JitPass

JitPass

You have API keys and tokens in plaintext on your Mac.
Use JitPass to protect them.

Download for Mac · brew install jitpass/tap/jitpass · Docs · jitpass.com

_{Free for personal and internal company use · Source-available · No account · No telemetry · Nothing leaves your Mac · Secure Enclave ready · Every change can be undone}

_{What's the number on your Mac? The scan only reads, and changes nothing until you say so.}

Get started   The problem · Three steps · Install · The menu bar
Protect   Findings and decoys · Your tools keep working · Undo anything
Approve   Two Touch ID moments · Grants · The audit
AI agents   Built for AI agents · AI jobs · A grant or an AI job?
More   How it compares · How it works · What it does not do · Docs

Your secrets are in plain files. Anything you run can read them.

API keys in .env, cloud credentials in ~/.aws/credentials, tokens in .npmrc, exports in ~/.zshrc, your shell history, the MCP configs your agents read. Nothing has to be hacked for them to leak. A compromised npm package, a trojanized IDE extension or a prompt-injected agent runs as you, so it can simply open the file.

JitPass moves each secret into a local vault that opens with Touch ID, and leaves a decoy where the plaintext was.

Three steps, about two minutes

1. Find Setup scans your Mac and changes nothing. It recognises 100+ token formats (OpenAI, Anthropic, AWS, GitHub, Stripe and more), plus private keys and database URLs.

2. Protect One click moves each secret into the vault and leaves a decoy in its place. Every file is backed up first, and your tools keep working.

3. Approve When a program reaches for a real key, JitPass names it and what launched it in the Touch ID dialog. Touch to allow, or cancel.

No terminal needed: open JitPass and setup walks you through steps 1 and 2.

jit scan                 # read-only: every exposed secret, file and line
jit migrate --dry-run    # preview the whole fix plan
jit migrate              # apply it: shows the plan, asks [y/N], one Touch ID
jit audit                # afterwards: every request, and what you answered

Download for Mac · brew install jitpass/tap/jitpass
_{Free · No account · Every change can be undone}

What you get

Built for AI agents

Your coding agent runs as you, with your shell and your files. One poisoned README, issue or web page can tell it to cat .env and paste the result somewhere. With JitPass, there is nothing real in that file to paste.

• A cold read gets a decoy, and the read is logged.
• Every request is named. When an agent runs aws or an MCP server, you see which program and which agent, then decide.
• Keys out of configs. MCP server keys and the agents' own API keys move to the vault.
• Keys out of transcripts. The deep scan finds the copies agents kept, across 100+ token formats, and Redact clears them.

The AI Agents window shows each agent on your Mac: keys in its files, what it can reach, and what it did this week.

jit migrate ~/.claude.json            # MCP server keys move to the vault
jit wrap claude                       # the agent's own API key too
jit migrate caches                    # clear copies of vaulted keys from agent transcripts
jit migrate redact                    # and tokens in them that were never vaulted
jit audit --parent claude             # what the agent touched

Let AI run your scripts, never your keys

Some work needs a key and a script, and you want an agent to do it: export a report, sync a list, call an internal API. Handing the agent the key means it is in the agent's context, its transcript and its sandbox. An AI Job hands it the result instead.

A job is a command you approved, with the secrets it gets. When an AI tool asks for one, the jit service runs it: it decrypts, starts the command in its folder, hides every secret value in the output, and hands back the text.

1. Pick a profile, pick a script, approve with Touch ID	2. Every job, who ran it, and which AI apps can ask

Open AI Jobs from the menu bar and press New AI Job…. Pick the profile whose secrets the script needs, then the script, and approve. Connect adds jit to Claude Desktop or Cursor; terminal agents like Claude Code and Codex need nothing.

$ jit job allow notion-export -- .venv/bin/python export_pages.py
  Touch ID  ->  let AI run notion/export_pages.py with 3 secrets, 1 shown
✓ Approved notion-export · 41 files fingerprinted

jit job run notion-export          # what Claude Code, Codex or Gemini CLI types
jit mcp install                    # Claude Desktop, whose Cowork shell can't run jit itself
jit mcp install --client cursor    # Cursor

What the tool gets back is the script's own output, then what jit adds:

Exported 42 pages to out/notion_20260925.csv
[jit] new file: out/notion_20260925.csv
[jit] hidden values: none

If the script had printed its key, the line would read [hidden: NOTION_API_KEY] in its place, and the count would say so.

Three rules make it safe to leave running:

• Only you approve a job, with Touch ID. An agent can propose one; it arrives as a filled-in sheet you read before anything runs.
• A changed file stops the job. jit fingerprints the folder when you approve it. Edit the script or a library it loads, and the job is refused until you look at what changed and approve it again.
• Commands that hand values back are refused. python -c, sh -c, env, cat: anything that would just print the secrets it is given.

A job asks for Touch ID on every run by default. --ask never lets it run while you are away, until you remove it; removing a job never asks. Add --dry-run to see the whole job without approving anything. Details: AI jobs. Wondering whether you need a grant instead? See A grant or an AI job?

Leaving the keyboard

An agent working overnight or a 3 a.m. job stalls on a question nobody is there to answer. A grant moves your decision earlier instead of removing it: one Touch ID while you are still there, naming exactly which program may use which secrets, and for how long.

1. Say who, which secrets and how long, then Touch ID	2. Every grant, how often it was used, and Revoke

Open New Grant… from the menu bar. Pick the program (every copy started under a terminal or editor, or one running process), tick the profiles it may use, and choose how long: 1 hour to 7 days, or until you revoke it. A grant ends at its deadline, when that one process exits, or when you press Revoke, which never asks: taking access away is always free.

$ jit grant --process claude --profile myapp --for 8h
  Touch ID  ->  let claude use "myapp" for 8 hours
✓ granted g-7f3a2c81   claude -> myapp   until 17:42

A grant or an AI job?

Both let an agent work without asking you each time. The difference is whether the agent ever holds the key.

Your tools keep working

No new commands to learn. Protect a credential once, then keep typing what you always typed.