scrt4 — secret manager for coding agents

scrt4 is a single daemon + CLI that holds your .env values in a hardware-bound encrypted vault. The master key is derived from your FIDO2 authenticator (YubiKey, passkey, phone, Touch ID, Windows Hello) via the WebAuthn PRF extension — no passwords, no TOTP. The key is re-derived every session and never leaves the device.

Runs the same way on macOS, Linux, and WSL. AGPL-3.0. Under 10 MB end-to-end.

Install

One command. Auto-detects OS and architecture, pulls SHA256-verified binaries from GitHub Releases, and installs a systemd user unit (Linux) or launchd plist (macOS). No Docker required.

Supported authenticators

First unlock

Your first secret

Two ways to add secrets: type them one by one, or import an existing .env file.

scrt4 list only ever shows secret names. Values are never printed on stdout — the only way to see a value is scrt4 view, which opens a GUI dialog so values render in the OS window system where a CLI agent cannot read them.

Using with Claude Code

Write commands with $env[NAME] placeholders. scrt4 substitutes the real values at runtime inside the subprocess environment. The substituted text is never returned to the model.

Example: deploy a smart contract

Example: call an API

Example: push to GitHub

Discovering what's available

scrt4 llm emits an llms.txt-style dump of every secret name in the vault, every loaded module with its capabilities, current session status, and recommended next steps. Prefer this over stale docs — it reflects the live vault.

Importing existing .env files

If you already have project .env files on disk, their secrets belong in scrt4, not in plaintext. The import module parses export KEY=value forms, surrounding quotes, and # comments.

After import, delete the plaintext file — some tooling still reads .env directly, so confirm your app uses the new injection flow before removing it. A Claude Code session with scrt4 unlocked can help find .env files under your project directories with find ~/projects -name '.env' 2>/dev/null and walk through them one at a time.

Encrypted Google Drive backup (cloud-crypt)

The cloud-crypt module ships with the native installer by default. Setup has three steps: Drive-scoped OAuth, save the master key, push the vault.

1. Give cloud-crypt Drive access

Three setup paths — pick whichever matches what you already have:

2. Save your master key somewhere durable

The Drive ciphertext is useless without the master key. Save it password-protected to a USB stick, a password manager, or both.

3. Push the encrypted vault to Drive

Everything encrypted by cloud-crypt lives in a single Drive folder named claude-crypt, auto-created on first push. You can rename or move the folder later — the module tracks archives by ID, not path. Filenames and sizes are not encrypted.

4. Restore on a new machine

1. Install scrt4 on the new machine (curl -fsSL https://install.llmsecrets.com/native | sh).
2. Run scrt4 setup to enroll a new authenticator.
3. Unlock, then run scrt4 recover /path/to/backup-file.enc — this restores the original master key from the password-protected export you saved in step 2.
4. Authenticate cloud-crypt (scrt4 cloud-crypt auth setup ...) and scrt4 cloud-crypt pull-and-decrypt <driveId> to pull the encrypted vault back down and decrypt it.

Encrypt a folder

The encrypt-folder module produces a standalone .scrt4 archive using the same vault key. Useful for backing up source trees, ops notebooks, or anything else you'd rather not leave in plaintext.

Pair with cloud-crypt push ~/notes.scrt4 to ship the archive to Drive without a second round of encryption — the archive is already ciphertext.

Recovery

Three recovery paths, in order of preference:

How the key works

Your vault key is derived from the FIDO2 authenticator via the WebAuthn PRF extension — CTAP2's hmac-secret under the hood. Each scrt4 unlock triggers a tap/touch/biometric check on the authenticator, which returns a device-bound HMAC. scrt4 uses that HMAC as input to the vault KDF. The key is re-derived every session and never leaves the device.

This is why scrt4 doesn't need a password, doesn't need TOTP, and doesn't need cloud state: the hardware authenticator IS the key. Steal the vault file alone and you have nothing; steal the authenticator alone and you have nothing. You need both.

Vault encryption

• AES-256-GCM authenticated encryption at rest (~/.scrt4/vault.enc).
• Decrypted only in daemon memory during an active session; never written unencrypted.
• The daemon scrubs every stored value from subprocess stdout before returning it to the calling agent.
• scrt4 view opens a Zenity GUI dialog — values render in the OS window system where a CLI agent cannot read them.

Daemon & TCB split

scrt4 is split into a small trusted computing base (TCB) and a larger set of modules:

• Daemon (Rust, <2k LoC) — crypto, vault handling, session state, and subprocess injection. Values never leave daemon memory.
• Core CLI (bash, ~2,800 LoC) — command dispatch, UX, module loader.
• Modules — extend functionality (cloud-crypt, encrypt-folder, import-env, github, etc.) without expanding the TCB. Modules see ciphertext and metadata only; encrypt/decrypt stays in the daemon.

See ARCHITECTURE.md for the full module/TCB split and SECURITY.md for the threat model.

What the AI sees (and doesn't)

Commands reference

Run scrt4 help locally for the canonical list — this page drifts, the binary doesn't.

Modules

Modules extend scrt4 without expanding the trusted computing base. The native installer ships three by default; the rest are explicit opt-in via --module NAME.

Run scrt4 modules list to see what's loaded in your install.

Trust & verification

• Downloads page — llmsecrets.com/downloads lists every release with per-platform install commands and published SHA256 checksums.
• Two-hosts, one-hash — the same scrt4-native.sh.sha256 is served from install.llmsecrets.com/native.sha256 and committed at scrt4/install/scrt4-native.sh.sha256 on the public repo's main branch. Both must match before piping to sh; tampering either source alone fails the check.
• Release manifest — install.llmsecrets.com/releases/latest.txt points to the current tag; each tag directory has a SHA256SUMS over every daemon binary and the bash CLI.
• Self-verification — scrt4 verify-self checks its own bytes against the published manifest.
• Reproducible layout — source + bash modules + install scripts + docs is about 1.5 MB. "Under 10 MB" is the conservative public claim; the core bash (~2,800 lines) and daemon (Rust, <2k LoC) are small enough to read line by line.

Uninstall

Removes the daemon, CLI, and session data. The encrypted vault at ~/.scrt4/ stays on disk until you delete it — that's deliberate, so a reinstall can pick up where the old one left off.

Troubleshooting

"Secret not found"

The name may differ from what the command expects. Run scrt4 list to see exactly what's stored.

"Session locked"

Run scrt4 unlock. Check scrt4 status for TTL. Sessions can be extended with scrt4 extend.

"hmac-secret not supported"

Your authenticator doesn't support the WebAuthn PRF extension. YubiKey 4 and NEO are the common culprits — YubiKey 5 firmware 5.2.3+ is required. Check firmware with ykman info.

cloud-crypt: gcloud not found

cloud-crypt uses the Google Cloud SDK to mint OAuth tokens. Install it from cloud.google.com/sdk or use auth setup --from-secret / --paste to bring your own OAuth blob.

Need a new secret?

scrt4 add NAME=value or scrt4 import FILE. Both work mid-session.

Still stuck?

File an issue at llmsecrets/llm-secrets, or email security@llmsecrets.com for anything sensitive.