Rapg — AI skill for Claude Code
Local-first secret manager for the AI-agent era — keep API keys out of .env files and out of your agent transcripts.
How to install Rapg
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open kanywst/rapg and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Rapg does
Local-first secret manager for the AI-agent era — keep API keys out of .env files and out of your agent transcripts.
Alternatives in AI
README
rapg
Single-binary, local-first secret manager built for the AI-agent era.
[](https://go.dev/) [](https://github.com/kanywst/rapg/actions) [](LICENSE)
The problem
You hand `ANTHROPIC_API_KEY` to Claude Code. You hand `AWS_SECRET_ACCESS_KEY` to your Cursor agent. You hand a database URL to whatever shell snippet your LLM just generated.
Three things go wrong:
- The agent's transcript and context window now contain your secret. Logs persist, screenshots happen, transcripts get pasted into bug reports.
.envfiles keep that secret in plaintext on disk, and someone always commits one by accident.- Existing managers (1Password, Bitwarden) solve team sharing, not agent leakage.
`rapg` is a small Go binary that keeps your dev secrets in a locally encrypted vault and injects them into child processes, including AI agents, without ever writing them to disk.
Install
Homebrew
brew install kanywst/tap/rapgNix
nix run github:kanywst/rapgIt also exposes an overlay for NixOS and home-manager configs, and a dev shell with the Go toolchain.
Pre-built binary
Download a tarball for your OS and architecture from the [latest release](https://github.com/kanywst/rapg/releases/latest), then put `rapg` on your `PATH`.
From source
Requires Go 1.25 or newer.
go install github.com/kanywst/rapg/cmd/rapg@latestQuick start
First run sets a master password (minimum 12 chars, strong complexity):
rapgIn the TUI, press `n` to add a secret. Fill in `Service`, `Username`, `Password`, and the `Env Key` field, for example `ANTHROPIC_API_KEY`.
Inject those secrets into any child proces
Related Skills
Usewarden
Free, local guardrail for AI coding agents — Claude Code, Cursor, Gemini CLI and more. Blocks out-of-scope wri
Kru
Local-first MCP password and credential manager for AI agents. Use passwords, API keys, SSH identities, and TO
Keyfence
Local proxy that keeps your API keys and secrets out of LLM requests. Works with Claude Code, Cursor, Codex an
Comfyui MCP Panel
The local-first sidebar AI agent for ComfyUI — runs on your own Claude OR ChatGPT subscription (no API keys, n
Tracecrate
Local-first AI agent trace workbench. Inspect Claude Code, Codex and OTLP logs, compare runs, and export priva
Devsandbox
Run AI coding agents in a per-project sandbox that keeps your real dev environment. Your shell, mise-managed t
Related Agents
Credentials Manager
Gestiona credenciales del proyecto (.env, API keys, tokens, webhooks). Úsalo CADA VEZ que aparezcan credencial
Secret Purist
The paranoid sentinel of credential security. Use this agent to scan codebases and git history for leaked secr
Secret Hunter
Hunts publicly-leaked credentials (API tokens, cloud keys, DB strings) that belong to a previously-ingested pr
