Per-project secrets in local KeePassXC vaults, injected into commands without ever printing them. Agent-safe: PreToolUse guard hook + read-only MCP server. Single Go binary.
KeePass Plugin with a Fluent Design search window to quickly find entries and autotype or copy passwords and other fields. A global shortcut opens the search window from anywhere.