trevorbyrum/keymask: Local MCP credential broker for coding agents (Claude Code, Codex, Gemini, and any MCP-stdio client). Agent requests secrets via schema, you type values into a localhost form, values land in Vault / .env / macOS Keychain / libsecret / Windows Credential Manager / SSH host — never the AI transcript. Output scrubbing on subprocess stdout. MIT. 💻Terminal Control