GitHub - royashbrook/hush: a secret store for AI agents with one rule: the agent never sees the plaintext. get a secret once into the OS keychain, then inject it into commands forever. no get, cross-platform, MIT. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
royashbrook
hush
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>23 Commits<br>23 Commits
.github/workflows
.github/workflows
assets
assets
helpers
helpers
test
test
win
win
.gitignore
.gitignore
AGENTS.md
AGENTS.md
LICENSE
LICENSE
README.md
README.md
SKILL.md
SKILL.md
hush
hush
package.json
package.json
View all files
Repository files navigation
a secret store for AI agents , the one with no get.
get a secret once into the OS keychain, then inject it into commands forever , the value never hits stdout, the transcript, or the cloud.
A secret store for AI agents, with one hard rule: the agent never sees the plaintext.
Values never reach stdout, so they never land in the tool result, the transcript, or the cloud. A<br>secret only ever moves from the store straight into the consumer. There's no get on purpose, a<br>plain getter is the leak.
The point: you (an agent) are running as the user with their CLIs already authed, so you can already<br>set a server-side secret or call a service , you just can't see the value without it landing in the<br>chat. hush gets it once into the OS keychain, then you inject it into those commands forever. No<br>chat paste, no temp files, no .env to commit by accident.
agents: start here
If you were handed this repo's url, install yourself, then follow the playbook. Get the hush<br>script onto the box and read SKILL.md , that's the whole onboarding (it covers store /<br>mint / inject and how to adopt hush in the repo you're working in). The script is one self-contained<br>bash file; put it wherever your agent loads tools or just on your PATH:
git clone https://github.com/royashbrook/hush<br>chmod +x hush/hush<br># then put hush/hush on your PATH, or move it into your agent's skills/tools dir
or run it straight from npm without cloning: npx @royashbrook/hush (mac/linux; on windows use the<br>clone, the orchestrator is bash).
Claude Code convenience (auto-loads as a skill): clone straight into the skills dir instead , whole<br>session git clone https://github.com/royashbrook/hush ~/.claude/skills/hush, or one project<br>./.claude/skills/hush. Other agents: see AGENTS.md.
That's it , the human points you here and says "use the hush skill," and you take it from here. The<br>one thing only a human can do is paste a secret they hold: when you hit that, run hush set<br>and a hidden dialog pops on their screen (you never see the value).
install (humans)
Same clone as above, or just grab the single hush script and put it on your PATH.
Backends: macOS Keychain, Linux libsecret (secret-tool), and Windows DPAPI (via PowerShell) are<br>built in. On other platforms keep the same contract with your OS secret store (see SKILL.md).<br>Cross-OS tested in CI (manual workflow_dispatch, all three runners).
quick start
hush set my-vendor-token # paste a value you hold (hidden prompt)<br>printf '%s' "$TOK" | hush set my-vendor-token # ...or pipe it in (scripts/CI), still off argv<br>hush mint app-operator-key # generate + store a random one<br>hush run TOKEN=my-vendor-token -- some-cmd # inject into a command, never printed<br>hush list # names only, never values
Naming: keep the default hush namespace and prefix names by project (blame-cf-token,<br>lifescored-gemini-key) so one keychain search for hush finds everything. HUSH_NS is only for a<br>genuinely separate store, not per-project. Need to fix an existing name? hush rename<br>moves the value internally (never re-asked, never printed). Full docs + the portable contract:<br>SKILL.md.
not a vault
An agent with shell access can read+write this store, so it's not a lock against a hostile process.<br>It's structure that keeps plaintext out of the transcript and makes "store once, inject everywhere"<br>the easy path. It's also...