baton is a local authentication broker for AI agents and MCP tools. It lets an agent use your GitHub, cloud, or API credentials without putting the secret value into its chat or tool output.
Save a credential once, then let an agent use it directly or through a context or expiring lease. baton runs the command or HTTP request with the credential and hides known secrets in the result.
Try it
Requires Python 3.10+ and uv. Install baton-auth from PyPI:
uv tool install baton-auth
baton import # import existing local logins (gh, aws, npm, ...)
# or prompt privately for a single service:
baton add github
baton run -- gh api /user
baton http https://api.github.com/user
baton setup --auto # connect installed MCP clients
baton add SERVICE prompts privately for required fields (or reads from piped stdin). Commands run in your working directory with a temporary HOME containing only that context's CLI settings.
baton setup --auto configures detected MCP clients (cursor, claude-desktop, windsurf, zed, vscode, muse-code, hermes-agent), or pass --client CLIENT (codex, claude-code, agents-md, ...). baton setup prints portable MCP config JSON. Agents with command access can use baton run or baton http.
Hand work to another agent
Agents on different machines can connect to one broker using paired identities. Each machine keeps its private key; credentials stay at the broker. A recipient accepts a grant from its inbox, uses the permitted APIs, and can hand narrower access plus a task summary to another paired agent. Models and providers do not need their own integrations.
See remote pairing and handoffs for the setup. Remote access supports HTTPS APIs through CLI or MCP. Shell commands and credential administration stay local.
Cryptography at a glance
| Name | How baton uses it |
|---|---|
| AES-256-GCM-SIV; ChaCha20-Poly1305 fallback | Encrypts credentials in the local vault. |
| BLAKE3 | Derives separate keys, authenticates leases and vault records, and links audit entries. |
| Argon2id | Turns a passphrase into the vault key when passphrase mode is used. |
| HMAC-SHA-256 | Signs AWS requests using Signature Version 4. |
Learn more
- User guide — contexts, leases, providers, refresh, and MCP tools.
- Security and limits — what baton protects, how it stores secrets, and where its boundary ends.
The distribution is named baton-auth and also provides the baton-auth command. The Python import is baton_auth.
The vault stays on the broker machine. A temporary HOME keeps local CLI configuration separate; it is not a full operating-system sandbox.
1 maintainer
Metadata
1 maintainer
Release files for baton-auth 0.1.7
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| baton_auth-0.1.7.tar.gz | 191.7 kB | Without provenance | Details for baton_auth-0.1.7.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| baton_auth-0.1.7-py3-none-any.whl | Python 3 | none | any | Details for baton_auth-0.1.7-py3-none-any.whl |
Total release size: 261.5 kB
Release files / baton_auth-0.1.7.tar.gz
| Download URL | baton_auth-0.1.7.tar.gz |
|---|---|
| Size | 191.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
888531918d4e40cd9a2ed4230fa65bb1f45af845b05ac3f91aefa0cbe0fb6e30
|
|
BLAKE2b-256 checksum How to use checksums |
c5f5bf5cf27f9422f4724529cd70bd4bb537c838c4c0a2dde6207583b78cef03
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.5 {"installer":{"name":"uv","version":"0.13.5","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / baton_auth-0.1.7-py3-none-any.whl
| Download URL | baton_auth-0.1.7-py3-none-any.whl |
|---|---|
| Size | 69.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0115ab44b7264423a997da9291e8ccf1c235074595229399251f515a4b5e32ef
|
|
BLAKE2b-256 checksum How to use checksums |
e9e06e3d6b917da70ae8815f1dd072c69bae8fbc9e5eb6d374004fdb3d75fa92
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.5 {"installer":{"name":"uv","version":"0.13.5","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Security for baton-auth 0.1.7
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
