npm:keyblind

Resolve a secret by name using the configured backend (local vault, 1Password, Bitwarden, or env vars). Returns the decrypted value at runtime. The se

Store a secret in the encrypted vault. The value is encrypted with AES-256-GCM before storage. The secret value is never visible in the LLM conversati

List all stored secret names (names only — values are never revealed in this listing).

Replace real values in your .env file with deterministic fake values. Real values are encrypted and backed up to the vault. AI agents reading .env fil

Restore real .env values from the vault. Reverses the sandbox operation.

Delete a secret from the vault.

View the audit log of secret resolutions, stores, and deletes. Shows who accessed which secret and when.

Generate a TOTP 2FA code for a stored secret. Returns the current 6 or 8 digit code and seconds remaining until rotation.

Store a TOTP configuration from an otpauth:// URI (from QR code scan or manual entry).

List all stored TOTP configurations.

Delete a stored TOTP configuration.

Create an encrypted, expiring share link for a secret. The secret is encrypted into the URL fragment and never sent to any server.

Receive and decrypt a shared secret from a share URL fragment.

Check dead man

Check in to reset the dead man

Create a new shared team vault (encrypted SQLite). Requires a passphrase.

Push a local secret to the shared team vault.

Import all secrets from the team vault into your local vault.