gethasp/hasp

What it solves

Coding agents often require API keys and credentials to run tests or deploy code. Traditionally, these secrets are placed in .env files or prompts, which risks leaking them into the agent's context or shell history. HASP prevents this by ensuring managed secret values never enter the agent's context.

How it works

HASP acts as a local secret broker. It stores credentials in a local encrypted vault and only provides the secret values to specific commands or tools at runtime. It supports various integration flows including run, inject, and the Model Context Protocol (MCP), allowing it to connect directly to agents like Claude Code, Cursor, and Aider.

Who it’s for

Developers using AI coding agents who want to maintain strict security boundaries between their sensitive credentials and the LLM context.

Highlights

• Local-first encrypted vault for secret storage.
• Integration with popular agents (Claude Code, Cursor, Aider, etc.) via MCP and wrappers.
• Repo hooks that block managed secrets from being committed to version control.
• Audit records for all brokered secret usage.
• Telemetry is disabled by default.