Your agent asks. You tuck it away.
Save API keys straight to Apple Keychain, without pasting them into your agent’s chat. Tuck clears your current clipboard after you paste.
Free for Mac · macOS 14 or later
Runs entirely on your Mac · no account · no server · no network access
Out of your agent’s chat.
Paste into a native secure field. Your agent gets a save status; the key never enters the conversation.
Off your clipboard.
Tuck clears your current clipboard after a successful paste. Clipboard-history apps may still retain an earlier copy.
In Apple Keychain.
Stored on your Mac with Apple’s normal access controls. No Tuck account, server, or separate credential store.
What left your Mac.
Tuck is a passthrough with a friendly face. There is no account, no server, no analytics, and no way to read a key back. It holds the key only for the moment it takes to write it to Apple Keychain, with Apple's normal access controls. Don’t take our word for it: the complete source is public on GitHub, so you can check every line of this receipt.
TUCK · RECEIPT
Small details that matter mid-session.
TuckKnows what a key looks like
Tuck recognizes well-known key formats and says “Looks like an OpenAI API key” as you paste. It warns when the key contradicts the destination and flags a stray trailing space. Advisory only. Save is always yours.
Counts every character
A live count while you type, and a confirmation that says how many characters were saved. Long keys that terminal prompts truncate arrive whole.
Replace on purpose
If the item already exists, Tuck asks for a second explicit Replace. Requests expire after five minutes. A second request while one is open is told to wait.
The real app.
Connect your agent.
Start in the Mac app. Tuck provides the instructions for Claude Code, Codex CLI, and other local MCP agents.
Setup help →- Open Tuck.Choose “Connect your agent.”
- Give your agent the instructions.Click “Copy instructions for my agent,” then paste them into your coding agent.
- Let your agent finish connecting.It adds Tuck and installs the skill. Restart the agent if prompted.
Security you can check.
A tool that handles your API keys shouldn’t ask for blind trust. Every line of Tuck is public, so you, or anyone you trust, can confirm it has no servers, no network access and no way to read a key back.
Tuck is fair source under the Functional Source License (FSL-1.1-ALv2). Read the code, build it yourself, and send an improvement. The one thing it rules out is selling a competing copy. Every release becomes Apache 2.0 open source two years after it ships.
Questions people ask.
Tuck is a free Mac app and local MCP server that lets an AI coding agent like Claude Code or Codex CLI ask you for an API key, then saves what you enter to Apple Keychain without the value entering the agent conversation, for developers who work with local AI agents.
How can I give a local AI coding agent like Claude Code an API key without pasting the secret into the chat?
Connect Tuck to the agent as an MCP server. When the agent needs a key, it calls Tuck's save_credential tool with only a Keychain service name and account name. Tuck opens a native popup with that destination filled in. You paste the key and click Save. The agent gets back one status word, such as saved or cancelled, and never the key.
Is there an MCP server that lets a coding agent ask me for a credential and save it to the macOS Keychain without the value ever entering the conversation?
Yes, Tuck. Its MCP server has one tool, save_credential. The agent can send a service name, an account name and an optional link to the provider's key page. It cannot send the secret, and nothing comes back but a status. Tuck writes the value to your login Keychain as a standard generic password item. There is no tool to read, list, export or delete a credential.
What are alternatives to the 1Password CLI for supplying secrets to local AI coding agents?
Tuck covers the step where you hand a new key to an agent. Tuck is not a password manager. It has no account, no server, no credential store of its own and no network access, and its only permission is the App Sandbox. Each key goes to Apple Keychain, where your scripts read it at run time with the security command. The source is public on GitHub.
How do I connect Tuck to my agent?
Open Tuck, choose Connect your agent, copy the instructions and paste them into your agent. The agent then registers Tuck's MCP server and installs the Tuck skill. Both steps matter. The skill tells the agent when to use Tuck, but installing the skill alone does not connect the app. Tuck works with Claude Code, Codex CLI and other local agents that can launch a stdio MCP server.
Is this the Tuck menu bar app or the Tuck window hider?
No. Tuck at tuckaway.dev saves API keys to Apple Keychain for AI coding agents. It is a different app from the Tuck menu bar manager and from Irradiated Software's Tuck window hider. It is free on the Mac App Store and needs macOS 14 or later.
Does Tuck connect to the internet?
No. There is no Tuck account, server or analytics, and macOS gives Tuck no network access at all: its only permission is the App Sandbox. You can check it yourself in Terminal:
codesign -d --entitlements - /Applications/Tuck.app
Can I read the code?
Yes. Tuck is fair source: the complete app is on GitHub under the Functional Source License (FSL-1.1-ALv2). Read it, build it yourself, or send an improvement. The one thing it rules out is selling a competing copy, and every version becomes Apache 2.0 two years after its release.
Does Tuck ever see my key?
Only in the native secure field while you enter it, and only for as long as it takes to write to Keychain. Tuck does not store it, log it, or send it to your agent.
Can my agent read the key back?
No. The only tool Tuck offers is save. There is no read, list or export, and the response to the agent is a status word.
Where is the key stored?
In your Mac's login Keychain, as a standard generic password item with the service and account names your agent supplied. You can see and manage it in Apple's Keychain Access.
Can my agent open web pages through Tuck?
It can suggest one page: the provider's official key page. Tuck shows the site name, says in the link's help text that the agent suggested it, and opens it in your default browser only when you click.
Is it safe to paste an API key into Claude Code?
It works, but the key becomes part of the conversation: it is sent to the model provider with your messages and kept in the session history on your Mac. With Tuck, Claude Code asks for the key by name, you enter it in Tuck’s popup, and the agent only ever sees the word saved.
How do I store an API key in Keychain on a Mac?
Ask your coding agent to save it with Tuck: the popup opens with the Keychain service and account already filled in, and you paste the key and click Save. Without an agent, Apple’s security command saves one and prompts you for the value, so the key stays out of your shell history:
security add-generic-password -s SERVICE_NAME -a ACCOUNT_NAME -w
How do MCP tools keep secrets out of the chat?
Tuck’s MCP tool never takes a secret as an argument. The agent sends only names, you type the value into a native window the agent cannot see, and the tool returns a status. A secret passed as an MCP argument or returned in a result ends up in the conversation.
Is Tuck an alternative to .env files for AI agents?
For keys, yes. A .env file is plain text in your project, where your agent can open it. Tuck saves each key to Keychain instead, and your scripts read it when they run, for example:
security find-generic-password -s SERVICE_NAME -w
macOS may ask you to allow a tool the first time it reads a saved item.
What does it cost, and what do I need?
Tuck is free. It requires a Mac on macOS 14 or later and a local coding agent that supports MCP and can launch a stdio server. It saves to Apple Keychain only.