gethasp/hasp

HASP is a local-first broker for managed secrets in agent workflows.

What it solves

Coding agents often require API keys and credentials to run tests or deploy code. Traditionally, these secrets are placed in .env files or prompts, which risks leaking them into the agent's context or shell history. HASP prevents this by ensuring managed secret values never enter the agent's context.

How it works

HASP acts as a local secret broker. It stores credentials in a local encrypted vault and only provides the secret values to specific commands or tools at runtime. It supports various integration flows including run, inject, and the Model Context Protocol (MCP), allowing it to connect directly to agents like Claude Code, Cursor, and Aider.

Who it’s for

Developers using AI coding agents who want to maintain strict security boundaries between their sensitive credentials and the LLM context.

Highlights

  • Local-first encrypted vault for secret storage.
  • Integration with popular agents (Claude Code, Cursor, Aider, etc.) via MCP and wrappers.
  • Repo hooks that block managed secrets from being committed to version control.
  • Audit records for all brokered secret usage.
  • Telemetry is disabled by default.

Related

  • Project
    Infisical/agent-vault

    Agent Vault is an open‑source HTTP proxy that stores secrets and injects them into outbound requests for AI agents, preventing the agents from ever seeing real credentials. It offers a management UI, CLI, per‑agent tokens, pluggable secret back‑ends (including Infisical), egress filtering, request logging, and optional PostgreSQL scaling. Deployable as a single binary or Docker image, it integrates via standard `HTTPS_PROXY` environment variables and is aimed at securing remote‑coding, all‑purpose, custom, and sandboxed AI agents.

  • Project
    hashgraph-online/hol-guard

    HOL Guard is a Python‑based, local‑first antivirus for AI agents. It intercepts shell commands, file access, package installs, and plugin usage, flagging secrets, destructive actions, prompt‑injection, and supply‑chain risks. Users install via `pipx`, run a wizard to hook supported agents (Codex, Claude Code, Copilot CLI, Gemini, etc.), and manage approvals through a CLI or optional cloud dashboard. The repo also provides `plugin‑scanner` for CI security checks of AI plugins, with a ready GitHub Action.

  • Project
    tech-leads-club/agent-skills

    A secure, validated registry and CLI for installing verified skills and instructions to extend the capabilities of professional AI coding agents.

  • Project
    hardenrun/aif

    A local safety system for coding agents that prevents the execution of dangerous commands and blocks secret leaks through pre-execution blocking.

  • Project
    JuliusBrussee/cavemem

    A cross-agent persistent memory system for coding assistants that uses compressed local storage and MCP to allow AI agents to remember information across sessions.