jitpass/jit

jitpass - just-in-time credentials

Just-in-time credentials for your dev machine.

Documentation · Quickstart · Supported tools · Command reference · Security

Status: macOS-only (Apple Silicon), and still in development.

What jit is (30 seconds)

Your secrets live in plaintext all over your machine: .env files, ~/.aws/credentials, ~/.zshrc exports, .npmrc tokens, MCP configs. Anything running as you can read them. A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions.

jit moves each secret into a local encrypted vault gated by Touch ID, and rewrites the files so your tools keep working. On disk there's now a decoy. The real value only appears, in memory, for the specific process that asked for it, after a biometric prompt. The result: you unlock once, jit asks before handing a credential to a tool (or an agent), and there's a decoy on disk the rest of the time.

| launched by Code | launched by claude | | :---: | :---: | | <img width="1917" height="946" alt="image" src="https://github.com/user-attachments/assets/e797790b-aadc-4616-8165-c6ca816ff80a" / | <img width="1917" height="946" alt="image" src="https://github.com/user-attachments/assets/1487988e-b21a-4fe5-a196-94268dd284b6" / |

Install

Apple Silicon prebuilt binary, no Go required:

curl -sLO https://github.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz
tar -xzf jitpass_darwin_arm64.tar.gz jit
sudo mv jit /usr/local/bin/

Upgrading:

jit upgrade   # verified self-update: checksum-checked swap, restarts the service. Your vault is untouched.

Recommended: turn on shell completion, so jit <TAB completes subcommands, flags, vault paths, and wrappable tool names:

echo 'source <(jit completion zsh)' >> ~/.zshrc && exec zsh

How you actually use it

jit scan                            # read-only. shows every plaintext secret. writes nothing.
jit vault init                      # make the vault (master key in your login keychain)
jit migrate --dry-run               # preview the whole machine-wide fix plan
jit migrate                         # apply it: shows plan, asks [y/N], one Touch ID
jit migrate ~/code/myapp            # or fix just one project
jit run -- npm run dev              # run your tool; real values injected into that process only

jit scan with no path sweeps your whole home directory, so give it a moment on a large one. To go straight at one place, point it at a path: jit scan ~/.aws.