Automic Vault
I created Homebrew. Now I’m fixing what happens when agents use it.
Automic Vault hardens supported CLI tools on macOS, moves exposed credentials into the Keychain, and gates their use while you keep your usual commands.
Free and open source. Your existing commands keep working. No agent plugin required.
The packaging layer
You install a CLI to do a job. Its credentials often end up in files or helpers that any code running as you can read. Agents inherit that mess.
For GitHub, av harden gh installs our signed, patched CLI and migrates its credentials into Automic Vault custody. You still run gh. Authenticated operations now reach its Authorization Gate.
See how we harden your toolsReading an issue, publishing a release, and revealing a token need different authority. AV checks the complete operation before applying the credential.
| Command | Decision |
|---|---|
gh issue listRead issues | AuthorizedRead Only |
gh issue createCreate an issue | Approval requiredRemote Write |
gh auth tokenReveal the token | Approval requiredSecret Disclosure |
Revealing a credential needs its own decision, even when nothing changes remotely.
Homebrew
Homebrew hardening protects /opt/homebrew from changes by other code running as you. At Read & Update, recognized inspection commands and brew update can run; installs and upgrades need Approval. This targets Apple Silicon Homebrew; services and shell completions are incompatible while hardened.
How Homebrew hardening worksAWS
Normal AWS commands receive short-lived session credentials. Long-lived keys leave the shared credentials file. AV obtains session credentials separately for each AWS process.
How AWS hardening worksDocker
Before releasing a registry credential, AV verifies the live Docker Desktop process, its signature, runtime protections, ancestry, arguments, and requested registry.
How Docker hardening worksSecure your command line
Find credentials that tools, dependencies, and agents can read from your files or credential helpers. Each Finding explains the exposure and what you can do about it.
Choose a supported Hardener for a Finding, then use av doctor to verify the installed protection.
Find your tools
curl -fsSL https://www.automicvault.com/scanner.sh | bashDownloads a small standalone scanner built from the latest release sources, verifies its signature, and runs it in a read-only sandbox with no network access.
A clean Scan covers the checks AV supports. It does not certify your whole machine as secure.
Decide what your tools and agents can do
Choose Read Only for your agent’s GitHub gate and a different policy for your terminal. AV verifies each Launcher’s live software identity before applying its policy.
AV does not sandbox your agent or prevent arbitrary local file changes.
Write Access still leaves disclosure and elevated credential use behind Approval. Unknown operations always need a human decision.
For an eligible agent task, grant ten active minutes of Write Access at one gate. You can extend, suspend, or end that grant from its visible controls.
Choose how much authority to giveCode signing establishes software identity and integrity, not intent. Task identifiers narrow temporary grants; they do not establish identity.
Give agents the capabilities they need
Let an agent prepare release notes while a reviewed script publishes to GitHub and updates your CDN. A Blessed Script binds exact contents and declared capabilities to your review.
A reentrant script pauses for agent input, exposes fixed entry points for context, then continues the deterministic work. AV authorizes each invocation. Editing the script invalidates its Blessing.
Build a reviewed agent workflowValidate agent output before using it. Keep Secret Values within the script’s execution; a Blessing does not make its code trustworthy.
In action
See the software, command, arguments, working directory, and Secret Names before you allow an operation.
Use the same Secret Name across projects with a different Project Value for each. AV selects the nearest matching physical directory, or the Global Value when no Project Value matches.
For compatible HTTP clients, the Secret Proxy gives your application a temporary reference and applies the real credential only to approved destinations.
Understand Project Values Explore credential proxyingDirectories select Values; they grant no authority. Policy covers all Values of a Secret Name. Proxy references are bearer values that can exercise already-granted session access.
Review requests from your enrolled Macs on eligible iPhones using the same iCloud Keychain account. See the operation you’re being asked to allow, wherever it originated.
Each Mac keeps its Secrets, policy, and Authorization History, and enforces the decision locally. You can also enable Touch ID Approval on a Mac for biometric-only allow actions.
Set up iPhone and Touch ID Approval Join the public iPhone beta on TestFlightiPhone Approval removes pointer- and keyboard-driven allow actions on the Mac. Disable iPhone Mirroring and Show on Mac, or require Face ID or Touch ID on every eligible iPhone. An unavailable relay never enables a fallback.
AV protects supported credentials and gates supported Tool operations against code running as you. Wrappers do not intercept every command, and installing a package does not make it safe. Root or kernel compromise, arbitrary local destruction, and a Target’s behavior after receiving a Secret remain outside this boundary.
Read the security modelAuthorization History keeps local records of allowed and denied requests. AV persists and verifies the record of an allowed Secret Use before releasing the Secret. History is bounded; it is not a tamper-resistant or complete forensic log.
Canonical definitionsThe Mac app costs nothing and ships under Apache-2.0. Optional iPhone Approval requires an active subscription to send allow responses. Denying a request does not require a subscription.
