Maskey stores API keys, tokens, passwords, and SSH keys in iCloud Keychain for scripts and coding agents. It has a macOS window and the mk command line. Entries sync across your Macs without another account or hosted service.
mk run supplies selected entries as environment variables. It masks their exact values in stdout and stderr. No bootstrap token is needed.
mk set github/GITHUB_TOKEN # prompts without echoing the value
mk run github -- gh auth statusFor an SSH Key entry, the command gets a public key and an SSH agent. The private key stays in mk's process. During the run, the command can request any signature with that key. The agent ends with the command.
Create, search, and edit entries in the macOS window. Reveal or copy a value when you need it. Program access lets a credential helper obtain a raw value after you grant the entry access.
mk activity shows which programs used or changed entries through Maskey on this Mac. The record contains no values, notes, command arguments, or environment variables.
You need an Apple silicon Mac and Apple's Command Line Tools or Xcode.
brew install --cask entwining/tap/maskey
xattr -dr com.apple.quarantine /Applications/Maskey.app
mk setupMaskey is signed ad hoc and is not notarized. The xattr command removes Gatekeeper's quarantine. You can also install with a script or build from source.
For coding agents, run mk skill install to install the shipped skill. Sandboxes need permission to connect to the Keychain service's socket.
Use commands you trust. Wrap the tool that needs the credential, not a whole coding agent, whose own logs mk cannot mask. Masking cannot protect credentials a command transforms, saves, or sends elsewhere. Other programs hosted by Apple's Python can access the same Keychain items. The activity record can also be altered by programs running as you.
Maskey is written in Go with MyGo. Run the repository checks before submitting a change.