hezebang/keybearer

Keybearer is a Rust command-line tool that solves a specific problem: you want to use AI coding assistants like Claude Code, Codex, or OpenCode on a remote server, but you do not want to store your API keys on that server where other users or a compromised root account could read them. The README is written primarily in Chinese. The way it works is that your API keys stay on your local machine in a configuration file. When you SSH into a remote server, Keybearer uses a feature called SSH agent forwarding to create a secure tunnel back to your local machine. When an AI tool on the remote server tries to read its config file and pick up an API key, Keybearer intercepts that file-read operation at the operating system level using a Linux security feature called seccomp. Instead of letting the tool read a real file from disk, Keybearer injects the API key into a temporary in-memory location that disappears the moment the session ends. The key is never written to the remote server's disk, never appears in shell history, and never sits in a remote config file. The project supports three AI tools: Codex, OpenCode, and Claude Code. You can set up different API key profiles for different servers, so your work cluster uses one provider and your personal server uses another, all controlled from the single config file on your local machine. Changing a key locally takes effect on all remote connections immediately without touching any remote files. Setup requires building the Rust binary with cargo, copying it to the remote server, writing a YAML config file on your local machine, and starting the local agent process before connecting via SSH. The README includes a comparison table showing how this approach differs from simply putting a key in a remote config file or using a proxy that forwards requests, noting that the key in this approach has no persistent form on the remote side at all. The project is MIT-licensed and credits an earlier tool called CC-Switch for some of its configuration design ideas.