by Signet-AI · Signet-AI/signetai
Local-first vault for agent secrets — agents reference secret names, not values; values never leave your machine.
Signet keeps the model honest: agent prompts reference secrets by name; Signet resolves them at call time inside tools. This prevents accidental secret leakage into model context and provider logs.
When to use: You're shipping an agent that touches APIs and don't want raw keys in prompts.
Outcome: Tools call APIs without leaking secrets into prompts.
Layer secret-hygiene with destructive-op guards
| Tool | Inputs | When to call | Cost |
|---|---|---|---|
| vault add / list / resolve | (see docs) | Three flows | 1 call |
secrets-read secrets-writeput plaintext secrets in skills/configsResolution failsConfirm the secret name; case-sensitive
| Alternative | When to use it instead | Tradeoff |
|---|---|---|
| 1Password CLI | You already have 1Password | Not agent-aware |