Bouclier.ai runs on your Mac, between your AI tools and the providers. When your coding agent — Claude Code, Cursor — needs an API key, it gets it through your shell, never into the model's context. It can provision a whole project's environment variables in a single approval. No certificate to install.
Beta — research prototype. Not meant to be used live.
Bouclier is published for evaluation, security research, and personal experimentation. It is not a commercial product, is not supported, and is not meant for production, regulated workloads, or any environment where a failure could cause harm. Secret handling is best-effort; review what you store. See the Terms before installing.
Local-only. Secrets live in your macOS Keychain and never leave this Mac.
When your agent needs a credential, Bouclier asks you— in a local dialog, not in the chat. You paste it (or let Bouclier generate one). It's stored in your Keychain and injected into the shells your agent spawns, so a command like curl -H "Authorization: Bearer $STRIPE_KEY" just works — while the value never enters the model's context, the MCP channel, or any log.
The agent requests a secret by name. Bouclier opens a dialog where YOU paste or generate the value. The agent only ever learns the variable name — never the value.
The value lands in your macOS Keychain, scoped to Bouclier. On the way out, a managed secret is scrubbed to a placeholder so the model provider never sees it either, then restored in the response.
It's injected into new shells as $ENV_VAR. Your agent uses it in real commands; the conversation and the model context stay clean.
Point your agent at a new repo's environment needs and approve them together — Bouclier shows one dialog, batches as many secrets as it takes, and tells the agent exactly which ones landed and which are still pending. Nothing is silently dropped. Pair it with the Vercel CLI (echo "$VAR" | vercel env add) to set dozens of deployment variables without the agent — or the chat — ever seeing one.
Bouclier ships an MCP server and a bouclier CLI that share one core. An agent can orient itself, list and request secrets, and ask you to turn protection on. What it can'tdo is the point: it can never read a value, disable protection, or widen a secret's policy. The agent proposes; you approve; Bouclier enforces.
# orient before acting
bouclier status
→ protection ON (standard mode) · 3 secrets usable
# ask the human for what's missing
bouclier secrets request STRIPE_KEY DATABASE_URL --reason "deploy"
→ a dialog opens; you paste; the agent gets names, never values
# this is refused, by design
bouclier protection disable
→ not available to agents — do it in the app (exit 7)status, list secrets, request and activate them — no value is ever returned. The agent works on its own.
Turning protection on is a one-tap approval in Bouclier's own dialog. The agent suggests; the human decides.
Read a value, disable protection, uninstall — none of these have an agent path. The tool can't switch off the thing guarding it.
By default Bouclier points your AI tools at a local gateway by setting a base URL — no root certificate, nothing installed in your trust store, no system-wide interception. Your prompts reach the provider byte-for-byte, with one deliberate exception: the managed secrets you asked Bouclier to keep out. Auth headers are forwarded untouched so your tools authenticate normally.
Forwarded byte-for-byte — except a managed secret, which is swapped for a placeholder on the way out and restored in the response so the provider never sees it. No blind rewriter touching your other fields.
Authorization, x-api-key, trace IDs, analytics — every header reaches the upstream unmodified, so your tools keep working. Pinned by an end-to-end test so a future change can't drift.
The gateway binds 127.0.0.1 and nothing else — there's no system-wide traffic redirection. Only processes that explicitly point at it (ANTHROPIC_BASE_URL / OPENAI_BASE_URL) are ever in scope.
Standard mode installs nothing. The byte-identical guarantee is pinned by an end-to-end test in CI on every release.
Deploy and configure via Jamf, Kandji, or Mosyle. Control the gateway port, additional AI domains for the secret keeper's host bookkeeping, and feature flags across your fleet.
Every secret-keeper event is logged locally and can be forwarded to your SIEM. Export a privacy-scrubbed diagnostics bundle for incident response.
An agent can use Bouclier but never weaken it — disabling protection or reading a secret has no agent path, only a human one. The tool can't switch off its own guard.
Secret placeholders are restored across streaming response chunks byte-for-byte, so your local tool calls still work even when the model streams the value back mid-token.
Secrets live in your macOS Keychain, scoped to Bouclier, and never reach the model, the MCP channel, or any log.
No cloud LLM, no analytics, no telemetry in the app.
Scan logs never contain your prompts, responses, secrets, or API keys — only metadata.
Bouclier installs no certificate — the gateway is a plaintext-loopback relay, not a TLS-terminating proxy.
Published threat model and privacy policy covering every trust boundary.
Download the DMG, drag to Applications, click Enable. Your agent can start using secrets it never sees from that moment.
Download for macOSmacOS 15+ · Apple Silicon & Intel · v0.8.0