LLM Secret Manager — AI skill for Claude Code

llm-secret-manager

**The secret manager for LLM agents: they can create, rotate, and use your secrets — without ever being able to read them.**

[](LICENSE) [](mcp/nv-mcp.py) [](bin/nv) [](https://modelcontextprotocol.io)

LLM agents are great at ops work — deploying, rotating credentials, wiring up services. But every secret that enters an agent's context lives on in transcripts, logs, and telemetry you don't control. The usual fix is "be careful". This is a better fix: **make it impossible.**

`llm-secret-manager` turns your OS keyvault into something an agent operates **like an HSM**: it can order secrets into existence, rotate them, and run programs with them — but there is *no operation that returns a secret*. Not to the agent, not to a log, not "just for debugging". Three layers, use any or all: the **`nv` CLI**, a zero-dependency **MCP server**, and a Claude Code **guard hook** that blocks commands which would print a secret.

you      $ claude "create a DB password and run the migration with it"

agent    → secret_generate("db-password")        ⇒ ok, length 32   (value never seen)
agent    → secret_run(["python","manage.py","migrate"],
                      env={"DB_PASSWORD": "db-password"})
                                                 ⇒ exit 0          (value went kernel → process env)

you      $ nv run DB_PASSWORD=db-password -- psql   # same reference, your shell

Why you can trust it (hint: you don't have to)

There is nothing here *to* trust. No custom crypto, no storage format, no server state, no dependencies. Storage, encryption, locking, and session binding are the **OS keyvault's own** (macOS login Keychain).