Run coding agents with Keycard

Agentic coding tools like Claude Code and Cursor need access to production databases, third-party APIs, and internal services to be useful. But broad access creates risk: one misunderstood prompt can lead to a destructive query or a leaked credential.

keycard run solves this by wrapping your coding agent in a secure session with automated credential management and enforced tool policies.

1. Install the CLI:

   brew install keycardai/tap/keycard

2. Install the plugin:

   claude plugin marketplace add keycardai/plugins
   claude plugin install keycard-cli@keycardai

3. Sign in to your Keycard account:

   keycard auth signin --zone <zone-id>

4. Add a keycard.toml with a Keycard managed resource credential:

   [zone]
   id = "your-zone-id"
   
   [[credentials.default]]
   env_var = "GH_TOKEN"
   resource = "https://api.github.com"

5. Run your agent in a secure session:

   keycard run -- claude

Keycard handles:

• Just-in-time credentials: Each time the agent uses a tool or calls an MCP server, Keycard issues a fresh, scoped credential. No secrets stored on disk or in your shell history.
• Agent-native policy enforcement: Every tool use is evaluated against your organization’s policy before it executes. Dangerous operations are blocked automatically.
• Centralized visibility: All agent activity is logged to your Keycard audit trail. Identify rogue agents, review usage patterns, and track credential access across your team.

Inside a keycard run session, credentials are provisioned as your agent needs them. When an agent requests access to a resource (a database, an API, an MCP server), Keycard exchanges a scoped token just-in-time.

This means agents only ever hold short-lived, narrowly-scoped credentials. Revoking centrally stops the next credential from being issued, and the one the agent already holds remains valid until it expires, so access ends within the lifetime of the current credential rather than the instant you revoke. Revoke a Grant covers the full behavior.

Policies control what your agents can and can’t do. When an agent attempts a tool use, Keycard evaluates the action against your policy and either permits or denies it.

For example, you can allow SELECT queries against a production database but deny DELETE or DROP operations, so a misunderstood instruction doesn’t become an incident.

Policies are managed centrally and enforced on all development devices. Adjust a policy once and it takes effect everywhere.