Command line

keymitt <command> [options]

Secrets

add

keymitt add <name> [--description <text>] [--command <program>]... [--host <host>]...
                   [--env <VAR>]... [--channel stdin|env|file|http]... [--from-stdin]

Stores a new secret. The value is prompted for twice without echo, or read from standard input with --from-stdin (for example pbpaste | keymitt add api --from-stdin --host api.example.com). Names use letters, digits, ., _ and -. --command psql resolves the program now and stores its full path. --env restricts which environment variable names the secret may be put in. Without --channel, --command enables stdin, env and file, and --host enables http.

update

keymitt update <name> [--from-stdin]

Replaces the value of an existing secret.

rm

keymitt rm <name> [--yes]

Deletes the value from the keychain and the entry from the policy. Asks you to type the name to confirm, unless --yes is given.

list

Shows every secret, whether its value is present in the keychain, and its channels, programs and hosts.

allow, disallow

keymitt allow <name> [--command <program>]... [--host <host>]... [--env <VAR>]... [--channel <channel>]...
keymitt disallow <name> [--command <program>]... [--host <host>]... [--env <VAR>]... [--channel <channel>]...

Adds or removes rules. Allowing a host also enables the http channel; commands are stored as full paths.

Server

mcp

Runs the MCP server on standard input and output. Configure this in your AI client. Logs go to standard error; set KEYMITT_LOG (warn by default) for more detail.

Approvals

Command	Purpose
keymitt pending	List requests waiting for terminal approval
keymitt approve <id>	Approve one; you type yes to confirm. Needs an interactive terminal
keymitt deny <id>	Deny one

Backup

Command	Purpose
keymitt backup <file>	Encrypted backup of the policy and all values. Strong approval and a passphrase
keymitt restore <file> [--overwrite]	Restore with strong approval; existing values and entries are kept unless --overwrite

Audit

keymitt audit [-n <lines>]

Prints the last entries (20 by default) of audit.jsonl, one JSON object per line. Events are add, update, remove, run, http, read_file, backup and restore. Entries record the secrets involved, the command or URL with placeholders, the approval (method, strength, elapsed_ms), the outcome and the number of redactions — never values. The log rotates to audit.jsonl.1 at 10 MB.

Setup and diagnostics

Command	Purpose
keymitt doctor [--approval]	Check paths, policy (including bare program names), keychain, approval methods and curl
keymitt setup claude	Print the Claude Code registration command
keymitt setup polkit	Print the Linux polkit action and how to install it
keymitt paths	Show where keymitt keeps its files

Environment variables

Variable	Purpose
KEYMITT_HOME	Directory for policy.toml, audit.jsonl and pending approvals
KEYMITT_LOG	Log filter for keymitt mcp, e.g. info or debug