Your Claude login in the Secure Enclave.
Your secrets out of the agent.
Tegata puts the credential Claude Code uses behind Touch ID, in hardware, and keeps the agent from reading the secret files on your Mac. One-time purchase. No account, no server, no telemetry.
Join the beta Read the threat modelRequires macOS 15 on Apple Silicon with Touch ID. Apple Watch approval is supported by the system policy but not yet verified by us.
The problem, in one command
security find-generic-password -s "Claude Code-credentials" -w
That prints your Claude login, refresh token included, to any process running as you. No prompt, no log. A malicious npm install, a rogue editor extension, or a prompt injection inside the agent itself can run it. Reported to the vendor in June 2026 and classified as expected behaviour, because on macOS "the user account is the boundary".
The agent breaks that boundary from the inside. It runs thousands of commands as you, installs what it needs, and reads what it is told to read. Every secret it touches is copied into a transcript on disk. On the author's Mac, a scan found 38 such copies, including a production deployment token.
What Tegata does
- Moves the login out of the Keychain and into a vault whose key lives in the Secure Enclave, bound to your current fingerprints. Nothing leaves the chip; a copied vault opens nowhere.
- Serves it back to Claude Code only through its official credential hook, after Touch ID or your Watch. No wrappers, no PATH tricks, nothing in the network path.
- Keeps the friction to one prompt per session. Unlock once; the screen lock, sleep or a user switch locks it again. You choose the policy.
- Shows you what the agent already leaked (transcripts, config backups, shell files,
.envfiles) and, with one reversible click, stops it from reading credential files at all. - Watches for drift. If something edits the Claude Code settings or the plaintext login comes back, you get a notification within seconds and a Repair button.
Built so you can check it
| Claim | How to verify on your Mac |
|---|---|
| The key never leaves the Secure Enclave | codesign -d --entitlements :- Tegata.app shows the Data Protection keychain access group; the key is created with kSecAttrTokenIDSecureEnclave. The vault format is published. |
| Biometrics only, no password fallback | The access control is biometryCurrentSet. Enrol a new fingerprint and the vault refuses to open, by design. |
| Only Tegata's own helper can ask for the credential | The agent applies a code-signing requirement per connection. Copy the helper and re-sign it: it is refused. |
| No runtime exceptions | codesign -d --entitlements :- tegatad.app lists no disable-library-validation, allow-jit or get-task-allow. |
| Nothing phones home | sudo lsof -i -a -c tegatad stays empty. The only network use is the update check you can see in the menu. |
| Everything is reversible | Uninstall from the menu restores settings.json from its backup, removes the agent and the vault, and points you to claude auth login. |
Exposure report
The report lists every secret-shaped value Tegata finds in the places the agent writes to or reads from: Claude Code transcripts and history, its config and the backups it keeps, your shell startup files and history, and the .env files under the project folders you choose. Never the value: file, line, key name, a masked preview, and what to do about it.
Then it closes the source: Claude Code permission rules that deny reading .env and secret files, and a hook that refuses credential-shaped files. Both removable from the same screen. For the secrets in your projects' own .env files, Tegata points you to varlock or 1Password; it does not try to replace them.
Honest limits
- Subscription tokens are waiting on a Claude Code change. Today Claude Code's credential hook accepts API keys; a
setup-tokensubscription token served through it is rejected by the API. The fix is small and filed with a reproduction (anthropics/claude-code#97350). Until it ships, Tegata protects API keys end to end and stores subscription tokens ready for the day it does. - Same-user malware that runs while the vault is unlocked can ask the agent for the credential during the session window. Tegata names the caller in the prompt and can refuse anything that is not Claude Code; it does not pretend to be a boundary against code you already run as yourself.
- A re-login through the browser creates a new plaintext login. Tegata notices within a minute and tells you.
- macOS only. Apple Silicon with Touch ID or a Watch.
Pricing
Buy once, keep the version you have forever. No account: the licence is a signed key that works offline. Direct download and Homebrew cask. Not on the Mac App Store, on purpose: the sandbox would forbid editing Claude Code's settings, and security tools do not belong behind an app-store review cycle.
FAQ
Why not just use the Keychain with an ACL? Claude Code rewrites its item on every token refresh and drops the ACL each time (five open reports). Tegata does not fight the item; it removes it.
What if I lose my fingerprints or reset the Secure Enclave? Nothing irreplaceable is inside. Reset the vault and sign in again. There is no recovery code because a recovery code would be a password-only path, which is exactly what Tegata refuses to have.
Does it work with Codex or OpenCode? Not yet. Neither offers a credential hook; both keep their login in a plaintext file. The Exposure report still covers their transcripts and configs.
Is the source available? The design, threat model, vault format and every feasibility test are public. Whether the code is published is undecided.