enclave

Your AI agent needs your Netflix password. Instead of asking in chat, it sends you a link. You type the password (or your password manager fills it) and tap Send. It's locked in your browser before it leaves, so only your agent can open it. The agent keeps it in a vault of its own, next to 2FA codes and passkeys, and uses it later without seeing it.

hex   I need your Netflix login to finish this: https://moonlit-lynx-37.convex.site/k3Jd8vQ2…

you open it, type, tap Send hex saved Netflix: email, password

It works out of the box with a hosted relay. No accounts, no keys to set up, nothing for the person to install.

Set up your agent

Agents with a shell (Claude Code, Codex, Cursor, Gemini CLI, OpenCode and 30 more) get it as a skill:

npx skills add AVGVSTVS96/enclave

It runs enclave with npx, so there's nothing else to install.

Agents that use MCP get the same thing as tools. Add the server below, and add this line to the agent's instructions, because tools alone don't stop a model from asking in chat:

When you need a password, API key or other secret, ask for it with the enclave tools rather than in chat.

Claude Code

/plugin marketplace add AVGVSTVS96/enclave

/plugin install enclave@enclave

Or as MCP tools:

claude mcp add enclave -- npx -y enclave-link mcp

Codex

codex mcp add enclave -- npx -y enclave-link mcp

Codex stops a tool after 60 seconds by default, and wait_for_secret can wait 25 minutes, so add this under [mcp_servers.enclave] in ~/.codex/config.toml:

tool_timeout_sec = 1800

Cursor, Claude Desktop, Windsurf, Cline, Roo Code, Kiro, Junie, Factory

They all take the same JSON:

{

"mcpServers": { "enclave": { "command": "npx", "args": ["-y", "enclave-link", "mcp"] } } }

VS Code and GitHub Copilot

.vscode/mcp.json:

{

"servers": { "enclave": { "type": "stdio", "command": "npx", "args": ["-y", "enclave-link", "mcp"] } } }

Gemini CLI

gemini extensions install https://github.com/AVGVSTVS96/enclave

Grok Build

grok mcp add enclave -- npx -y enclave-link mcp

OpenCode

opencode.json:

{

"mcp": { "enclave": { "type": "local", "command": ["npx", "-y", "enclave-link", "mcp"] } } }

Zed

In Zed's settings.json:

{

"context_servers": { "enclave": { "command": "npx", "args": ["-y", "enclave-link", "mcp"], "env": {} } } }

OpenClaw, Hermes and other chat assistants

Assistants that talk to you through Telegram, Discord or WhatsApp should use the skill (npx skills add AVGVSTVS96/enclave), so the link reaches you in the chat. For MCP instead:

openclaw mcp add enclave --command npx --arg -y --arg enclave-link --arg mcp

Hermes, in ~/.hermes/config.yaml:

mcp_servers:

enclave: command: npx args: ["-y", "enclave-link", "mcp"] timeout: 1800

Goose

Run goose configure, choose Add Extension → Command-line Extension, enter npx -y enclave-link mcp, and set the timeout to 1800 seconds.

ChatGPT, Claude.ai and the Gemini and Grok apps can't use enclave yet: they run in the cloud, and the vault lives on the computer where the agent runs. Their desktop and coding-agent versions above work.

Your own code can use the TypeScript SDK; see SDK.

How it works

agent                          relay (Convex)                   person's browser

───── ────────────── ──────────────── makes a one-time key pair enclave ask ─── open ──────────▶ stores an empty request ◀── link ─────────── sends https://…/ #key=… ──────────────────────────────────▶ opens the link reads the key after # (browsers never send it) encrypts the answer stores encrypted bytes ◀───────── POST, once enclave wait ◀── live update ─── decrypts, saves to its vault deletes the request ────────▶ gone

• The relay can't read anything. The key it would need never leaves the agent's computer. The public key travels in the part of the link after #, which browsers don't send to servers, so the relay doesn't even learn what was asked for.
• Links work once and expire. The first answer wins, and the request is deleted as soon as the agent picks it up, or after 24 hours.
• No polling. enclave wait holds a live Convex subscription and wakes up the moment the answer lands.

Using a secret without seeing it

enclave run KEY="OpenAI API key/key" sh -c 'curl -s https://api.openai.com/v1/models -H "Authorization: Bearer $KEY"'

run works like env, except the values come from the vault, and anywhere one shows up in the command's output it's replaced with [hidden KEY]. Quote the command so your own shell doesn't expand $KEY first.

To type a password into a login form, pipe it straight into whatever does the typing: enclave get Netflix password | . A field named totp holds a 2FA setup key, and enclave get GitHub totp gives its current 6-digit code.

Passkeys

A field named passkey holds a passkey, and the agent signs in with it in Chrome without ever seeing its key:

enclave passkey GitHub    # then click the site's passkey sign-in

enclave passkey arms the passkey for one sign-in, for up to 5 minutes. When the site asks for a passkey, enclave's Chrome extension hands the request to enclave sign, which signs it inside the vault and disarms the passkey. The private key never leaves the vault: enclave get and enclave run refuse passkey fields.

A passkey keeps working in Proton Pass and enclave side by side.

Install the extension once per machine, with Google Chrome on Linux, from a clone of this repo at the release the vault runs. Every release is tagged v . It's force-installed through Chrome's policy, so it loads in every profile:

git clone https://github.com/AVGVSTVS96/enclave && cd enclave

git checkout "v$(enclave --version)" extension/install # signs with that release on this machine, through npx

or with a vault on another machine:

git checkout "v$(ssh my-server enclave --version)"

extension/install ssh my-server enclave sign

Bring your Proton Pass vault

enclave import proton            # every vault

enclave import proton Work # or just the ones you name

copies Proton Pass in through pass-cli: logins, 2FA, passkeys, notes, cards, SSH keys and custom fields, one item per Proton item, named by its title. Proton keeps everything. Run it again to bring in what changed: names stay the same, renames follow, items deleted in Proton leave enclave too, and anything you saved yourself is kept. A value you save over one of Proton's stays until that field changes in Proton.

2FA comes in as a totp field, so enclave get totp gives the current code, and passkeys as a passkey field.

CLI

npm install -g enclave-link      # or run any of these with npx -y enclave-link

ENCLAVE_FROM sets the name the page shows ("hex is asking for…"), ENCLAVE_HOME sets where the vault lives (~/.enclave), and ENCLAVE_RELAY points at your own relay.

MCP tools

There's no tool that returns a secret's value.

SDK

import { vault } from "enclave-link"

const { url, wait } = await vault.ask("Netflix", ["email", "password"]) // send url to the person await wait()

await vault.run(["sh", "-c", 'curl -u "$EMAIL:$PASSWORD" https://example.com'], { EMAIL: "Netflix/email", PASSWORD: "Netflix/password", })

vault reads ENCLAVE_FROM, ENCLAVE_HOME and ENCLAVE_RELAY. For anything else, openVault({ from, home, relay, store }) makes one of your own. It also has get, list and remove, the same as the CLI.

Answers are saved to ~/.enclave by default. To keep them somewhere else, pass a store: any object with get, put, remove and names, like your own database. For a one-time answer that's never written to disk, keep it in memory:

const answers = new Map()

const oneTime = openVault({ store: { get: async (name) => answers.get(name), put: async (name, item) => void an