KEYFIT
Open source and free to use

The Right Accounts.For Every Repo.

Keyfit verifies each project’s AWS, Linear, GitHub, Claude, Codex and Vercel accounts before your agent runs.

Install Keyfit 
claudekeyfit: claude not started, lumen-web needs attention  ✘ aws       lumen-prod → …8023   SSO session expired    → aws sso login --sso-session lumen  (bypass once: KEYFIT_DISABLE=1 claude …)aws sso login --sso-session lumenSuccessfully logged into Start URL: https://lumen.awsapps.com/startkeyfit statuslumen-web  ✔ aws       lumen-prod → …8023   SSO token valid 7h 58m · account confirmed  ✔ linear    lumen   workspace confirmed  ✔ github    lumen-ci   login confirmed  ✔ claude    Lumen   Lumen (team) confirmed  ✔ vercel    lumen-ci → lumen   login and team confirmedclaude

Works with the tools you already use

  • AWS
  • Linear
  • GitHub
  • Claude Code
  • Codex
  • Vercel

Verified, not assumed

Checked with each service.

Keyfit asks AWS, Linear, GitHub, Claude and Vercel who you are signed in as. Expired sign-ins are caught before anything runs.

keyfit statusharbor-api  ✔ aws       harbor → …4417   IAM key via Granted · account confirmed  ✔ linear    harbor   workspace confirmed  ✔ github    harbor-dev   login confirmed  ✔ codex     ChatGPT pro   subscription login, no API key

Wrong account refused

Another client’s profile? Refused.

Inside a project, an AWS profile or Vercel team that belongs to another client is blocked, and you see why.

aws --profile harbor s3 lskeyfit: this folder belongs to lumen-web (AWS profile lumen-prod); refusing --profile harbor.  Bypass once: KEYFIT_DISABLE=1 aws …vercel deploy --scope harborkeyfit: this folder belongs to lumen-web (Vercel team lumen); refusing --scope harbor.

Project-scoped MCP

Each project sees its own servers.

Agents only get the Linear workspace of the repo they are in. MCP servers you claim for one client stay out of every other session.

linear_lumen:  connected (59 tools)linear_harbor: disabled (0 tools)linear_atlas:  disabled (0 tools)harbor_cloud:  disabled (0 tools)buffer:        connected (12 tools)

No new habits

Keep typing claude.

Keyfit knows the project from the folder, including git worktrees and Superset workspaces. Folders you haven’t registered work exactly as before.

cd ~/code/harbor-apiclaude  ✻ Welcome to Claude Code  keyfit · harbor-api · aws harbor → …4417 · linear harbor · github harbor-dev

Private by design

Runs on your Mac. Talks only to the services it checks.

  • No account, no server, no telemetry

    A small open-source command-line tool with no dependencies.

  • Keys stay secret

    Never printed or logged. Keys you add are stored in the macOS Keychain.

  • Each key goes only where it belongs

    The Linear key goes to Linear, the GitHub token to GitHub. Nothing else leaves your Mac.

  • Your repositories stay untouched

    Nothing is written into your code or into another tool’s login.

Everything it reads, stores and sends

Set it up once. Then forget about it.

macOS, Python 3.11 or newer, zsh or bash.

Install

Available 25 October, with Homebrew and pipx.

Turn it on

keyfit setup --rc
keyfit init

Open a new terminal after setup. init offers the accounts it finds on your Mac.

Questions

Does it slow my tools down?

Barely. Local checks run on every launch, and online checks are reused for 30 minutes, so most launches add a fraction of a second.

What happens in folders I haven’t registered?

Nothing. The tools run exactly as they did before Keyfit.

I already use direnv. Do I start over?

No. keyfit init imports the AWS profile and Linear key lines from your .envrc. It reads the file as text and never runs it.

Does Keyfit see my code or prompts?

No. It decides which accounts a tool starts with, then hands over to the real tool.

Linux or Windows?

Not yet. Keys live in the macOS Keychain, so the first version is macOS only. Linux is planned.

How do I turn it off?

KEYFIT_DISABLE=1 claude skips Keyfit once. keyfit setup --remove takes it out of your shell; your projects stay registered.