concealer
concealer
The local-only secret manager for the AI-coding era.
Encrypted with SOPS + age. No cloud, no telemetry, no account. Your agents use secrets without ever seeing them.
brew install fxerkan/tap/concealer
Coding assistants read your files. The moment a key lands in a .env it can leak. concealer keeps secrets encrypted, scoped, and out of every transcript.
An MCP server lets agents list names and inject values into a command's environment — plaintext is redacted from everything they see. Registration + rate limits stop bulk exfiltration.
The vault decrypts on any machine with just the master password — not tied to a Keychain or TPM. Copy the files, type the password, done.
One readable Python script, MIT-licensed. No black box, no account, no telemetry — verify with a firewall that nothing phones home.
All encryption is delegated to battle-tested tools: AES-256-GCM over age X25519. The age private key never touches disk in plaintext — key-at-rest.
Every read, write, copy and inject is appended to an HMAC-chained log with a monotonic seq and a tail anchor. Names and actions only — never values.
Disambiguate the same value across repos by tenant / project / environment / repo. The most-specific scope wins at inject time.
The same encrypted vault, however you like to work.
Type-aware forms, searchable multi-select filters, per-secret deploy renderers, clipboard copy with auto-clear, and a tamper-evident audit viewer. Bilingual (TR/EN), dark/light/matrix themes, localhost only.
concealer web → http://127.0.0.1:8787
Browse, search, add, delete and reveal secrets without leaving the terminal — arrow keys, instant filtering, type-aware editing.
concealer tui
Register an agent, hand it a revocable token, and it can inject a DB password to run a query — while the value stays redacted from its context. Every call is audited with source=mcp.
concealer agent register claude
Local-only. Portable. Open source. Built for the AI-coding era.
Reach out directly — we read every message and usually reply within a day.
Homebrew pulls in sops, age and expect automatically.
brew install fxerkan/tap/concealer
Prefer the manual route? See the Installation guide.