Client, secret ID, target, consumer and reason. No value flag. No stdin secret.
Private macOS utility / local-first / active private build
Credentials stay with the owner. Work keeps moving.
KeyCourier is a private approval broker for AI coding tools. An agent asks for a named credential by ID. You decide. KeyCourier installs it into an approved consumer without returning the value to the agent.
- 01
- Owner approval
- 02
- Allowlisted consumer
- 03
- Content-free receipt
01 / The boundary
An AI tool can request access without becoming the custodian.
AI clients share the macOS user account, so the request is descriptive rather than trusted. The privileged step stays in the native app: a person reviews the reason, confirms the target and approves a named consumer.
The hand-off
Four steps. One place for the value.
The agent-facing surface is deliberately small. It carries identifiers and intent, then receives a receipt that can say what happened without saying what was delivered.
The app reads the protected Keychain only after fresh user presence.
One approved variable in one owner-controlled file, replaced atomically.
Status, IDs and a code. Never plaintext, logs or diagnostic bundles.
Designed for the dangerous edges
The useful constraints are the product.
KeyCourier narrows authority before it tries to add convenience. That makes the safe path easier to inspect when several tools are working at once.
No plaintext hand-back
The CLI and portable skill exchange IDs, reasons and receipts. Secret material stays in the owner-controlled path.
Named consumers only
Owner-created profiles decide the target and destination. Requests cannot provide arbitrary paths, variables or reload commands.
Rollback is part of delivery
Local writes are atomic and keep one protected previous version so a bad install has a defined recovery point.
Failures stay visible
A missing consumer, expired request or unavailable target produces a failed or not-configured result instead of a global success.
Three guided destinations / fixed consumers
This Mac stays local. Mac Mini and VPS use encrypted delivery.
This Mac installs into a private KeyCourier-managed consumer after approval. Mac Mini and VPS each have their own age recipient, reviewed owner-only helper and fixed canary consumer.
Dummy ciphertext delivery passed on both remote hosts. The checks covered exact-package replay rejection, mode-600 consumer verification and recovery decryption without printing the value.
Production credentials remain off until the final app-mediated canary receives owner approval and the recovery identity moves to owner-controlled offline media. The Mac Mini copy of the native app also waits for an updated signing profile before it can launch there.
This MacLocal consumer registered
Mac MiniHost delivery canary passed
VPSHost delivery canary passed
Recovery identityOffline move pending
Owner approvalFinal app-mediated canary pending
Privacy boundary
Your credential never needs to become an AI response.
KeyCourier uses the macOS data-protection Keychain with user-presence access control. Support files are owner-only. The app is local-first and unsandboxed for approved file delivery, so it protects the workflow boundary rather than claiming to defend a compromised macOS account.
- Stored
- Named metadata in the app; value in Keychain
- Requested
- IDs, target, consumer and reason
- Returned
- Content-free status and receipt code
- Not included
- Hosted vault, arbitrary shell or secret-bearing CLI flags
One canonical interface
No MCP is required for the safe path.
The CLI remains the narrow trigger for Codex, Claude Code and OpenCode. An MCP wrapper could be added later only if it delegates to the same metadata-only contract.