On this page

Distributed Thinking Systems is announcing the general availability of Secrets Kit 2.0.4. The public stable release brings together local credential storage, selected application access, and encrypted peer-to-peer synchronization. The client is free and open source, and synchronization between authorized peers on the same local network is free too. Optional Remote Secret Sync (RSS) connects enrolled peers across networks when direct communication is unavailable.

Product Overview Get Started Download Installer Script

The download is the free client’s install.sh installer. Get Started covers supported platforms and installation instructions.

The Secrets Kit 2.0 release series substantially rebuilt the earlier Keychain-based workflow. Encrypted SQLite provides the normal new-store and synchronization path, with independent local storage keys on each peer. macOS Keychain remains a supported backend; existing Keychain records do not automatically become synchronized SQLite records.

Free local storage and LAN synchronization

Secrets Kit keeps API keys, tokens, and passwords on your machines. Applications and scripts can receive selected credentials through seckit run, rather than keeping copies in shell scripts or project configuration files. That works for database clients, scheduled jobs, development tools, and agents; it is not an agent-only product. Hermes integration is available, but neither Hermes nor an AI service is required to use the client.

Authorized peers on the same LAN segment can synchronize through the free peer-to-peer client, with unlimited LAN connections and no hosted subscription. Local credential access does not depend on a hosted vault. Each peer retains its own storage protection, and discovering another machine does not grant it permission to receive secrets.

Two authorized LAN peers synchronize encrypted records, retain separate local storage keys, and supply selected credentials to their applications
Open full-size diagram

Free LAN synchronization keeps storage on your devices. Applications receive selected credentials as plaintext in their own processes, so their behavior still matters.

Remote Secret Sync when your machines are on different networks

RSS is an optional paid service for authorized peers that cannot communicate directly across network boundaries. It carries synchronization payloads encrypted for their destination. Your private encryption keys stay with you. We do not receive them, and RSS cannot decrypt your synchronized secret payloads. Local access and authorized LAN synchronization remain available independently of RSS.

A workstation and remote server synchronize destination-encrypted messages through optional Remote Secret Sync without giving the service their private keys
Open full-size diagram

RSS carries destination-encrypted messages between authorized peers on separate networks. Private keys remain with the peers; account and operational metadata have separate retention rules.

Subscription enrollment is open and does not require an invitation or access code. Follow the installed client’s documented checkout and enrollment workflow; purchasing capacity and authorizing a peer are separate steps.

RSS costs US$5 per paid node slot per month, with a two-slot minimum of US$10/month. Enrolling a device within purchased capacity does not add a charge. For billing, a node is an RSS-enrolled Secrets Kit identity associated with an operating-system user - not each application or agent using that identity. Separate enrolled user identities on one physical machine can count separately. The pricing page explains capacity, examples, and subscription management.

Synchronization messages are handled transiently in memory, rather than retained as a cloud copy of your secret store. Account and operational metadata have separate retention rules. An optional encrypted peer-invitation mailbox is a different feature and is not currently configured in production. Our Security & Privacy overview and service policies describe those distinctions and the operating-system limitations.

Protect the credential - and choose what receives it

Optional MCP access is local, not a network-facing secrets API. An agent’s MCP host talks to seckit-mcp over standard input/output (stdio), and seckit-mcp uses a Unix domain socket (UDS) to reach the same-user daemon. The MCP interface is read-only and policy-scoped; secret-value retrieval requires an explicit allowlist. The versioned MCP integration guide explains the configuration and access boundaries.

Within one machine and Unix account, an agent host connects to seckit-mcp over stdio, and seckit-mcp accesses the local daemon through a Unix domain socket
Open full-size diagram

No listening MCP network port. Synchronizing records between authorized peers does not expose either host's local MCP interface to agents on the other machine. This is not isolation between agents sharing one Unix account.

Secrets Kit reduces the need for scattered credential copies; it does not make the receiving process trustworthy. An application supplied with a credential receives its plaintext value and can log, expose, or transmit it. Agents with sufficient system access can do the same. Optional policy-scoped MCP access also requires an explicit decision about whether a value may enter model context.

Synchronization is not a backup. Changes and deletions can propagate, so local keys, recovery material, and tested backups remain important. Start with a disposable credential and verify application access and peer authorization before moving an existing workflow.

Install the public release

The current stable release, Secrets Kit 2.0.4, is available for macOS and supported glibc-based Linux systems. Begin with Get Started, follow the versioned installation guide, or download the installer from the stable v2.0.4 release. The release includes the managed installer; GitHub’s source-code archives are not the customer installation path.

The product overview explains the local-first workflow, Guides cover everyday tasks, and Pricing explains when paid RSS is useful. You can begin with one local application and add LAN peers without subscribing to anything. Add RSS only when you need the cross-network connection.

For help with deployment, migration, integrations, or ongoing maintenance, contact Distributed Thinking Systems about a maintenance contract or consulting engagement. Scope and fees are agreed separately from an RSS subscription; the subscription does not itself include a maintenance contract or priority support.