他什么都没说。他留着你的钥匙。它还能用。

范围诚实

hush 保护transcript：值绝不进入聊天、工具输出或 通过自身渠道进行日志记录。它不保护敌人或 具有壳层访问权限的即时注入代理——此类代理可以cat对vault， tee stdin 转为磁盘，或将值（base64/反向）变换为文字 涂黑。如果你的对手是代理本身，你需要操作系统层级的隔离 （钥匙扣，守护进程 + 套接字认证），不是 hush。参见 SECURITY.md。

为什么

把秘密粘贴到安全带聊天里，它会永远留在文字记录里。 hush 分隔通道：人工通过TTY或线束加载数值 原生提示（通过MCP），代理只负责编排名称。从来没有工具 返回一个值。

MCP（不依赖束带：claude、opencode、光标、codex）

hush serve 用4个工具暴露 stdio：hush_check、hush_list、hush_need （通过引出请求并存储该值），hush_run（注入 + 编辑）。hush setup 安装技能，注册服务器，并提供服务 添加束束权限规则，使代理无法读取~/.hush与其

hush — keep API keys out of AI agent chats

He says nothing. He keeps your keys. It still works.

Scope honesty

hush protects the transcript: values never enter chat, tool outputs, or logs through its own channels. It does not protect against a hostile or prompt-injected agent with shell access — such an agent can cat the vault, tee stdin to disk, or transform values (base64/reverse) past literal redaction. If your adversary is the agent itself, you need OS-level isolation (keychain, daemon + socket auth), not hush. See SECURITY.md.

npm i -g --allow-scripts=hush-secrets hush-secrets  # installs binary + skill
hush set MY_API_KEY            # in YOUR terminal, never in chat
hush update                    # self-update via npm (needs npm on PATH)

Why

Pasting a secret into a harness chat leaves it in the transcript forever. hush separates the channels: the human loads values via TTY or the harness native prompt (over MCP), the agent only orchestrates names. No tool ever returns a value.

MCP (harness-agnostic: claude, opencode, cursor, codex)

hush serve exposes stdio with 4 tools: hush_check, hush_list, hush_need (asks for the value via elicitation and stores it), hush_run (injects + redacts). hush setup installs the skill, registers the server, and offers to add harness permission rules so the agent cannot read ~/.hush with its file tools (Claude Code, opencode v2) or runs hush without confirmation (Codex).

CLI

openssl rand -hex 24 | hush set WHATSAPP_VERIFY_TOKEN
hush check WHATSAPP_VERIFY_TOKEN META_APP_SECRET
hush stdin WHATSAPP_VERIFY_TOKEN -- npx wrangler secret put WHATSAPP_VERIFY_TOKEN
hush run --only META_APP_SECRET -- npx wrangler deploy
hush status

check and list print names only. run and stdin inject into the child process and redact output to [REDACTED].

hush run waits for the command to exit before printing, so redaction sees the whole output. To wrap a long-lived stdio process such as an MCP server, add --stream: output is forwarded line by line as it arrives (trade-offs in SECURITY.md).

"jira": {"type": "local", "command": ["hush", "run", "--stream", "--only", "JIRA_API_TOKEN", "--", "jira-mcp"]}

Where secrets live, and getting them back

Values are stored in ~/.hush/vault (file 0600, dir 0700), one NAME=value per line. There is intentionally no read-back over MCP and no get command — anything an agent can call ends up in its context.

To recover a value (rotation, migration, backup), use a real terminal:

hush export                  # prints all, NAME=value per line
hush export META_APP_SECRET  # prints one

export refuses to run unless stdout is a TTY, so a harness cannot capture it