Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-16 · high
The tool feeds fake credentials to anything that reads your secrets without asking first, including AI agents.
Why now: Posted to Show HN and covered in the August 16 briefing at 45 points and 66 comments.
jit puts a Touch ID prompt between your Mac and every secret on it. The Go tool, built for Apple Silicon, pulls credentials out of .env files, ~/.aws/credentials, and shell exports into a vault, then decides per process what that process actually sees.
The pitch is blunt: your laptop is the last place your secrets sit in plaintext, per the GitHub repo. Anything with permission gets the real value through one of three delivery paths, execve environment replacement, native credential protocols, or POSIX FIFOs. Anything without permission reading from those same FIFOs gets a decoy instead of an error, so a snooping process can't tell it's been fed a fake.
That decoy mechanic is built with AI agents in mind. An agent running with your full permissions still has to request each credential through a consent system rather than inheriting your environment wholesale. MCP configs store a vault path instead of a raw key, and the audit trail logs which secrets which agent touched.
That's a real gap closed. Anyone running Claude Code, Cursor, or another agent with shell access has been trusting it with the same plaintext exports a human developer would see. jit narrows that to a request-and-log model instead of blanket inheritance.
What the repo doesn't show is how consent actually gets granted or revoked in practice, or whether an agent that already holds a session token can replay it after the fact. 84 GitHub stars and a Show HN thread is early traction, not a track record. The open question worth watching: does the audit trail catch an agent that requests a credential once and then caches it outside jit's reach?
Each link below shares sources, entities, or timing with this story.
MCP uses OAuth / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (MCP uses OAuth); both cover GitHub, MCP; reported by the same outlet (github.com).
Cursor uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Linked by a graph relationship (Cursor uses MCP); both cover Apple Silicon, MCP; reported by the same outlet (github.com).
Figma supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Figma supports MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Cursor uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Claude Code uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
OpenCode supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (OpenCode supports MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
MCP uses Docker / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (MCP uses Docker); both cover GitHub, MCP; reported by the same outlet (github.com).