AGENT MASTER KEYOne local control point for every AI agent
Agent Master Key keeps your provider credentials encrypted on your Mac, then gives each AI agent one scoped key you can approve, audit, revoke, or kill.
macOS 14+ · Apple Silicon · no account or email · open DMG → Applications
The old way is backwards
Pasting a raw provider token into an agent gives it the real secret, wherever that key is stored and everywhere it works. AMK puts a local policy layer in the middle.
sk-proj-••••••••••••••••github_pat_••••••••••••rk_live_•••••••••••••••amk_live_••••••••••••Built for agents that do real work
Running Codex, Claude, Cursor, Hermes, or another MCP client against real tools.
Separating client systems from the credentials and agents used to operate them.
Giving multiple agents useful access without scattering provider keys across configs.
Needing a visible approval boundary, local audit trail, and one emergency stop.
Four moves. You're in control.
One provider secret goes into your local vault. One scoped key comes out for the agent. Follow the route.
amk_live_••••••••Bring a scoped API key. AMK encrypts it in the vault on your Mac—outside the agent's config and context.
Connect Codex, Claude, Cursor, Hermes, or another MCP client without pasting the provider secret into it.
Choose the connectors and actions this agent can reach. Anything outside that scope is denied.
Safe calls can run, risky writes can ask first, and one switch can stop every scoped request.
Real app. Real flows.
These short previews use the actual Agent Master Key macOS app with isolated demo data—no customer secrets and no concept UI.
AMK runs the broker on your Mac. Your provider credentials stay in an AES-256-GCM encrypted local vault.
Give Codex, Claude, Cursor, Hermes, or another MCP agent one scoped Master Key instead of every provider secret.
Invalid credentials stay masked and get a clear denial. The real key is never copied into the agent.
Pause scoped calls immediately without deleting the provider credentials stored in your vault.
Local-first by design
The local broker uses your real provider credential only for an allowed outbound request. The agent gets a scoped amk_live_…key, not the underlying secret.
ON YOUR MACAMK Local VaultAES-256-GCM · 127.0.0.1No Agent Master Key cloud vault sits in the loop. Provider secrets remain on your machine.
Grant an agent only the connectors and actions it needs. Unscoped calls are denied.
Risky actions can stop for your decision. Notifications and audit entries are redaction-aware.
Revoke one agent or pause them all without rotating every provider credential.
Bring the tools you already use
Start with the 45-connector catalog, or bring your own scoped key for a custom provider. Every route still passes through the same local broker and policy layer.
GitHub
Claude
OpenAI
Notion
Slack
Linear
Stripe
Cloudflare
Gemini
Perplexity
1Password
Firecrawl
Sentry
Supabase
Discord
AWS
Vercel
HubSpotGitHubClaudeOpenAINotionSlackLinearStripeCloudflareGeminiPerplexity1PasswordFirecrawlSentrySupabaseDiscordAWSVercelHubSpotNo fine-print theater
One scoped, revocable amk_live_… key that works through the local broker. It can reach only the connectors and actions you allowed—not your underlying provider credentials.
No. The provider credentials live in an AES-256-GCM encrypted vault on your Mac and are used by the broker running on 127.0.0.1.
Yes. During the current launch window, all product capabilities are included and no account or email is required. Future material changes are announced by Agent Master Key.
AMK limits what a scoped key can do, keeps real provider secrets out of agent configs, and gives you approvals, audit, revocation, and a kill switch. It does not claim to isolate malicious programs already running as the same macOS user. For hard OS-level separation, use separate macOS user accounts.
The current Public Preview supports Apple Silicon Macs running macOS 14 or later. Download the DMG, drag Agent Master Key to Applications, and connect your first agent.
Access, not secrets.
Download the full Agent Master Key Public Preview and take back control of every connection.
Download freemacOS 14+ · Apple Silicon · free during the launch window
