Password manager for macOS
The vault your AI agents can use, but never see.
Your coding agent needs a DATABASE_URL and a
STRIPE_SECRET_KEY. It doesn't need to read them. Kagisecure puts secrets
where they have to be, in a .env file or a process's environment, and
keeps the values out of the model's context. Every time, with your fingerprint.
brew install --cask itsucara/tap/kagisecure
Free and open source · macOS 15+ · Apple silicon & Intel
write_env_file(environment: "acme / staging", dir: "~/code/acme")DATABASE_URLSTRIPE_SECRET_KEYREDIS_URL
How agents use secrets without seeing them
An agent almost never needs to know a secret. It needs the secret to be present when something runs. Writing a file and starting a process are actions, and actions can wait for a human to say yes.
The agent sees names, not values
Over MCP, an agent can list your vaults, items and environments and look at an item's field labels. None of the nine tools returns a secret value, and the sidecar is built so that it can't: it can't even name the type that holds one.
You approve in the app, not in the chat
When the agent asks to write a .env file or run a command with secrets, the
Kagisecure app raises its own sheet: the caller and its code signature, the directory,
the variable names, a .gitignore warning. You grant it with Touch ID. The
agent can't answer for you.
The app does the injection
Kagisecure writes the file or starts the process itself and hands back only what happened: which variables, where, under which lease. Leases are tied to one directory and a time window, and you can revoke them at any moment.
Three ways in, one approval model: the MCP server for agents like Claude
Code, Claude Desktop, Codex and Cursor; the CLI, where kagisecure run
starts a command with secrets in its environment; and the browser extension, which
fills a password only after you approve that site.
A real password manager, too
Kagisecure is a native SwiftUI app, not a web view. It keeps your logins, API keys, notes and one-time codes, and decides what agents may touch item by item.
- Nothing is visible to agents by default. Items and fields are opt-in, and imported items arrive hidden until you say otherwise.
- Environments. Group the variables a project needs, bind each one to a vault field, and let agents ask for the set by name.
kagisecure run. Start a command with secrets in its environment. No shell in between, and injected values are masked in the output on the way back.- Leases you can see. Live countdowns, per-lease revoke, and
kagisecure lockto drop the key and every lease at once. - An audit log that checks itself. Every call is recorded, including the ones you
refused, in a hash chain you can verify with
kagisecure audit --verify. - Browser autofill. For Safari, Chrome, Edge, Arc, Brave and Chromium. Nothing fills on page load. Each fill is approved, and the site is checked against the item's saved websites.
- Quick Access. Press ⇧⌘Space from any app to copy a password, username or one-time code.
- Passwords and one-time codes. A generator for random passwords and passphrases, with a strength meter based on real entropy, and TOTP codes with a countdown ring.
- Easy to move in. Import from 1Password (
.1pux) and from CSV exports of 1Password, Apple Passwords, Chrome and Firefox.--dry-runshows the plan first. - A recovery code. Created with your vault, it unlocks it if you forget the master password.
The security model, briefly
Kagisecure is local-first. There is no server, no account and no telemetry, and the app has no network code at all.
Your vault is a file you own
A single encrypted file on your Mac. The key is derived from your master password with Argon2id, and the contents are sealed with ChaCha20-Poly1305.
The broker holds no keys
The MCP sidecar is a thin, unprivileged process. The unlocked key lives only in the app, and locking, sleep or idle drops it along with every lease.
Built for hostile inputs
The threat model assumes a compromised agent, prompt injection through tool results and a misbehaving MCP client, and says plainly what it doesn't defend against, such as root-level malware.
Signed and notarized
Official builds are signed with Apple's Developer ID by Itsucara and notarized by Apple. The CLI, MCP sidecar and browser helper ship inside the app and are signed with it.
Read the full threat model, including the known weak points. Kagisecure is at version 0.1.0: the vault format isn't frozen yet, and Touch ID currently approves agent requests but doesn't unlock the vault. You'll use your master password for that.
Install
Requires macOS 15 Sequoia or later, on Apple silicon or Intel.
Download the app
Download Kagisecure.dmg, open it and drag Kagisecure to Applications. It opens like any other app, with no workarounds needed.
Or use Homebrew
brew install --cask itsucara/tap/kagisecure
The cask also puts the kagisecure CLI and its helpers on your
PATH. Uninstalling never deletes your vault.
Check the signature yourself
spctl -a -vv -t install /Applications/Kagisecure.app
# accepted, source=Notarized Developer ID
codesign -dv --verbose=4 /Applications/Kagisecure.app 2>&1 | grep Authority
Connect your agent
Open the app, create your vault, and follow Set up your agent. It shows the exact configuration for Claude Code, Claude Desktop, Codex and Cursor with a copy button. For Claude Code, it's one line:
claude mcp add --transport stdio kagisecure -s local -- "$(kagisecure mcp path)"
Open source
A tool that guards your secrets should be one you can read. All of Kagisecure is on GitHub, dual-licensed under MIT or Apache 2.0, at your option.
Read the code
A Rust core, CLI and MCP server, and a native SwiftUI app. The design decisions are written up as ADRs in the repository.
Contribute
Bug reports and pull requests are welcome. Review of the threat model and vault format is especially valuable. Start with the contributing guide.
Report a vulnerability
Please don't open a public issue. Use GitHub's private vulnerability reporting, or write to security@kagisecure.com.