RIPPRE

05 — Developer security

Pocket-Vault

Release candidate

Let your AI tools use your credentials without handing them over.

Pocket-Vault keeps your access keys, tokens, passwords, and SSH keys in one encrypted vault on your Mac. When an AI coding tool or a script needs one — to run the tests, to deploy the build — it asks. Pocket-Vault checks your rules, runs the command with the credential supplied, and hands back the result. The tool never holds the secret, and every request is recorded.

It is built for developers who work alongside Claude Code, Codex, or OpenCode. Connect a tool in one step and it is told, in writing, to get secrets from the vault and never to ask you for one. Permissions expire on their own, and you can withdraw any of them at any moment — so if a session leaks, you revoke a temporary permission instead of rotating a password.

  • Runs entirely on your Mac
  • No account, no cloud, no telemetry
  • Every use scoped, expiring, and recorded
Notify me Read the docs

Features

Built for AI coding tools

  • Connect Claude Code, Codex, or OpenCode in one step. Pocket-Vault sets the tool up and leaves a note in your project telling it to get secrets from the vault and never to ask you for one.
  • A tool asks for permission to run a command — run the tests, deploy the build — and Pocket-Vault runs it with the credential supplied. The tool gets the output, not the credential.
  • There is no way for a tool to fetch a secret’s value or to list what your vault holds; the note names the secrets it may ask for.
  • A starter rule lets connected tools use Low and Medium risk secrets on their own for up to an hour at a time. Each High or Critical secret asks you first, by name.
  • The reason a tool gives is shown to you and recorded, but it never decides anything — so instructions planted in a file or a web page cannot talk their way past your rules.

You stay in charge

  • When a rule says to ask you first, the request waits on the Home screen in a plain sentence: who is asking, for which secrets, and why they say they need them.
  • Every permission covers named secrets and one kind of use, expires on its own, and can be revoked at any moment. If a session leaks, you revoke a temporary permission instead of rotating a password.
  • Rules you write once decide which program may use which credential, for how long, and what needs your approval. Nothing is allowed until a rule or you allow it.
  • A new program is recorded and refused until you allow it, and a program whose file changes has to be allowed again.
  • Allowing a program, replacing your rules, and connecting a tool each need Touch ID, your Apple Watch, or your Mac login password.
  • Every decision goes into a chained record, so an entry edited or removed from the middle shows up.

Your secrets, in one place

  • Scan this Mac finds .env files, SSH keys, and the credential files your cloud, package, database, and container tools keep, and imports only what you pick.
  • Each .env line is sorted into credentials and settings. Ports, switches, and timeouts stay in the file unless you tick them, and a name you hide is never offered again.
  • Secrets are filed by project, named for the folder they came from, and you can move, rename, and tidy them.
  • Check tells you whether a key looks real — recognized formats from more than thirty providers, built-in checksums, expiry dates, placeholders — without sending it anywhere.
  • Show brings a value back for thirty seconds and records that you looked. There is no copy button, and the window stays out of screenshots and screen sharing by default.
  • An optional Verify (beta), off unless you turn it on, asks a key’s own issuer whether it still works, one key at a time.

Works the way you already work

  • Put pocket-vault run in front of any command and it receives the credential as an environment variable. Nothing needs rewriting.
  • If a command prints a credential Pocket-Vault supplied, it comes back as [REDACTED] — and seven common key formats are caught even when Pocket-Vault did not supply them.
  • An optional SSH agent signs with Ed25519 keys kept in the vault, each signature one recorded decision. It runs from the command line.
  • The command-line tool and the connection your AI tools use are inside the app. There is nothing else to install.

Locked down by default

  • Every secret is encrypted separately, and the key that opens them is never written to disk unprotected.
  • Locks itself after 15 minutes without use, and locking withdraws every live permission. Nothing outside your Mac can ask it to open.
  • Closing the window keeps Pocket-Vault in the menu bar so your tools keep working; Lock now and Quit are one click away.
  • A recovery key, shown once at setup, is the way back in if you forget your passphrase. There is no back door.
  • Backs itself up automatically, keeps the newest ten copies, and never deletes your current vault when you restore one.

Why you can trust it

Pocket-Vault runs on your Mac and nowhere else. There is no account, no server, and no telemetry; the only thing that ever sends a secret anywhere is the optional Verify beta, which sends one key to the company that issued it when you press the button, and records that it did. Secrets are encrypted one by one with standard, published methods, and nothing is granted without a rule or your say-so.

It is candid about its limits. It is not a sandbox: a program already running as you can still read what you can read. What Pocket-Vault changes is that access to your credentials is scoped, expiring, revocable, and on the record.

Version updates

Pocket-Vault has not been released to the public yet. Version 1.0 is the first complete version and the numbers before it mark the development phases that built it; the current build adds the changes made since 1.0.

  1. Current build

    Pre-release

    Tools that work the moment you connect them

    • Connecting a tool now installs a starter rule, so it can use Low and Medium risk secrets on its own and asks you about High and Critical ones instead of being refused.
    • Connect writes a note into your project’s CLAUDE.md or AGENTS.md telling the tool to get secrets from the vault, never to ask you for one, and which secrets it may ask for.
    • Allowing a program, replacing your rules, and connecting a tool now ask for Touch ID, your Apple Watch, or your login password, and a canceled prompt is recorded.
    • Connect also allows the command-line tool inside the app, sets Codex up so it does not stop to ask on every call, and refuses a project folder that does not exist.
    • The Rules screen now shows switched-off policies too, so importing no longer drops them.
    • Security hardening, including tighter permissions on Pocket-Vault’s data folder.

  2. Version 1.0.0

    The first complete version

    • A Welcome screen creates your vault inside the app and shows your recovery key once.
    • Scan this Mac finds credential files and imports only what you pick, with each .env line sorted into credentials and settings.
    • Connect Claude Code, Codex, or OpenCode from the app, and file your secrets by project.
    • Simple and Advanced modes, a menu bar icon, and a window that closes without quitting.
    • Show a value for thirty seconds with screenshot protection on, Check a key’s format offline, or Verify it with its issuer (beta, off by default).
    • The vault locks itself after 15 minutes without use, plus security hardening.

  3. Version 0.14.0

    Security review

    • pocket-vault recover gets you back in with your recovery key if you lose your passphrase.
    • Add and remove the passphrases and recovery keys that open your vault, and rotate its key.
    • Blocking a program withdraws its live permissions at once, even on connections already open.
    • A program whose file changes has to be allowed again.
    • Security hardening from a whole-system review.

  4. Version 0.12 – 0.13

    Backups

    • Take, list, verify, restore, and prune backups of your vault and its record.
    • Restoring never deletes anything: your current vault is moved aside first.
    • Only one program can open the vault at a time.
    • Groundwork for Windows: the command-line tool builds and runs its automated tests there.

  5. Version 0.10 – 0.11

    SSH agent and output scrubbing

    • An SSH agent that signs with Ed25519 keys kept in the vault, one recorded decision per signature.
    • Store a whole key, certificate, or service-account file as one secret with pocket-vault add --from-file.
    • Seven common credential formats are scrubbed from a command’s output, on top of the values Pocket-Vault supplied.

  6. Version 0.7 – 0.9

    Desktop app, import, and AI tools

    • The desktop app, where you approve or refuse requests; a rule can now ask you first instead of refusing.
    • Find credential files under a folder, and import a .env file line by line.
    • A built-in connection for AI coding tools, with no way for a tool to fetch a secret’s value.
    • pocket-vault run can wait for your approval.

  7. Version 0.1 – 0.6

    Foundations

    • A security design and threat model, written before any code.
    • An encrypted vault, with every secret sealed separately and opened by your passphrase.
    • Rules that refuse by default, and permissions that are scoped, expiring, and revocable.
    • A tamper-evident record of every decision.
    • The pocket-vault command-line tool: store a secret, run a command with it, and serve the vault to your tools.

Documentation

How to set up Pocket-Vault, use it day to day, and fix what goes wrong.

Open the Pocket-Vault docs

Build with Rippre

Ideas become businesses through execution.

hello (at) rippre (dot) com