Keybox 0.1.0
Seal a secret for Cursor, VS Code, Claude, or Codex. The agent can spend it. The model never reads it.

Requires
- Node.js 20 or newer
- One of: Cursor, VS Code, Claude Code, Claude Desktop, Codex, or any MCP client
- macOS and Xcode Command Line Tools (swiftc), only for the Command-Option-L hotkey

Build once
1. Unzip this archive and open a terminal in the keybox-0.1.0 folder.
2. npm install
3. npm run build

Then install the host you use. node dist/cli.js install all registers every host.
install-cursor is an alias for install cursor.

Cursor
  node dist/cli.js install cursor
  Reload Cursor (Developer: Reload Window). Confirm Keybox under Customize.
  A send-time hook blocks a raw key. Press Command-Option-L once and allow
  Accessibility for keybox-hotkey. In an editor file, the same keys are a
  Keybox keybinding.

VS Code
  node dist/cli.js install vscode
  Reload VS Code. Keybox is in ~/.copilot/mcp-config.json and the user mcp.json.
  VS Code has no send-time hook. Seal first with Keybox: Seal Key, or
  Command-Option-L in an editor (Ctrl+Alt+L on Windows and Linux).

Claude
  node dist/cli.js install claude
  Restart Claude Code and Claude Desktop.
  Claude Code blocks a raw key on submit and redacts tool results. It can still
  store the submitted prompt in its local session file. The model does not receive it.
  Claude Desktop is MCP only. Seal with Command-Option-L or keybox seal before you send.

Codex
  node dist/cli.js install codex
  Restart Codex. A raw key is blocked on submit, and tool results are redacted.

Other MCP clients
  After one install, the server command is ~/.keybox/bin/keybox mcp
  (keybox.cmd mcp on Windows). Tools: list_secrets, describe_secret,
  http_request, place_secret, revoke_secret. None return a secret.
  Seal with keybox seal before you send unless that client has a Keybox hook.

Use
Highlight a secret and seal it. The selection becomes a handle such as «kb:openai».
Send that. The agent spends it with the Keybox http_request tool.

The macOS hotkey is skipped on Windows and Linux. If swiftc is missing, run
xcode-select --install.
