enclave

[enclave]

Your AI agent needs your Netflix password. Instead of asking in chat, it sends you a link. You type the password (or your password manager fills it) and tap Send. It's locked in your browser before it leaves, so only your agent can open it. The agent keeps it in a vault of its own, next to 2FA codes and passkeys, and uses it later without seeing it.

[The enclave page in the ledger theme: hex is asking for Netflix, with email and password fields, a Send to hex button, and a ledger showing who holds the secret] [The same page in the field theme, on a full blue background]

hex   I need your Netflix login to finish this: https://moonlit-lynx-37.convex.site/k3Jd8vQ2…you   open it, type, tap Sendhex   saved Netflix: email, password

It works out of the box with a hosted relay. No accounts, no keys to set up, nothing for the person to install.

Set up your agent

Agents with a shell (Claude Code, Codex, Cursor, Gemini CLI, OpenCode and 30 more) get it as a skill:

npx skills add AVGVSTVS96/enclave

It runs enclave with npx, so there's nothing else to install.

Agents that use MCP get the same thing as tools. Add the server below, and add this line to the agent's instructions, because tools alone don't stop a model from asking in chat:

When you need a password, API key or other secret, ask for it with the enclave tools rather than in chat.

/plugin marketplace add AVGVSTVS96/enclave/plugin install enclave@enclave

claude mcp add enclave -- npx -y enclave-link mcp

codex mcp add enclave -- npx -y enclave-link mcp

tool_timeout_sec = 1800

{  "mcpServers": {    "enclave": { "command": "npx", "args": ["-y", "enclave-link", "mcp"] }  }}

{  "servers": {    "enclave": { "type": "stdio", "command": "npx", "args": ["-y", "enclave-link", "mcp"] }  }}

gemini extensions install https://github.com/AVGVSTVS96/enclave

grok mcp add enclave -- npx -y enclave-link mcp

{  "mcp": {    "enclave": { "type": "local", "command": ["npx", "-y", "enclave-link", "mcp"] }  }}

{  "context_servers": {    "enclave": { "command": "npx", "args": ["-y", "enclave-link", "mcp"], "env": {} }  }}

openclaw mcp add enclave --command npx --arg -y --arg enclave-link --arg mcp

mcp_servers:  enclave:    command: npx    args: ["-y", "enclave-link", "mcp"]    timeout: 1800

ChatGPT, Claude.ai and the Gemini and Grok apps can't use enclave yet: they run in the cloud, and the vault lives on the computer where the agent runs. Their desktop and coding-agent versions above work.

Your own code can use the TypeScript SDK; see SDK.

How it works

agent                          relay (Convex)                   person's browser─────                          ──────────────                   ────────────────makes a one-time key pairenclave ask ─── open ──────────▶  stores an empty request         ◀── link ───────────sends https://…/<id>#key=…  ──────────────────────────────────▶ opens the link                                                                 reads the key after #                                                                 (browsers never send it)                                                                 encrypts the answer                               stores encrypted bytes ◀───────── POST, onceenclave wait ◀── live update ───decrypts, saves to its vaultdeletes the request ────────▶  gone

• The relay can't read anything. The key it would need never leaves the agent's computer. The public key travels in the part of the link after #, which browsers don't send to servers, so the relay doesn't even learn what was asked for.
• Links work once and expire. The first answer wins, and the request is deleted as soon as the agent picks it up, or after 24 hours.
• No polling. enclave wait holds a live Convex subscription and wakes up the moment the answer lands.

Using a secret without seeing it

enclave run KEY="OpenAI API key/key" sh -c 'curl -s https://api.openai.com/v1/models -H "Authorization: Bearer $KEY"'

run works like env, except the values come from the vault, and anywhere one shows up in the command's output it's replaced with [hidden KEY]. Quote the command so your own shell doesn't expand $KEY first.

To type a password into a login form, pipe it straight into whatever does the typing: enclave get Netflix password | <typer>. A field named totp holds a 2FA setup key, and enclave get GitHub totp gives its current 6-digit code.

Passkeys

A field named passkey holds a passkey, and the agent signs in with it in Chrome without ever seeing its key:

enclave passkey GitHub    # then click the site's passkey sign-in

enclave passkey arms the passkey for one sign-in, for up to 5 minutes. When the site asks for a passkey, enclave's Chrome extension hands the request to enclave sign, which signs it inside the vault and disarms the passkey. The private key never leaves the vault: enclave get and enclave run refuse passkey fields.

A passkey keeps working in Proton Pass and enclave side by side.

Install the extension once per machine, with Google Chrome on Linux, from a clone of this repo at the release the vault runs. Every release is tagged v<version>. It's force-installed through Chrome's policy, so it loads in every profile:

git clone https://github.com/AVGVSTVS96/enclave && cd enclavegit checkout "v$(enclave --version)"extension/install                   # signs with that release on this machine, through npx

or with a vault on another machine:

git checkout "v$(ssh my-server enclave --version)"extension/install ssh my-server enclave sign

Bring your Proton Pass vault

enclave import proton            # every vaultenclave import proton Work       # or just the ones you name

copies Proton Pass in through pass-cli: logins, 2FA, passkeys, notes, cards, SSH keys and custom fields, one item per Proton item, named by its title. Proton keeps everything. Run it again to bring in what changed: names stay the same, renames follow, items deleted in Proton leave enclave too, and anything you saved yourself is kept. A value you save over one of Proton's stays until that field changes in Proton.

2FA comes in as a totp field, so enclave get <name> totp gives the current code, and passkeys as a passkey field.

CLI

npm install -g enclave-link      # or run any of these with npx -y enclave-link

ENCLAVE_FROM sets the name the page shows ("hex is asking for…"), ENCLAVE_HOME sets where the vault lives (~/.enclave), and ENCLAVE_RELAY points at your own relay.

MCP tools

There's no tool that returns a secret's value.

SDK

import { vault } from "enclave-link"
const { url, wait } = await vault.ask("Netflix", ["email", "password"])// send url to the personawait wait()
await vault.run(["sh", "-c", 'curl -u "$EMAIL:$PASSWORD" https://example.com'], {  EMAIL: "Netflix/email",  PASSWORD: "Netflix/password",})

vault reads ENCLAVE_FROM, ENCLAVE_HOME and ENCLAVE_RELAY. For anything else, openVault({ from, home, relay, store }) makes one of your own. It also has get, list and remove, the same as the CLI.

Answers are saved to ~/.enclave by default. To keep them somewhere else, pass a store: any object with get, put, remove and names, like your own database. For a one-time answer that's never written to disk, keep it in memory:

const answers = new Map()const oneTime = openVault({  store: {    get: async (name) => answers.get(name),    put: async (name, item) => void answers.set(name, item),    remove: async (name) => void answers.delete(name),    names: async () => [...answers.keys()],  },})

Security

The encryption is HPKE (RFC 9180) with X25519, HKDF-SHA256 and AES-128-GCM, built on the browser's own Web Crypto with no libraries, and tested against the RFC's test vectors. Answers are padded, so the relay can't even tell how long a password is.

The vault keeps each item encrypted in ~/.enclave/items, sealed to the vault's own key in ~/.enclave/key.json and bound to the item's name. The item files are safe to back up anywhere. The key is what unlocks them, so treat it like an SSH key.

What enclave can't protect against:

• Whoever runs the relay sends you the page. Your browser downloads the page, including the code that locks your password, from the relay each time you open a link. What the relay stores can't be read, but if someone took over the relay's Convex account, they could change the page to copy what you type before locking it. The page's script is 128 lines in page/page.ts plus the encryption in src/hpke.ts, served as one file with a strict Content Security Policy, so you can read exactly what it runs. If you'd rather trust nobody's relay, host your own.
• Anyone with the link can answer it first. They still can't read anything, but they could send a fake answer. If that happens, the page says "This link doesn't work anymore" when you open it.
• Phishing. A link can say anyone is asking. Only send secrets to agents you asked for help.
• An agent that wants to see a secret can. enclave keeps secrets out of the chat and out of tool results, and run hides their exact values in output. But an agent with a shell on the same computer could still read its own vault. enclave stops secrets from leaking by accident, not a model that's trying.

Host your own

The relay is a Convex app, so self-hosting is a few commands, on Convex's cloud or the open-source Convex backend:

git clone https://github.com/AVGVSTVS96/enclave && cd enclavenpm installnpm run dev -- --once    # sign in to Convex and create your projectnpm run deploy

Then point agents at it with ENCLAVE_RELAY=https://<your-deployment>.convex.cloud.

Themes

The page comes in two themes, both following the system's light or dark mode:

• ledger (the default): calm and white. A highlighter marks what's readable, and a small ledger shows who holds the secret: you, the relay, or your agent.
• field: the whole screen is one color. After you send, a track shows where it went, and a used link turns gray.

Pick one, and optionally one color, when you deploy:

ENCLAVE_THEME=field ENCLAVE_COLOR=#ff4a2e npm run deploy

ENCLAVE_COLOR is ledger's highlight or field's background, and text on it switches between white and ink to stay readable. To make your own theme, copy page/themes/ledger.css and point ENCLAVE_THEME at your file. A theme is plain CSS over the page's fixed markup, and any fonts or images it links to get built into the page, which loads nothing from anywhere else.

Develop

npm run dev      # builds the page and runs a Convex dev deploymentnpm run check    # typecheck and testsnpm run build    # bundles the CLI, SDK and types into dist/npm version 0.3.0  # a release: sets every version, commits and makes the signed tag v0.3.0

License

MIT