JitPass for Mac

You have API keys and tokens in plaintext on your Mac.
Use JitPass to protect them.

Download for Mac · brew install jitpass/tap/jitpass · How it works · jitpass.com

_{Free for personal and internal company use · Source-available · No account · No telemetry · Nothing leaves your Mac · Secure Enclave ready}

_{What's the number on your Mac? The scan only reads, and changes nothing until you say so.}

Get started   Set up · Install
The app   The menu bar · The windows
More   The full story · How it compares · For contributors

JitPass is the menu bar app for jit: it moves the API keys and tokens on your Mac into a vault that opens with Touch ID, and asks you before any program uses one.

Set up in about two minutes

1. Find Setup scans your Mac and changes nothing. It recognises 100+ token formats, plus private keys and database URLs.

2. Protect One click moves each secret into the vault and leaves a decoy. Every file is backed up first.

3. Approve A program that wants a real key is named in the Touch ID dialog, with what launched it. Touch to allow, or cancel.

Download for Mac · brew install jitpass/tap/jitpass
_{Free · No account · Every change can be undone}

Everything in one click of the menu bar

• The ring tells you. Green unlocked, red locked, amber not set up yet.
• One click to see everything. Your vault, your AI agents, your tools, grants, AI jobs, today's decoy reads and what is left to do.
• Scans run on a schedule. A new finding tells you once, and waits in Findings.
• A vault key that never leaves your Mac. Only the jit inside JitPass.app can keep the vault key in the Secure Enclave, the chip that holds keys and never lets them out. Opt-in from Settings › Protection, and reversible.
• The app never sees a secret. It is a window onto the jit service. Every button sends a request the jit CLI can also send, so the CLI keeps working without the app, headless and in CI.

The windows

Findings. What is still in the open, and the one fix for each.	AI Agents. Each agent on your Mac: keys in its files, what it can reach, what it did.
AI Jobs. Let Claude or Cursor run a script you approved. They see the output, never the key.	Grants. Let one agent work while you are away, and revoke it with one click.
Tools. Every CLI jit protects, and proof that it is working.	Decoys. Who opened a protected file, and what they got.

Install

brew install jitpass/tap/jitpass

One cask installs JitPass into /Applications with the jit command line inside it, linked onto PATH, plus shell completions.

Without Homebrew, download the app, drag it into Applications and open it. It offers to link jit onto your PATH and checks for a newer release once a day; both live under Settings › General. A copy opened straight from Downloads runs from a temporary location, so the app asks to be moved first.

Upgrading from the old jit-app cask? Run brew uninstall --cask jit-app first.

The full story (what gets protected, AI agents, how it works and what it does not do) is in the jit README.

---

For contributors

Build

Requires macOS 14+, Swift 5.10+ and full Xcode: swift test needs XCTest, which the command line tools alone do not ship. scripts/gate.sh points DEVELOPER_DIR at /Applications/Xcode.app for you. It also runs swiftformat and swiftlint, so install both (brew install swiftformat swiftlint).

scripts/gate.sh            # format, lint, build, test: the same steps CI runs
scripts/gate.sh --run      # and bundle and relaunch the dev build
swift run JitPass          # menu bar item appears; no Dock icon
scripts/bundle.sh release  # dist/JitPass.app, unsigned

Build through scripts/gate.sh rather than chaining the steps by hand: it stops at the first step that fails.

Release

The version is the bundled jit's: tag v<jit.version> (for example v2.3.0), or v<jit.version>.N for a release that changes only the app (v2.3.0.1). The workflow refuses a tag that disagrees with jit.version. The bundled jit is fetched and verified at build time.

Push the tag. The workflow builds, Developer ID signs, notarizes and staples the bundle, publishes a draft, verifies the published zip the way a user's Mac will, undrafts, and renders the cask. The same steps run locally:

VERSION=2.3.0 scripts/bundle.sh release   # fetches and verifies the jit in jit.version first
scripts/sign.sh                           # Developer ID identity for team CZC6BH93GJ
NOTARY_KEY_FILE=... NOTARY_KEY_ID=... NOTARY_ISSUER_ID=... scripts/notarize.sh
scripts/verify.sh dist/JitPass-2.3.0-arm64.zip dist/checksums.txt

Layout

Sources/JitAgentClient   socket client and protocol models, no AppKit, tested
Sources/JitPassApp       AppKit menu bar app, a view over JitAgentClient
Tests/JitAgentClientTests
Resources/               Info.plist, Agent-Info.plist (jit's helper bundle), entitlements
scripts/                 bundle, sign, notarize, verify, cask
docs/design/             design docs and mockup sources

License

PolyForm Perimeter License 1.0.0, the same source-available license as jit: free for personal and internal use; it does not permit building a competing product on it. Contributions are made under the CLA; see CONTRIBUTING.md.