grantpin documentation
A local secrets broker for AI coding agents. Your agent can use a secret without ever receiving it.
grantpin keeps your API keys and database URLs in an encrypted vault on your Mac. An agent such as Claude Code asks to run a command with named secrets. You see the exact command, confirm with Touch ID, and the command runs with the secrets in its environment. The agent only gets the output, with every secret value replaced by [REDACTED:NAME].
No cloud, no account, no analytics. Apache-2.0.
IntroductionWhat grantpin is and how one run works.
InstallDMG, Homebrew or build from source.
Quick startFrom an empty vault to a first approved run.
Claude Code and MCPConnect an agent and see what it sees.
CLI referenceEvery command, flag and exit code.
Security modelWhat it protects against, and what it does not.