Concealer ships a single-file, local-only secret vault with MCP agent access

A developer has released concealer, an open-source secret manager that lives in a single Python file, runs entirely on the user's machine, and is hosted on GitHub. In a post on dev.to, the author frames it as a response to a problem that barely existed when the .env convention took hold: AI coding assistants have to read your repository to do their job, and plaintext credentials sitting in it are now a leak waiting to happen.

The leak paths AI assistants opened

The post's argument is that the .env file was a workable compromise for a decade — plaintext, but local and git-ignored. Coding agents changed the terms. Because an assistant scans the repo, runs commands, and pipes output back into a model, the author identifies several ways a key can escape: it can be echoed into a chat transcript that later gets pasted into an issue, captured in a log the agent streams back, held in the model's context for the rest of a long session, or staged and committed by an agent that adds every file it finds. None of these paths require malice; the assistant simply reads the environment it works in.

Why existing tools fall short, per the author

Cloud vaults such as Vault, Doppler, or cloud KMS offerings require an account, a network round trip, and a service that has to stay up — heavy for a laptop project, and the secrets end up on someone else's infrastructure. Password managers like 1Password are built for humans rather than scripts and agents. OS keychains do not travel with you to a new machine. And .env is the plaintext problem itself. The author wanted four properties combined: local-only operation, no account or telemetry, portability by copying files and entering one password, and an agent-aware design in which a secret's value never enters an assistant's context.

How concealer is built

The tool is a single Python 3 script that depends only on the standard library, and it deliberately avoids inventing cryptography. Encryption is delegated to SOPS — which originated at Mozilla and encrypts structured YAML or JSON files without destroying their shape — and to age, Filippo Valsorda's encryption tool. The only cryptography concealer performs itself is verifying the master password with scrypt and chaining the audit log with HMAC. Secrets are typed (database credentials, cloud keys, web logins, custom records) rather than flat key/value pairs, and scoped by tenant, project, environment, and repo. Several interfaces sit on top of one vault, including a CLI — cer set stores a value, cer run injects it into a child process and scrubs it from the output — and a web console bound to localhost, unlocked with the master password.

The MCP piece: agents that use secrets without seeing them

The feature the author says motivated the project is an MCP server, using the Model Context Protocol that agents use to reach tools. An agent can list the secret names that exist for a project — names only, with values never leaving the vault — or ask concealer to run a command with a named secret. The value is decrypted straight into the child process's environment, and the output is redacted before the agent reads a single line, so plaintext never enters the context in either direction.

Because an agent that can trigger secret use is itself a risk, the MCP server layers on controls. Registration is mandatory: only a registered agent token can call the tools, and human or CLI tokens get denied. There is no bulk access — a command must name the exact secrets it needs, one by one. Rate limits cap both how many rows a single call can return and how many distinct secret names an agent may reveal within a rolling window; names already seen re-list freely, while new ones count against the quota, so bulk enumeration is slowed down and recorded. Every exchange lands in a tamper-evident audit log that records names and actions, never values.

Why it matters

AI coding assistants have quietly rewritten the threat model for local secrets. A key in a .env file is now trivially reachable by any command an agent runs, and the leak paths — transcripts, logs, accidental commits — are ordinary side effects of how agents operate, not attacks. Concealer's contribution is less a new cipher than a reframing: it treats "the agent must never see the value" as a first-class design constraint, enforced at the point where secrets are injected into processes. For solo developers and small projects, the single-file, no-account shape also lowers the barrier that makes full vault deployments feel disproportionate. The usual caveats apply — this is one developer's project rather than an audited product — but leaning on SOPS and age instead of custom cryptography is a defensible starting position, and the pattern is worth watching as agent-assisted development becomes the default.