abracadabra

Every autonomous coding agent hits the same wall: it needs an API key, and the only way to get one is to ask a human to paste it into the chat. That leaks the secret into transcripts, logs, and pull requests, it blocks the agent until someone is at the keyboard, and it leaves credentials scattered across stale .env files with no rotation story.

abracadabra is a local vault with a loopback API on 127.0.0.1:7331. Secrets live in the OS keystore — Keychain behind Touch ID on macOS, keytar on Linux and Windows, with an encrypted passphrase file as a portable fallback. Agents retrieve secrets by name over that API using a scoped, expiring bearer key, so the value never enters the conversation; an MCP server offers the same access interactively, where one biometric approval grants a TTL-bounded window of silent reads. A subprocess wrapper injects the resolved secrets into any command's environment without writing them to disk. The human performs exactly one high-trust action — issuing a scoped key — and the agent operates autonomously afterward.

Published to npm as @userdefault/abracadabra and used as the credential layer for the GotchiBot agent fleet. Secrets sync between machines over USB or LAN as sealed cartridges, so a new laptop never requires re-pasting a key.