Fidelius fixed the local version of a recurring interruption: an agent needs a credential, I enter it in a native prompt, and its process gets a temporary file without the value becoming a chat message. Then I wanted the same interaction with an agent running on another computer.
The missing piece was the distance. The prompt needs to appear on my Mac, but the file needs to exist on the machine doing the work. Holocron extends that bridge: pair the two endpoints, save the connection, and let the remote agent request what its task needs while I approve the handoff locally.
Two kinds of context, with different rules
Ordinary context and credentials shouldn’t travel through the same bucket. Holocron gives them separate paths.
For ordinary context, I explicitly share clipboard text or a selected UTF-8 file. Each action creates an immutable snapshot that a connected agent can list and read over MCP. It doesn’t watch the clipboard, and copying something else later doesn’t quietly share it. The snapshot is the unit of access, rather than whatever happens to be on my clipboard when the agent asks.
Those snapshots are private local plaintext, with expiry and revocation for future reads. Revoking one can’t erase text an agent already received. Sharing a snapshot also doesn’t automatically populate the other computer’s clipboard. An explicit clipboard-write operation has its own receipt, and a successful write means the OS accepted the text, not that somebody pasted or executed it.
A credential request ends as a file on the receiver
Secrets use a separately paired, encrypted handoff. Pairing includes a verification number the owner checks in the native Mac prompt, so neither endpoint simply accepts the relay’s claim about who’s on the other end. Once that pairing is saved, the remote agent can make a named request with a reason, and I approve and enter the values on the Mac.
The receiver gets a private temporary directory with one file per requested secret. The returned result is the path, not the values. They stay out of ordinary context snapshots and MCP responses, and the authorized program reads them directly. The receiver schedules cleanup after five minutes by default.
That’s a deliberately small contract: request, approve, deliver a file. It isn’t a remote password manager, and it doesn’t give the agent ambient access to everything on my Mac. Both endpoints still need protected OS accounts. Cleanup can be delayed by sleep or a stopped machine, and deleting a file isn’t a secure-erasure guarantee.
The Mac still has to be awake
The CLI handles pairing, service lifecycle, snapshots, and requests; a Raycast extension puts the Mac-side sharing and service controls close at hand. The context endpoint uses a Secure MCP Tunnel. The Mac needs to be awake with the relevant service running, which is an important difference from a hosted connector like Angelos.
Holocron is still an early release. Automated checks cover encrypted transfer, consumption, replay protection, and revocation, but the complete native-approval and cross-device clipboard flows still need device testing. The setup guide starts with harmless values before real credentials.