2Secret 1.10.0: AI tools use your vault, you stay in charge

Version 1.10.0 of 2Secret is out for Mac, Windows and Linux, the command line, the web vault, the browser extension and the sync server. New in this version: Agent Access. AI tools such as Claude Code, Claude Desktop, Cursor and Codex can use the items in your vault, and you decide about every secret.

What it does

AI tools increasingly do things for you: run a deployment, test a website, set up an account. Sooner or later they need a password or an API key. Until now the choice was to paste the secret into the conversation, or to say no. With Agent Access the tool asks 2Secret, and 2Secret asks you.

It works through the Model Context Protocol (MCP), which these tools speak. You add 2Secret to your tool with the command 2secret mcp, turn on AI agents under Settings → Desktop app, and the first time the tool connects 2Secret asks whether it may, and shows the program behind it. From then on the tool can search the titles, user names, websites and tags of your items. It never gets a password, a one-time code or notes that way.

Every secret needs your yes

When the tool wants a value (a password, an API key, the current one-time code) or wants to save or change an item, 2Secret shows which tool asks, for which item and fields, and the reason the tool gives. You allow it once, for these items until 2Secret locks, or for these items for 8 hours. Optionally 2Secret asks for Touch ID, Face ID or Windows Hello first. Deny is the default: Enter and Escape refuse.

Programs get secrets, the model does not

Often it is not the AI that needs the secret but a program it runs: a deployment script, a database client. The tool can run such a program through 2Secret with 2s:// references in its environment. 2Secret asks you once for all of them, the program gets the real values, and in the output the tool reads back the values are replaced by their references. The same goes for new logins: the tool can ask 2Secret to generate the password, and never sees it.

Known, logged, revocable

Every tool has its own key, so Claude Code and Cursor are two different agents with their own permissions. Under AI agents you see which tools are connected, what they may do without asking, and every request with your answer; you revoke a tool with one click. All of it is encrypted with your account key, and when 2Secret locks everything is forgotten from memory and open questions are refused.

What is still to come

This version works with tools on your own computer, and the desktop app has to be running. Two things are planned: filling a login in your own browser for AI browser agents, so the model never sees the password at all, and a way for tools that run elsewhere to ask you through your sync server, end to end encrypted. The documentation describes what this version does and does not protect.

Updating

• Mac, Windows and Linux: apps with automatic updates turned on offer 1.10.0 by themselves. Otherwise get it from the download page. Agent Access needs the command line tool too, from the same page.
• iPhone and iPad: this version brings no new features to the phone app; a TestFlight build follows as usual.
• Your own server: 1.10.0 changes nothing on the server, so there is nothing to do.

Everything that changed is in the changelog; the setup per tool is in the Agent Access documentation.