Rapg — AI skill for Claude Code
Local-first secret manager for the AI-agent era — keep API keys out of .env files and out of your agent transcripts.
How to install Rapg
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open kanywst/rapg and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Rapg does
Local-first secret manager for the AI-agent era — keep API keys out of .env files and out of your agent transcripts.
Alternatives in AI
- Rb Setup — First-time setup 1.3k ★
- Claw Empire — Command Your AI Agent Empire from the CEO Desk — A local-first AI agent office simulator that orchestrates CLI 1.1k ★
- Usage — macOS menu bar & Windows tray app pinning Claude Code, Codex & Antigravity quota, burn rate, and cost to your 301 ★
README
rapg
Single-binary, local-first secret manager built for the AI-agent era.
[](https://go.dev/) [](https://github.com/kanywst/rapg/actions) [](LICENSE)
The problem
You hand `ANTHROPIC_API_KEY` to Claude Code. You hand `AWS_SECRET_ACCESS_KEY` to your Cursor agent. You hand a database URL to whatever shell snippet your LLM just generated.
Three things go wrong:
- The agent's transcript and context window now contain your secret. Logs persist, screenshots happen, transcripts get pasted into bug reports.
.envfiles keep that secret in plaintext on disk, and someone always commits one by accident.- Existing managers (1Password, Bitwarden) solve team sharing, not agent leakage.
`rapg` is a small Go binary that keeps your dev secrets in a locally encrypted vault and injects them into child processes, including AI agents, without ever writing them to disk.
Install
Homebrew
brew install kanywst/tap/rapgNix
nix run github:kanywst/rapgIt also exposes an overlay for NixOS and home-manager configs, and a dev shell with the Go toolchain.
Pre-built binary
Download a tarball for your OS and architecture from the [latest release](https://github.com/kanywst/rapg/releases/latest), then put `rapg` on your `PATH`.
From source
Requires Go 1.25 or newer.
go install github.com/kanywst/rapg/cmd/rapg@latestQuick start
First run sets a master password (minimum 12 chars, strong complexity):
rapgIn the TUI, press `n` to add a secret. Fill in `Service`, `Username`, `Password`, and the `Env Key` field, for example `ANTHROPIC_API_KEY`.
Inject those secrets into any child proces
Related Skills
Infisical Skill
Infisical secret management skill for AI agents — keep API keys out of agent context
AI Credential Safety
Guide to protecting API keys and credentials from AI agent exposure — .env safety, secret scanning, and Secret
Claude Code Secret Guard
Claude Code mod that keeps API keys, tokens and passwords out of the model's context: gitleaks scans every too
Kru
Local-first MCP password and credential manager for AI agents. Use passwords, API keys, SSH identities, and TO
Tokenstash
Your AI agent needs your API keys. It doesn't need to see them. tokenstash writes keys straight into .env.loca
Usewarden
Free, local guardrail for AI coding agents — Claude Code, Cursor, Gemini CLI and more. Blocks out-of-scope wri
Related Agents
Credentials Manager
Gestiona credenciales del proyecto (.env, API keys, tokens, webhooks). Úsalo CADA VEZ que aparezcan credencial
Info Disclosure
Information Disclosure specialist (H1 #18, CWE-200/209/215/538/668/798). Use for finding exposed sensitive dat
Secret Purist
The paranoid sentinel of credential security. Use this agent to scan codebases and git history for leaked secr
