Locus: how to stop an agent from using the wrong account

It does this by removing the ambient credentials. When you run a command through locus exec, Locus clears variables such as GH_TOKEN, AWS_PROFILE and SUPABASE_* from that command's environment. It then adds only the credentials of the pinned client. Agents can ask to be pinned. They cannot pin themselves, and they cannot override a locked project or team.

A folder can also refuse the wrong client. In a client's directory you can list which identities are allowed and require a pin, so a mix-up gets blocked instead of discovered later.

Locus works with Phantom Secrets. Phantom answers "can this secret enter the model?" Locus answers "as whom, against which account, right now?" Credentials in a Locus binding can be Phantom references, so the values never sit in a config file.

Locus is written in Rust, MIT licensed, and the current release is 0.5.1. It installs with Homebrew or from npm as locus-cli.

Agents can read your .env file like any other file. Phantom Secrets swaps real keys for placeholders and adds the real one only when a request leaves.