An agent gets most of the way through a task and then needs an API key. Now I’m opening a dashboard, finding the right credential, and figuring out how to get it back to the process without pasting it into the conversation. When the agent refuses a plaintext key and asks me to set an environment variable instead, the fiddly part lands straight back with me.
Fidelius is the small local bridge I wanted instead. The agent runs one blocking command with a reason and the names of the secrets it needs. A native prompt opens, I enter the values, and the command returns a private temporary directory path. The program that needs the secret reads its file directly. Fidelius doesn’t print the value into the agent’s tool output.
The useful result is a path
There isn’t a secret-management service to adopt or a new API for the consuming program to learn. Each request gets its own temporary directory with one file per named secret. A shell can feed that file to an authorized command through stdin, which makes the handoff work with existing tools instead of asking every integration to understand Fidelius.
Keeping the files around briefly is intentional. If the command fails for an unrelated reason, the agent can retry it without asking me to open the same prompt again. The default cleanup window is five minutes, and an independent cleanup process handles expiry. Separate requests get separate directories, so several agents can ask without sharing one mutable scratch file.
A native prompt, a deliberately narrow boundary
The core is Go. On macOS the prompt uses AppKit through Swift; desktop Linux uses Zenity or KDialog, and Windows uses Windows Forms. The released tool supports macOS 13+, Linux on amd64 and arm64, and Windows on amd64.
The files have user-private permissions: a 0700 directory and 0600 files on macOS and Linux, and an invoking-user-only ACL on Windows. That keeps the scope clear. This is a temporary handoff protected by the OS account boundary, not an encrypted vault or a sandbox around the agent. A process running as that user can still read the file, and the consuming command must avoid echoing or logging it. Expiry removes the temporary files; it doesn’t claw back a copy someone already made.
Fidelius solves the local case. Holocron came next because the agent asking for a credential isn’t always running on the same computer as the person who can provide it.