Your agent can use the key. It never sees it.

Your app still has to talk to real APIs. So Phantom runs a small proxy on your own machine (127.0.0.1). When a request goes to a supported API host, the proxy adds the real key at that moment. The agent can use the key without ever seeing it. Phantom also ships an MCP server so agents can ask which secrets exist and whether they are healthy. It never returns the values.

How well does it work? We ran a scripted attack test. It tries 30 techniques, such as cat .env, printenv, reading /proc/self/environ, base64 and hex dumps, git add -f, and a README that contains a prompt injection. The test uses fake keys. With a plain .env file, 210 of 450 attacks exposed a key. After phantom init, 0 of 450 did. This is a scripted worst case, not a live AI model, so it shows where a key can appear and not how often a model would go looking.

The README lists what Phantom does not cover. A key file you never put in .env stays readable. Someone with access to your user account and your keychain is outside the documented boundary. We would rather you read those limits now than find them later. Phantom Secrets is MIT licensed, written in Rust, and the current GitHub release is v0.7.9.

Agents inherit whatever accounts happen to be logged in on your computer. Locus pins an agent to one identity, so acting as the wrong client becomes impossible.