Your Mac. Your vault.
API keys and tokens live in an encrypted vault on your machine. No cloud sync, no account to create.
A local vault for AI coding agents
Your agent works.
Your secrets
stay yours.
Give your agent permission to use your API keys.
Without handing over the keys.
macOS 14+ Latest release on GitHub
Local onlyNo accountOpen source
A RUN, WITH GRANTPINInteractive example
grantpin run --secrets API_KEY \
-- ./deploy.sh
grantpinThis command needs your permission.
- Command
./deploy.sh- Secret
-
API_KEYvalue stays hidden - Project
~/your-project
Approval is followed by Touch ID.
Permission granted.
The command gets the secret.
The agent gets redacted
output.
API_KEY=[REDACTED:API_KEY]
Decision recorded in the audit log
The agent asks. You decide. grantpin handles the secret.
Works with your coding workflow
Claude CodeCodexCursorCLI + MCP
Permission, on your terms.
Review the command and approve with Touch ID. Allow a single run or create a grant with a scope you choose.
A trail you can follow.
Keep a local record of requests, decisions, and results. Injected secret values are redacted from command output.
A small change to your workflow
Keep the context.
Lose the exposure.
Think of grantpin as the bouncer between your AI agent and your secrets.
-
01
Put your keys in one place.
Add your API keys and tokens to the local vault. Manage them from the menu-bar app, or use the CLI.
Store once. Reference by name. -
02
Connect your coding agent.
Connect through MCP, or let your agent call the grantpin CLI. It asks to run a command with named secrets.
No secret values in the agent’s configuration. -
03
Review. Approve. Keep building.
See the command, project, and requested keys. After approval, grantpin runs the command and returns redacted output.
Your approval. An audited result.
Good questions.
A little more
under the hood.
Does the agent ever see the secret?
The normal run flow passes the secret to the approved command’s environment, not to the agent. grantpin replaces exact matches of injected values in stdout and stderr before returning that output.
This is exact-match redaction: encoded or transformed values can get through. Always review the command you’re approving.
Do I approve every command?
You can approve one run, allow matching requests for a limited time, or create a standing grant. Grants are scoped to a caller label, project directory, secret names, and command prefix. Matching requests can then run without a new prompt; every use is still audited.
Creating a grant requires approval. Keep its scope narrow and its lifetime short.
Which agents can I use it with?
grantpin has an MCP server and a command-line interface. Claude Code has a dedicated connection flow in the app. Other coding agents, including Codex and Cursor, can integrate through MCP or call the CLI.
Does grantpin make any command safe?
No. An approved command receives the secret and can send it elsewhere. grantpin does not sandbox commands or restrict network access, and it cannot protect a compromised user account.
The important boundary is your approval of the command and any grants you create.
Which platforms does it support?
The current app is for macOS 14 and later. It includes a menu-bar app, a local background service, a CLI, and an MCP server. Touch ID is used for approval, with macOS account-password fallback when needed.
Is it open source?
Yes. grantpin is licensed under Apache 2.0. It runs locally, with no cloud account or sync service required.
Less exposure. More peace of mind.
Your keys.
Your permission.
A local home for your secrets.
A clear boundary for your agent.
macOS 14+ Latest release on GitHub
or with Homebrew
brew install --cask jmeh-sindikata/grantpin/grantpin