Bossanova: let Codex use an API key without putting its value in the conversation

[cj-tinygem]

Bossanova is a proprietary Windows/macOS local encrypted vault with an optional MCP bridge for Codex CLI. I am posting on behalf of Tinygem, its publisher.

Bossanova 0.1.54 interface preview, rendered from the current GUI code with synthetic data. This preview does not show the installed app, a real vault, or an MCP operation.

Watch the 26-second GUI walkthrough: finding a stored API token, enabling AI access and leaving “Not a secret” off. It uses synthetic demonstration data and does not show a live authenticated API request.

For a first test with the permanent Free tier:

1. Install the desktop app, sign in, and unlock the vault. Free includes 10 fields on one active vault device.
2. In Settings → AI, select “Find AI on this computer” and connect the Codex row with its switch. Windows and WSL registrations are separate; choose the row for the environment where you run Codex.
3. Add one disposable, non-production API token as a text data item. Give it a non-secret label, turn on its AI-access star, and leave “Not a secret” off.
4. Start a new Codex conversation, check that the Bossanova tools are listed, and ask for a task such as “Use the stored service token to check my account status. Do not print the token.” When the approval card appears in Bossanova, review the data and destination before allowing the request.

The MCP response returns the operation result rather than the private token value. For compatible HTTPS CLIs, a proxy carrier lets the child process use a placeholder token while Bossanova substitutes the real value only at the approved host. Connection permission, item access, and destination approval are separate controls. A program execution also requires approval for its executable and working directory.

The boundary matters: an approved destination or a program given an environment/file carrier receives the value it needs. Bossanova does not isolate other processes, prevent every possible exfiltration path, or make an untrusted executable safe. Explicit sharing of a non-secret value with the assistant is a separate user choice.

Worked read: Paddle MRR

Publisher-run check on 1 November 2026: the Windows app, connected to Codex CLI in WSL, sent an authenticated Paddle Live metrics request through the existing approved connection and destination. The response was HTTP 200. The API key was absent from the MCP tool inputs and returned content. Private account metrics are omitted here.

To try this with your own account, store a Paddle Live API key with metrics.read permission in Bossanova and enable AI access for that item. In Codex, use a prompt such as:

Use the Paddle Live API key stored in Bossanova to send:
GET https://api.paddle.com/metrics/monthly-recurring-revenue?from=2026-10-31&to=2026-11-02
Authenticate with a Bearer header. Return only data.currency_code,
data.timeseries, and data.updated_at. Do not print or save the key.
Stop if approval is denied.

Choose your intended UTC date range. Paddle returns daily data and a refresh timestamp. Review a new destination's approval card when existing permission does not cover it. Bossanova's send approval binds the HTTPS origin; API methods and paths still depend on the key's permissions. Paddle's endpoint and permission documentation.

Vault features and plans

You can also use the vault without MCP for text/images, .env import, search, encrypted backup/restore, and direct LAN transfer between your own devices. There is no shared team vault or automatic cloud synchronization. Account sign-in and periodic online license checks are required; vault contents and decryption keys are not uploaded to the account service.

Plus is $2.99/month for 100 fields and two devices; Pro is $5.99/month for unlimited fields and five devices. Annual options are listed on the pricing page. There is no need to buy a plan to test a small workflow.

• Product and public demo videos: https://bsnv.app/
• Windows/macOS downloads: https://bsnv.app/download
• Connection steps and security boundaries: https://bsnv.app/docs/manual
• Worked example using GitHub's read-only rate-limit endpoint: https://bossanovanotes.wordpress.com/2026/11/01/let-claude-or-codex-call-an-api-without-pasting-a-token-into-chat/
• Pricing: https://bsnv.app/pricing

If you try it with Codex CLI, which step interrupts your normal API workflow: connecting the host, choosing the item, approving the destination, or reading the result? Please share feedback here without including credentials or private logs.

[antropos17]

For the disposable-token test, I'd include an approved endpoint redirecting to another origin. The token should not follow without a fresh destination decision. I maintain AEGIS; our selected HTTPS gateway documents a narrower pinned connection contract. I haven't tested Bossanova, so this is a suggested acceptance case, not a finding.

Drafted with AI assistance.