    I built KRU because I kept running into the same annoying problem in my agent workflows.
    
    The agent would get most of the way through a task, then hit a login, SSH prompt, or API authentication step. At that point, I either had to take over and enter the password myself, or paste it into the conversation so the agent could continue.
    
    The first option interrupts the workflow. The second puts the actual secret into the conversation and model context, which I especially don’t want when I’m using a third-party client or model endpoint.
    
    So I built KRU.
    
    KRU is a small local password vault with a stdio MCP server. You save a credential once, and when an agent reaches an authentication step, it can ask KRU to use that credential locally.
    
    KRU performs the login, fills forms, opens SSH connections, or makes authenticated requests without returning hidden passwords, tokens, or private keys to the agent.
    
    In practice, it can:
    
    - Fill login fields in a browser or managed terminal
    - Run SSH commands using a saved password or private key
    - Make authenticated API requests
    - Generate TOTP codes locally
    - Store custom fields alongside usernames, hosts, ports, and URLs
    
    You can refer to a saved item by name, for example:
    
    > Use the KRU item “Production Server” to deploy the current build.
    
    I’ve been using it in my own workflow for about a week or two. The main benefit is simple: I don’t have to stop halfway through a task to type a password, and I don’t have to give the agent the plaintext just to keep it moving.
    
    A few basics:
    
    - Free and open source
    - Runs locally with no account, subscription, or cloud vault
    - Available for Windows, macOS, Linux, and headless Linux
    - Supports passwords, API credentials, private keys, TOTP, and custom fields
    - Each field has its own visibility toggle if you deliberately want the agent to receive its value
    
    KRU isn’t a sandbox, and it doesn’t decide whether an agent’s command is safe. It only handles saved credentials locally and keeps hidden values out of the conversation.
    
    I’ve only used it in my own setup so far, so I’m curious how well it holds up in other people’s workflows.
    
    If you try it and something breaks, feels awkward, or just doesn’t make sense, let me know. I’m sure I’ve missed things.
    
    I originally built it to solve my own problem, but if it turns out to be useful to anyone else, I’d be glad to keep working on it.
    
    **GitHub and downloads:**  
    https://github.com/omaekumiko2-create/kru/releases/latest

I built a local password vault that lets AI agents use credentials without exposing them as plaintext