secure-my-setup

Move the plaintext secrets in your dev setup into a 1claw local vault, and let your AI coding agent use them without ever seeing the values.

1claw setup connects your agent to the vault. secure-my-setup fills the vault, safely, from the mess you already have, then hands off to that same secure wiring.

What it does

1. Scans your project (and, with --global, your machine) for plaintext secrets.
2. Moves them into your 1claw local vault, verifying each one landed before it touches a file.
3. Strips them from your files, gitignores those files, and flags any that were committed to git for rotation.
4. Wires your AI harness (Cursor, Claude Code, Codex, Hermes) to the local daemon, so the agent fetches secrets through 1claw's guarded proxy instead of reading them in plaintext.

Requirements

• Node 20 or newer.
• The 1claw CLI: npm i -g @1claw/cli (or brew install 1clawAI/tap/oneclaw).

Use

# dry run: see what would happen, nothing changes
npx secure-my-setup

# move secrets into the vault, strip them from files, wire your agents
npx secure-my-setup apply

# run your app with the migrated secrets injected into its env, nothing on disk
npx secure-my-setup run -- npm start

# put the secrets back into your files
npx secure-my-setup undo

Add --global to also scan ~/.zshrc, ~/.aws/credentials, and ~/.config. Add --json for machine-readable output.

Security

secure-my-setup never sees your vault passphrase, never writes a credential into a harness config, and never sends a secret over the network. The secure wiring uses 1claw's local daemon: the agent calls a proxy that injects the secret into outbound requests server-side, so the raw value never enters the model's context.

See SECURITY.md for the threat model, and scripts/live-proof.sh for a runnable proof against the real daemon.

Develop

npm install
npm run build
npm test

License

MIT