On this page

Distributed Thinking Systems is announcing the general availability of Secrets Kit 2.0.2. The public stable release brings together local credential storage, selected application access, and encrypted peer-to-peer synchronization. The client is free and open source, and synchronization between authorized peers on the same local network is free too. Optional Remote Secret Sync (RSS) connects enrolled peers across networks when direct communication is unavailable.

Download Secrets-Kit 2.0.2 Get Started

The download is the free client’s install.sh installer. Get Started covers supported platforms and installation instructions.

Version 2.0.2 is a substantial re-architecture of Secrets Kit, not simply an update to its earlier Keychain-based workflow. Encrypted SQLite provides the normal new-store and synchronization path, with independent local storage keys on each peer. macOS Keychain remains a supported backend; existing Keychain records do not automatically become synchronized SQLite records.

Free local storage and LAN synchronization

Secrets Kit keeps API keys, tokens, and passwords on your machines. Applications and scripts can receive selected credentials through seckit run, rather than keeping copies in shell scripts or project configuration files. That works for database clients, scheduled jobs, development tools, and agents; it is not an agent-only product. Hermes integration is available, but neither Hermes nor an AI service is required to use the client.

Authorized peers on the same LAN segment can synchronize through the free peer-to-peer client, with unlimited LAN connections and no hosted subscription. Local credential access does not depend on a hosted vault. Each peer retains its own storage protection, and discovering another machine does not grant it permission to receive secrets.

Remote Secret Sync when your machines are on different networks

RSS is an optional paid service for authorized peers that cannot communicate directly across network boundaries. It carries synchronization payloads encrypted for their destination. Your private encryption keys stay with you. We do not receive them, and RSS cannot decrypt your synchronized secret payloads. Local access and authorized LAN synchronization remain available independently of RSS.

Subscription enrollment is open and does not require an invitation or access code. Follow the installed client’s documented checkout and enrollment workflow; purchasing capacity and authorizing a peer are separate steps.

RSS costs US$5 per node per month, with a two-node minimum of US$10/month. Each additional enrolled node adds US$5/month. For billing, a node is an RSS-enrolled Secrets Kit identity associated with an operating-system user—not each application or agent using that identity. Separate enrolled user identities on one physical machine can count separately. The pricing page explains capacity, examples, and subscription management.

Synchronization messages are handled transiently in memory, rather than retained as a cloud copy of your secret store. Account and operational metadata have separate retention rules. An optional encrypted peer-invitation mailbox is a different feature and is not currently configured in production. Our Security & Privacy overview and service policies describe those distinctions and the operating-system limitations.

Protect the credential—and choose what receives it

Secrets Kit reduces the need for scattered credential copies; it does not make the receiving process trustworthy. An application supplied with a credential receives its plaintext value and can log, expose, or transmit it. Agents with sufficient system access can do the same. Optional policy-scoped MCP access also requires an explicit decision about whether a value may enter model context.

Synchronization is not a backup. Changes and deletions can propagate, so local keys, recovery material, and tested backups remain important. Start with a disposable credential and verify application access and peer authorization before moving an existing workflow.

Install the public release

Secrets Kit 2.0.2 is available for macOS and supported glibc-based Linux systems. Begin with Get Started, follow the versioned installation guide, or download the installer from the stable v2.0.2 release. The release includes the managed installer; GitHub’s source-code archives are not the customer installation path.

The product overview explains the local-first workflow, Guides cover everyday tasks, and Pricing explains when paid RSS is useful. You can begin with one local application and add LAN peers without subscribing to anything. Add RSS only when you need the cross-network connection.

For help with deployment, migration, integrations, or ongoing maintenance, contact Distributed Thinking Systems about a maintenance contract or consulting engagement. Scope and fees are agreed separately from an RSS subscription; the subscription does not itself include a maintenance contract or priority support.