Keyclasp Puts Agent Credentials in a Local AES-256-GCM Vault and Kills the Process if a Secret Appears in Output

keyclasp on GitHub, via Hacker News Show HN (single source)·low signalXBlueskyLinkedInCopy link

Keyclasp, posted to Show HN 2026-09-07 under MIT as a fork of Keyblind, stores credentials in a local encrypted vault and injects them into the child process environment only at execution time via `keyclasp run --env NAME`, so the agent sees credential names and availability status but never plaintext. It scans command output for the injected values and terminates the process on a match. The README compares itself point by point to 1Password's `op run`, trading a hosted account and predeclared Environment UUIDs for a local vault, explicit per-command selection and no cloud dependency or telemetry, currently Node 24+ on macOS arm64 and glibc Linux.