scrt4 — secret manager for coding agents

scrt4 is a single daemon + CLI that holds your .env values in a hardware-bound encrypted vault. The master key is derived from your FIDO2 authenticator (YubiKey, passkey, phone, Touch ID, Windows Hello) via the WebAuthn PRF extension — no passwords, no TOTP. The key is re-derived every session and never leaves the device.

Runs the same way on macOS, Linux, and WSL. AGPL-3.0. Under 10 MB end-to-end.

Install

One command. Auto-detects OS and architecture, pulls SHA256-verified binaries from GitHub Releases, and installs a systemd user unit (Linux) or launchd plist (macOS). Windows has its own installer below. No Docker required.

Linux and macOS

Windows

PowerShell 5.1 or later. Installs to your user profile, registers the named-pipe daemon, and upgrades in place later with scrt4 upgrade.

Supported authenticators

First unlock

Your first secret

Two ways to add secrets: type them one by one, or import an existing .env file.

scrt4 list only ever shows secret names. Values are never printed on stdout — the only way to see a value is scrt4 view, which opens a GUI dialog so values render in the OS window system where a CLI agent cannot read them.

Using with Claude Code

Write commands with $env[NAME] placeholders. scrt4 substitutes the real values at runtime inside the subprocess environment. The substituted text is never returned to the model.

Example: deploy a smart contract

Example: call an API

Example: push to GitHub

Discovering what's available

scrt4 llm emits an llms.txt-style dump of every secret name in the vault, every loaded module with its capabilities, current session status, and recommended next steps. Prefer this over stale docs — it reflects the live vault.

Recovery

Three recovery paths, in order of preference:

How the key works

Your vault key is derived from the FIDO2 authenticator via the WebAuthn PRF extension — CTAP2's hmac-secret under the hood. Each scrt4 unlock triggers a tap/touch/biometric check on the authenticator, which returns a device-bound HMAC. scrt4 uses that HMAC as input to the vault KDF. The key is re-derived every session and never leaves the device.

This is why scrt4 doesn't need a password, doesn't need TOTP, and doesn't need cloud state: the hardware authenticator IS the key. Steal the vault file alone and you have nothing; steal the authenticator alone and you have nothing. You need both.

Vault encryption

• AES-256-GCM authenticated encryption at rest (~/.scrt4/vault.enc).
• Decrypted only in daemon memory during an active session; never written unencrypted.
• The daemon scrubs every stored value from subprocess stdout before returning it to the calling agent.
• scrt4 view opens a Zenity GUI dialog — values render in the OS window system where a CLI agent cannot read them.

Daemon & TCB split

scrt4 is split into a small trusted computing base (TCB) and a larger set of modules:

• Daemon (Rust, <2k LoC) — crypto, vault handling, session state, and subprocess injection. Values never leave daemon memory.
• Core CLI (bash, ~2,800 LoC) — command dispatch, UX, module loader.
• Modules — extend functionality (cloud-crypt, encrypt-folder, import-env, github, etc.) without expanding the TCB. Modules see ciphertext and metadata only; encrypt/decrypt stays in the daemon.

See ARCHITECTURE.md for the full module/TCB split and SECURITY.md for the threat model.

What the AI sees (and doesn't)

Commands reference

Run scrt4 help locally for the canonical list — this page drifts, the binary doesn't.

Trust & verification

• Downloads page — llmsecrets.com/downloads lists every release with per-platform install commands and published SHA256 checksums.
• Two-hosts, one-hash — the same scrt4-native.sh.sha256 is served from install.llmsecrets.com/native.sha256 and committed at scrt4/install/scrt4-native.sh.sha256 on the public repo's main branch. Both must match before piping to sh; tampering either source alone fails the check.
• Release manifest — install.llmsecrets.com/releases/latest.txt points to the current tag; each tag directory has a SHA256SUMS over every daemon binary and the bash CLI.
• Self-verification — scrt4 verify-self checks its own bytes against the published manifest.
• Reproducible layout — source + bash modules + install scripts + docs is about 1.5 MB. "Under 10 MB" is the conservative public claim; the core bash (~2,800 lines) and daemon (Rust, <2k LoC) are small enough to read line by line.

Uninstall

Linux and macOS

Removes the daemon, CLI, and session data. The encrypted vault at ~/.scrt4/ stays on disk until you delete it — that's deliberate, so a reinstall can pick up where the old one left off.

Windows

No single command yet. The installer does three things, and this undoes them in reverse:

Read the last two lines before running them — they rewrite your user PATH, and it is worth checking $kept looks right first. As on Unix, the vault at %USERPROFILE%\.scrt4\ is left alone; delete it separately if you mean to.

Troubleshooting

"Secret not found"

The name may differ from what the command expects. Run scrt4 list to see exactly what's stored.

"Session locked"

Run scrt4 unlock. Check scrt4 status for TTL. Sessions can be extended with scrt4 extend.

"hmac-secret not supported"

Your authenticator doesn't support the WebAuthn PRF extension. YubiKey 4 and NEO are the common culprits — YubiKey 5 firmware 5.2.3+ is required. Check firmware with ykman info.

cloud-crypt: gcloud not found

cloud-crypt uses the Google Cloud SDK to mint OAuth tokens. Install it from cloud.google.com/sdk or use auth setup --from-secret / --paste to bring your own OAuth blob.

Need a new secret?

scrt4 add NAME=value. Works mid-session.

Still stuck?

File an issue at llmsecrets/llm-secrets, or email security@llmsecrets.com for anything sensitive.