EnigmAgent

The credential vault built for the age of AI agents. Your LLM only sees placeholders. Real secrets stay encrypted on your device.

The problem

When you use an AI agent — Claude, ChatGPT, Cursor, a browser automation tool — to do something that requires credentials, you face an impossible choice:

EnigmAgent is option D. The agent only ever types {{GITHUB_TOKEN}}. The real value never appears in the conversation, in logs, or in the agent's memory.

How it works

┌─────────────────┐   types {{GITHUB_TOKEN}}   ┌────────────────────┐
│   LLM / Agent   │ ──────────────────────────▶ │     Web Form       │
│  (any provider) │                             │  (github.com/…)    │
└─────────────────┘                             └─────────┬──────────┘
                                                          │ submit event (intercepted)
                                                          ▼
                                              ┌───────────────────────┐
                                              │      EnigmAgent       │
                                              │  content.js detects   │
                                              │  {{GITHUB_TOKEN}} →   │
                                              │  asks background SW   │
                                              └───────────┬───────────┘
                                                          │
                                              ┌───────────▼───────────┐
                                              │      Vault Tab        │
                                              │  (extension origin)   │
                                              │  checks domain match  │
                                              │  decrypts → ghp_xxx   │
                                              └───────────┬───────────┘
                                                          │ real value
                                                          ▼
                                              ┌───────────────────────┐
                                              │  Form re-submitted    │
                                              │  with real credential  │
                                              └───────────────────────┘

The plaintext value exists in memory for approximately one event-loop tick. It is never written to the clipboard, never logged, and never visible to any other tab or script.

Install in 3 steps

Chrome / Edge / Brave

1. Download the latest release ZIP and unzip it.
2. Go to chrome://extensions and enable Developer mode (top-right toggle).
3. Click Load unpacked and select the extension/ folder.

Firefox

1. Go to about:debugging#/runtime/this-firefox.
2. Click Load Temporary Add-on…
3. Select extension/manifest.json (or use platforms/firefox-ext/manifest.json for the Firefox-specific build).

Note: Signed releases for Chrome Web Store and Mozilla AMO are in progress. See LAUNCH_REPORT.md for current status.

Using EnigmAgent

First-time setup

1. Click the EnigmAgent icon in the toolbar → Open vault.
2. Click Create new vault. Enter a username and a strong password (12+ characters recommended). Argon2id will take about 1 second to derive your master key — this is intentional and makes brute-forcing a stolen vault file extremely expensive.
3. Add your first secret. Type in the chat box:

   add GITHUB_TOKEN @github.com ghp_yourtoken_here
   

   The @github.com part binds this secret to that domain — it will only be resolved on github.com, nowhere else.

Using placeholders with your AI agent

Tell your agent:

When you need to authenticate on GitHub, type {{GITHUB_TOKEN}} in the token or password field and submit the form. Do not ask me for the real value.

The agent will type the placeholder literally. When the form submits, EnigmAgent intercepts, resolves, injects, and re-submits. You will see a small badge in the lower-right corner: ✓ submitted with real values.

Real use cases

With Claude (Anthropic)

Claude writes {{OPENAI_API_KEY}} in the API key field on platform.openai.com. EnigmAgent resolves it automatically. Claude never sees the sk-proj-… value.

add OPENAI_API_KEY @platform.openai.com sk-proj-yourkey

With Cursor or GitHub Copilot

Let your coding agent commit code, open PRs, or deploy to Vercel without your tokens ever appearing in the editor context or AI chat.

add VERCEL_TOKEN @vercel.com vercel_token_here
add GITHUB_PAT @github.com ghp_pathere

With GitHub Actions (browser UI)

When setting repository secrets through the GitHub UI with a browser agent:

add REPO_SECRET @github.com supersecretvalue

The agent navigates to Settings → Secrets → New, types {{REPO_SECRET}} in the value field, and submits. EnigmAgent injects the real value only on github.com.

With n8n / Zapier AI (browser-based)

When configuring webhook credentials or API keys in n8n's browser UI:

add N8N_WEBHOOK_SECRET @app.n8n.cloud yourwebhooksecret

With any form on any site

The placeholder syntax works on any form field on any domain, as long as you've bound the secret to that domain:

add NIF @agenciatributaria.gob.es 12345678A
add IBAN @banca.example.com ES9121000418450200051332

Document injection ({{DOC:filename}})

Upload a Markdown or text file as a document secret:

add DOC_system-prompt.md @claude.ai (via Upload button or drag-and-drop)

Then reference it as {{DOC:system-prompt.md}} in any text field on claude.ai. The agent can embed your full system prompt without it appearing in the chat.

Placeholder syntax reference

Name grammar: [A-Za-z0-9_:\-.@]+ — case-insensitive.

Security model

Full threat model: docs/THREAT_MODEL.md

EnigmAgent vs. 1Password / Bitwarden

Use 1Password or Bitwarden for your own logins. Use EnigmAgent for the credentials your AI agents need to act on your behalf.

Repository layout

EnigmAgent/
├── extension/              Chrome/Firefox extension (MV3) — the whole product
│   ├── manifest.json       MV3 manifest (Chrome)
│   ├── vault.html          Unlock & management UI
│   ├── vault.js            Crypto + vault logic + bridge protocol
│   ├── content.js          Form submit interceptor
│   ├── background.js       Service worker — routes resolve requests
│   ├── popup.html/js       Toolbar popup
│   ├── style.css
│   ├── icons/              16/48/128 PNG icons
│   └── lib/argon2id.js     Bundled @noble/hashes (reproducible build)
├── platforms/
│   ├── firefox-ext/        Firefox-specific manifest (MV3 + gecko settings)
│   └── store-listings/     Chrome, Firefox, Edge store assets
├── build-tool/             Reproducible build: esbuild config + icon generator
├── docs/                   ARCHITECTURE.md, THREAT_MODEL.md
├── examples/               Placeholder schemas (GitHub, Spanish Renta, etc.)
├── tests/                  Smoke test page, crypto round-trip tests
├── CHROME_STORE_LISTING.md Store submission guide
├── SECURITY.md             Threat model + responsible disclosure
└── LAUNCH_REPORT.md        Publication checklist + status

Reproducing the build

cd build-tool
npm ci
npx esbuild argon2-entry.js \
  --bundle --minify --format=iife --target=es2020 \
  --outfile=../extension/lib/argon2id.js
python make-icons.py

package.json and package-lock.json pin @noble/hashes@1.4.0. The output is byte-reproducible — verify with sha256sum extension/lib/argon2id.js.

License

MIT — see LICENSE.

Author

Francisco Angulo de Lafuente · part of the OpenCLAW / P2PCLAW ecosystem of privacy-preserving local AI tooling.