keynest 0.0.1

Developer secret workbench: a pure-Python keystore with GUI and CLI for OS keyring and AWS Secrets Manager

keynest

Developer keystore that is pipx-installable and supports the OS keychain / credential manager and AWS Secrets Manager — with both a CLI and a Tkinter GUI.

keynest is a developer secret workbench. It helps a single developer stop scattering secrets across Notepad, stray .env files, shell history, and repo-adjacent config. It manages secret maps (JSON dictionaries of keys to values) in either the laptop OS secret store (via Python keyring) or AWS Secrets Manager (via boto3).

The guiding opinion: make the safe path the easy path. Instead of

export DATABASE_PASSWORD=...

prefer

keynest run my-app -- python app.py

See spec/spec.md for the full product specification.

Prior Art

aws-vault is the best prior art and is recommended over this tool for the moment. The main advantage of keynest will be that it is pure Python and ships a GUI. keynest also borrows patterns shamelessly from chamber, SOPS, KeePassXC, and the developer-docs-as-a-feature approach of Infisical / Doppler / 1Password.

Installation

pipx install keynest

Or with pip:

pip install keynest

Usage

keynest --help

Note: keynest is in early development. The CLI and GUI described in the spec are not yet implemented — the package scaffold and quality gates are in place first.

Contributing

See CONTRIBUTING.md.

License

MIT — see LICENSE.

Changelog

See CHANGELOG.md.

Current implementation

The implementation has moved beyond the early scaffold note above: both the CLI and Tkinter GUI are available, with OS-keyring and AWS Secrets Manager backends. The specification remains useful as product history, while the user documentation describes the behavior and limitations of the current code.

The preferred installation is an isolated global tool environment:

uv tool install keynest

or:

pipx install keynest

The install provides keynest and keynest-gui. Start with:

keynest health
keynest --help
keynest-gui

The recommended usage path injects a map only into a child process:

keynest run my-app/dev -- python app.py

See the documentation home, concepts and storage, dedicated CLI reference, GUI guide, AWS guide, and security model.

On Windows, keynest does not enumerate Credential Manager. It uses Python keyring to request exact entries under its own DeveloperSecretWorkbench service and keeps a separate non-secret index for listing. Windows itself has a credential-enumeration API, but keynest does not call it; this is an implementation boundary, not protection from other software running as your user. Consequently, unrelated credentials stored by other applications do not appear in keynest. The storage documentation has the full explanation.