01
The API call. The database query.
Provide tokens and passwords through environment variables or standard input. Your tools keep their usual authentication methods.
agentknock -s github -- gh repo viewFor your terminal. And your agents.
Your secrets.
On your phone.
Store developer credentials on your Android phone. Give your terminal, scripts, and coding agents access when a command needs it.
Free core features. Optional paid AI review.
Waiting for iOS? Follow @agentknockdev on X for updates.
Your computer requests access
Example · check a database
agentknock -s orders-db-prod \
--reason "Confirm the production database is reachable before deploying." \
-- psql -h db.prod.example.com \
-U orders_app -d orders -c 'SELECT 1;'The password is stored on the phone. After approval, Agentknock supplies it to psql for this command.
End-to-end encrypted between your devices
Your phone decides
One phone. The computers you work on.
- Linux
- macOS · Apple Silicon
- Windows · WSL2
A home beyond the workspace
More places to work.
Fewer places to leave secrets.
A laptop. A remote shell. A fresh development environment. The work moves on, but credentials saved there can stay behind.
Keep their stored home on your phone. Pair each computer once, then let it ask for the access it needs.
Follow one requestYour own machines
Keep one place for access decisions.
Remote workspaces
Review requests wherever you are.
Familiar tools, a different home for secrets
For the work that needs your credentials.
02
The server you need to reach.
Let your phone handle SSH authentication. The computer receives a signature; the private key stays on the phone.
agentknock -s work-ssh --no-ssh-passthrough \
-- ssh -o IdentityAgent=SSH_AUTH_SOCK \
deploy@server.example03
The commit with your name on it.
Review a Git signing request on your phone and authorize the signature there. Use the same key from your paired machines.
agentknock -s work-ssh --no-ssh-passthrough \
-- git -c gpg.format=ssh commit -S -m "Ship it"Examples assume a paired computer and configured secrets. SSH needs a registered public key; Git’s signing-key setting must match the selected key or be unset. Environment values reach the command and can be copied by it. SSH authentication and Git signing keep the private key on the phone.
Access decisions
Choose what needs your attention.
Set approval behavior for each secret, with exceptions for individual computers. The same settings apply to commands you run yourself and commands run by an agent.
- Ask
- Review a request and allow or deny it on your phone.
- Allow / Deny
- Save an automatic decision for a secret and computer.
- 4 hours
- Give a client temporary access to a secret for one operation type. End the grant early when the work is done.
- AI review
- Let an optional paid cloud reviewer use your instructions to approve, deny, or ask you. Explore AI review
Manual decisions, saved approval modes, and temporary access are free.
Trust has to be inspectable
Know what stays private.
And where access begins.
The phone and client exchange encrypted messages. The CLI and Android app are open source. The protections, and their limits, are documented.
Protected storage on Android
Android Keystore protects the encryption keys for stored sensitive data, using secure hardware where available.
An encrypted route between devices
The relay carries messages without the keys to read their protected contents. AI review is a separate, optional cloud service.
Source you can examine
Inspect the app and CLI, check release attestations, and reproduce CLI builds.
Make your first request.
Connect your phone and computer, then try a harmless test value. No real credential needed.