/vault

name: vault
description: Use when a task needs an API key, token, or login the user saved in CCC Settings > Vault. Run commands with the secret injected and redacted instead of reading the value.
allowed-tools: Bash

CCC's Vault holds the user's saved secrets (API keys, tokens, logins) in the OS keychain. The `ccc vault` CLI reads it locally; no server is needed.

1. Find the entry. This prints names, kinds, services and env vars, never values: `ccc vault list --json` 2. Run your command with the secret in its environment. The value is redacted from stdout and stderr, so it never reaches the transcript: `ccc vault exec --env STRIPE_API_KEY=stripe-live -- ./deploy.sh` `ccc vault exec --env stripe-live -- ./deploy.sh` (uses the entry's stored env var) 3. To check an entry has a value without reading it: `ccc vault get <name>` (exit 0 = saved).

Rules:

• Never use `get --reveal`, and never `echo`, log, commit, or write a secret to a file.
• Do not pipe secret output out of the `exec`. Do any piping inside the wrapped command.
• If the entry is missing, do not ask for the value in chat. Run

`ccc secret request NAME --reason "..."` to show the user a masked prompt in the dashboard.

Details: `docs/byok-and-vault.md`.