Secrets for AI agents without the chat

Why the chat is the wrong place

Whatever you type into an agent session stays in the conversation, in the session log on your disk and with the model provider. We measured it on our own machines: 68 of 70 deployment secrets were sitting in plain text in session logs. Rotating does not help while the next value takes the same route.

How the 68 out of 70 were measured

How it works

The agent runs vault-ask with the name of the value and the command that needs it. vault-ask generates a key pair locally and only shows a link.
You open the link. Before you enter anything, the page shows exactly which command will receive the value.
Your browser encrypts the value for the key pair on the agent's machine. The server only ever stores ciphertext, exactly as with any other Vault request.
vault-ask decrypts locally, checks that the command you saw is the one it is about to run, and passes the value to that command only. The agent sees: DB_PASSWORD received, 32 characters, passed to the command.

Install

Node.js 20 or newer, no further dependencies:

npm install -g @erseni/vault-ask

Or straight from the public source code, without npm:

git clone https://gitlab.erseni.net/open-source/secrets-component.git npm install -g ./secrets-component/cli

Three ways to hand over a value

The default: the value only exists as an environment variable of this one child process. Nothing is written to disk.

vault-ask DB_PASSWORD -- psql -h db.example.com -U app

For values that need to stay: written into a .env file with permissions 600.

vault-ask STRIPE_KEY SENTRY_DSN --env-file .env

For keys and certificates: one value into one file, permissions 600.

vault-ask TLS_KEY --file certs/server.key

There is deliberately no way to print the value. Several names in one call give you one page with several fields.

The other direction: the agent sends you a password

Ask your agent for a new password and you get a one-time link instead of the password in the chat. vault-ask send generates the value on the agent's machine, encrypts it there and writes the same value into the .env file or the command that needs it, so your system and your link match.

vault-ask send DB_PASSWORD --env-file .env

The link shows the value once and is used up afterwards. Sending counts against the same daily limit as requests.

Protection against the agent itself

Bound to one purpose: the command or file path is fixed when the request is created and shown to you before you type. The page encrypts what you saw together with the value; vault-ask compares both after decrypting and refuses anything else. A different command needs a new request, and with it a new look from you.
Masked output: vault-ask runs as the parent process and replaces the value in everything the command prints, including its Base64, URL and hex encodings. vault-ask X -- env shows three stars.
Hooks for Claude Code: a PreToolUse guard ships with the package. It blocks reading the files vault-ask wrote and refuses vault-ask with a shell, env, printenv or echo as the command.

The honest limit

All of this catches accidents and makes a manipulated agent visible. It does not make an agent that runs under your own operating system user with a shell harmless: such an agent can read the memory of processes it started. Complete protection only comes from separating privileges, with the secret held by a service under a different user and the agent only holding a handle. We describe this in our threat model instead of promising more than the code does.

For environments without a shell: MCP

vault-ask-mcp offers the same building blocks as MCP tools: request_secret writes a value into a file, run_with_secret runs a command with it, send_secret sends you a generated value as a one-time link. The server tells the agent at the start of every session when to use which tool, so "generate a password for my database" leads to a link without any setup on your side.

claude mcp add vault-ask -- vault-ask-mcp

Limits

Without an account: 3 requests per minute, protected by a proof of work.
Free, with an API key: 50 requests per day, no proof of work.
Pro: 500 requests per day.
Business: unlimited, with a technical cap of 60 requests per minute.

export VAULT_ASK_API_KEY=vak_...

Secrets for AI agents, without pasting them into the chat