AgentKeychain v0.4.0 — AI-native onboarding

AgentKeychain v0.4.0 — AI-native onboarding

AgentKeychain can now be installed and configured by giving an AI agent only the repository URL and asking it to follow the root AGENTS.md.

Highlights

• Added a repository-root AI installation protocol and bilingual AI installation guides.
• Added a public Hermes skill that routes credential tasks through AgentKeychain by default.
• Added agentkeychain status [--json], a safe readiness probe that never creates or mutates a vault.
• Replaced raw MCP KEK input with the standard password chain: CI-only AKC_PASSWORD, then the OS keychain.
• Detects stale OS-keychain passwords and replaces them only after the existing vault password verifies.
• Closes SQLite handles after every MCP tool call and clears temporary KEK/hash buffers.
• Documents the MCP plaintext trust boundary for akc_get.
• Pins AI installation artifacts and preserves existing compatible CLI, Skill, MCP, and vault state.

Install with an AI agent

Send your AI agent:

Install and configure https://github.com/linsipeng/agentkeychain as your default credential manager. Follow AGENTS.md in the repository.

Manual installation

curl -fsSL https://raw.githubusercontent.com/linsipeng/agentkeychain/v0.4.0/install.sh | sh -s -- --version v0.4.0

Verification

• 65 tests passed on macOS and Linux CI paths.
• Four release binaries built successfully: macOS arm64/x64 and Linux arm64/x64.
• All release assets are covered by SHA256SUMS.