.

Highlight a key and press ⌘⌥L on macOS, or run Keybox: Seal Key in an editor. Keybox replaces it with a handle such as «kb:openai». The agent calls the API through that handle. Keybox has no tool that returns the value.

Download Keybox 0.1.0 How to install

Node.js 20+ · macOS hotkey optional · MIT

Agent composer Agent

List my models
sk-proj-EXAMPLE

The key is highlighted. Seal it before you send.

Keybox is for the moment the key is already in the composer. Highlight it, seal it, and send the handle.

Features

A seal on the selection, a hook on send, and a spend path that keeps the value on your machine.

  1. Seal in the composer

    Highlight the secret and press ⌘⌥L. The selection becomes «kb:openai», or whatever name the key’s shape implies. The command palette has Keybox: Seal Key and Keybox: Seal Clipboard.

  2. A backstop on send

    On Cursor, Claude Code, and Codex, a hook blocks the turn when a raw key is still in the prompt, seals it, and shows the safe prompt. VS Code and Claude Desktop have no send-time hook, so seal before you send.

  3. Spend through the handle

    The agent calls http_request with the handle, method, and URL. Keybox attaches the credential and redacts the response. list_secrets and describe_secret return names, hosts, and expiry.

  4. An allowlist on every secret

    OpenAI, Anthropic, GitHub, Stripe, Slack, Google, and npm keys pick up that provider’s hosts when they are sealed. Any other secret stays unspendable until you allow a host.

  5. Open spend, when you ask

    The status-bar item, Keybox: Open Spend in settings, or keybox config open-spend on. Any HTTPS URL. Turning it on asks you to confirm. The value stays in the vault.

  6. Redact the echo

    On Cursor, Claude Code, and Codex, if a tool result still contains a sealed value, a hook strips it before that result goes back to the model.

Install

Download the archive, build it once, then install the host you use. One vault serves every host.

  • Node.js 20 or newer
  • Cursor, VS Code, Claude, or Codex
  • macOS, for the ⌘⌥L hotkey in chat fields
  • Xcode Command Line Tools, so swiftc can build that hotkey
npm install
npm run build
node dist/cli.js install cursor

  1. Reload Cursor

    Run Developer: Reload Window. Open Customize and confirm Keybox is listed — MCP server, skill, rule, and hooks.

  2. Allow the hotkey

    Press ⌘⌥L once. macOS asks for Accessibility for keybox-hotkey. Allow it. The composer is not a normal text field, so this shortcut is a system hotkey. In an editor file, the same keys are a Keybox keybinding.

  3. What you get

    Plugin at ~/.cursor/plugins/local/keybox, extension at ~/.cursor/extensions/keybox.keybox-0.1.0, and a send-time hook that blocks a raw key. 

node dist/cli.js install vscode

  1. Reload VS Code

    Run Developer: Reload Window. Keybox is registered in ~/.copilot/mcp-config.json and in the VS Code user mcp.json.

  2. Seal, then send

    Highlight a secret in an editor and press ⌘⌥L (CtrlAltL on Windows and Linux), or run Keybox: Seal Key. VS Code has no send-time hook. On macOS the system hotkey can also seal the frontmost selection, including Copilot chat, after Accessibility is allowed. 

node dist/cli.js install claude

  1. Claude Code

    Restart Claude Code. Hooks in ~/.claude/settings.json block a raw key on submit, tell the session which handles exist, and redact tool results. The skill is at ~/.claude/skills/keybox. Claude Code can still store the submitted prompt in its local session file. The model does not receive it.

  2. Claude Desktop

    Restart Claude Desktop. The MCP server is in the desktop config. Desktop has no prompt hook, so seal with ⌘⌥L or keybox seal before you send. 

node dist/cli.js install codex

  1. Restart Codex

    The MCP server is in ~/.codex/config.toml, hooks are in ~/.codex/hooks.json, and features.hooks is turned on. A raw key is blocked on submit, and tool results that echo a sealed value are redacted. 

node dist/cli.js mcp

  1. Point any MCP client at the server

    After one install, the command is ~/.keybox/bin/keybox mcp. The tools are list_secrets, describe_secret, http_request, place_secret, and revoke_secret. None of them return a secret. Seal with keybox seal before you send, unless that client has its own Keybox hook.

node dist/cli.js install all registers every host. On macOS, the first install compiles keybox-hotkey. If swiftc is missing, run xcode-select --install. The hotkey step is skipped on Windows and Linux.

Use

Seal, send the handle, and let Keybox attach the credential on the way out.

  1. Seal the selection

    Highlight the secret and press ⌘⌥L on macOS, or run Keybox: Seal Key in VS Code or Cursor. You send something like: 

    List my models «kb:openai»

  2. Let the agent spend it

    The agent calls Keybox http_request with { "secret": "openai", "method": "GET", "url": "https://api.openai.com/v1/models" }. Keybox adds the header — bearer, x-api-key, or a query parameter, depending on the provider — and returns a redacted response.

  3. If the raw key was sent

    On Cursor, Claude Code, and Codex the hook stops the turn, copies a safe prompt, and shows it. VS Code and Claude Desktop do not intercept send, so seal first on those apps.

    The host shows this. The same text is on the clipboard.

    Keybox sealed 1 secret («kb:openai») so it never reached the model. Send this instead:
    List my models «kb:openai»

What the agent receives

At the start of a chat, Keybox tells the agent which handles exist and that it must spend them instead of asking you to paste a key.

Handle
«kb:openai»
Hosts
api.openai.com, or the hosts you allowed
Expiry
12 hours, unless you kept the item
Open spend
On or off

The value and the header Keybox attaches are not in that view.

Commands

  • keybox list Names, hosts, expiry, and whether open spend is on.
  • keybox allow openai api.openai.com Allow that secret to be spent at a host.
  • keybox config open-spend on Any HTTPS URL. A confused agent could send a key to a host you did not name.
  • keybox config open-spend off Spend only at each secret’s allowed hosts.
  • keybox revoke openai Burn a sealed secret. The value is not printed.
  • keybox seal --clipboard --keep Store the clipboard as a durable vault item. Session grants otherwise expire in 12 hours.
  • keybox spend openai GET https://api.openai.com/v1/models Try a spend yourself. The printed response is redacted.
  • keybox place openai kosmos-openrouter Install a sealed OpenRouter key into Agent Canvas and the Kosmos vault. Prints the last four characters.

Tools the agent can call

  • list_secrets
  • describe_secret
  • http_request
  • place_secret
  • revoke_secret
Keybox icon: a white seal with a keyhole, on a black rounded square.

Download

Keybox 0.1.0

The CLI, the editor extension, host installers for Cursor, VS Code, Claude, and Codex, and this icon.

Download keybox-0.1.0.zip 0.1.0 Install steps
  • Installers for Cursor, VS Code, Claude Code, Claude Desktop, and Codex
  • CLI, editor extension, and macOS hotkey source
  • App icon as SVG and PNG

Check the archive against keybox-0.1.0.sha256.

Icon: SVG PNG