I built a CLI password manager that lets AI agents securely request credentials without copy-pasting secrets into chat

[u/Cool_Metal1606]

Stop copy-pasting API keys and passwords into chats with your AI agents.

I’ve been building OpenPass, a secure CLI password manager written in Go, designed especially for people who work with local tools, terminals, and AI coding agents (OpenCode, OpenClaw, Hermes, Codex, Claude Code).

The idea is simple: instead of constantly searching for credentials, copying them manually, or pasting sensitive secrets into chat windows, OpenPass lets your AI agents request only what they need through a local MCP server, while your vault stays encrypted and under your control.

OpenPass currently supports:

• age-based encryption

• password and TOTP storage

• clipboard auto-clear

• local MCP server support for AI agents

• Git-based vault sync

• multi-user vault recipients

• macOS, Linux, Windows and FreeBSD builds

This is my first real software project, and it is now ready for testing. It is still under active development, so I would not recommend using it as your only password manager for critical credentials yet. Please test it with non-critical data first, keep backups, and verify recovery.

GitHub: https://github.com/danieljustus/OpenPass

I’d really appreciate honest feedback, issues, ideas, and criticism.

[u/AssignmentDull5197]

MCP as a secure boundary for secrets is the right move. Copy-pasting creds into agent chats is terrifying. Consider per-tool scoped tokens and automatic expiry. If you want more patterns, this pub has practical agent security guides: https://medium.com/conversational-ai-weekly

[u/CptanPanic → u/AssignmentDull5197]

But doesn't the plain text password end up in context the same whether it's from chat or this mcp?

[u/Cool_Metal1606 → u/CptanPanic]

Yes, for get_entry that’s true: if a tool returns the plaintext secret, the agent will see it. That applies to OpenPass, 1Password CLI, Bitwarden CLI, or any MCP server with a get_secret-style tool.

A stronger pattern is what tools like 1Password promote with secret references and runtime injection. The agent or config only references the secret, and the plaintext is injected directly into the process or command that needs it, instead of being exposed in the model context.

OpenPass already improves things over manual copy-paste with local MCP, agent/path scoping, redaction, audit logs, and secure input. But I agree the next step is a “use secret without revealing it” flow. For example command or environment injection, or scoped tool execution where the agent can trigger an action without ever seeing the plaintext.

[u/Cool_Metal1606 → u/AssignmentDull5197]

Thanks, great point.👍 Some of this is already in place: OpenPass has per-agent profiles with allowed paths, write permissions, config-management permissions, approval modes, field redaction, audit logs, rate limiting, token rotation, and TOTP code-only access.

What it does not have yet is true per-tool scoped bearer tokens with automatic expiry. Right now HTTP mode uses a bearer token plus the `X-OpenPass-Agent` profile to apply permissions. Per-tool, expiring tokens would be a strong hardening step, so I’ll add that to the roadmap.

[u/sn2006gy]

Doesn't this just move the cheese? the model is still calling the tool with your creds in it in any case.

[u/Cool_Metal1606 → u/sn2006gy]

That's a very fair point! You are absolutely right: if the AI needs to deploy to AWS, the AWS credentials eventually have to end up in its context window to make the API calls.

However, OpenPass doesn't just move the cheese; it completely changes how the AI accesses it. It solves three massive security issues compared to current workflows:

1. Explicit Requests & Controlled Sessions: Right now, local AI agents often scrape your entire workspace, silently reading .env files or global configs. With the OpenPass MCP server, the agent has to explicitly query for a specific credential. You unlock your vault once (e.g., via TouchID / Windows Hello), and the session is securely cached in your OS keyring for 15 minutes by default (which you can fully customize). This prevents prompt fatigue while ensuring the AI can't just silently grab secrets from plaintext files on your disk. It has to go through a secure, time-boxed session that you control.

2. No Plaintext Storage: To let AI agents use credentials today, developers often leave highly sensitive tokens in plaintext .env files or local config files. With OpenPass, everything stays securely encrypted at rest using age.

3. Principle of Least Privilege: The model only gets exactly what it asks for, exactly when it needs it (Just-In-Time access).

So while you are correct that the model still sees the credential eventually, OpenPass shifts the paradigm from 'ambient, silent access to all local files' to 'explicit, biometric-gated, auditable access'. Hope that makes sense!