Metadata-Version: 2.5
Name: baton-auth
Version: 0.1.6
Summary: Local authentication broker for AI agents and MCP tools
Project-URL: Homepage, https://github.com/DanDekker/baton
Project-URL: Documentation, https://github.com/DanDekker/baton/blob/main/docs/guide.md
Project-URL: Issues, https://github.com/DanDekker/baton/issues
Project-URL: Source, https://github.com/DanDekker/baton
Keywords: AI agents,MCP,authentication,credential management,secrets management
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.10
Requires-Dist: argon2-cffi>=25
Requires-Dist: blake3>=1.0
Requires-Dist: cryptography>=45
Requires-Dist: httpx>=0.27
Requires-Dist: keyring>=24
Requires-Dist: mcp>=2.0
Requires-Dist: ruamel-yaml>=0.18.16
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Description-Content-Type: text/markdown

<div align="center">

<img src="https://raw.githubusercontent.com/DanDekker/baton/main/assets/baton-banner.svg" alt="baton — Pass the baton, never the secret." width="100%">

<p><a href="#try-it">Try it</a> · <a href="https://github.com/DanDekker/baton/blob/main/docs/guide.md">User guide</a> · <a href="https://github.com/DanDekker/baton/blob/main/docs/security.md">Security</a></p>

<p><a href="https://github.com/DanDekker/baton/actions/workflows/package.yml"><img src="https://github.com/DanDekker/baton/actions/workflows/package.yml/badge.svg?branch=main" alt="Package CI"></a></p>

</div>

---

**baton is a local authentication broker for AI agents and MCP tools.** It lets an agent use your GitHub, cloud, or API credentials without putting the secret value into its chat or tool output.

Save a credential once, then let an agent use it directly or through a **context** or expiring **lease**. baton runs the command or HTTP request with the credential and hides known secrets in the result.

## Try it

Requires Python 3.10+ and [uv](https://docs.astral.sh/uv/). Install [baton-auth from PyPI](https://pypi.org/project/baton-auth/):

```bash
uv tool install baton-auth

baton import                     # import existing local logins (gh, aws, npm, ...)
# or prompt privately for a single service:
baton add github

baton run -- gh api /user
baton http https://api.github.com/user
baton setup --auto               # connect installed MCP clients
```

`baton add SERVICE` prompts privately for required fields (or reads from piped stdin). Commands run in your working directory with a temporary `HOME` containing only that context's CLI settings.

`baton setup --auto` configures detected MCP clients (`cursor`, `claude-desktop`, `windsurf`, `zed`, `vscode`, `muse-code`, `hermes-agent`), or pass `--client CLIENT` (`codex`, `claude-code`, `agents-md`, ...). `baton setup` prints portable MCP config JSON. Agents with command access can use `baton run` or `baton http`.

## Hand work to another agent

Agents on different machines can connect to one broker using paired identities. Each machine keeps its private key; credentials stay at the broker. A recipient accepts a grant from its inbox, uses the permitted APIs, and can hand narrower access plus a task summary to another paired agent. Models and providers do not need their own integrations.

See [remote pairing and handoffs](docs/remote.md) for the setup. Remote access supports HTTPS APIs through CLI or MCP. Shell commands and credential administration stay local.

## Cryptography at a glance

| Name | How baton uses it |
| --- | --- |
| AES-256-GCM-SIV; ChaCha20-Poly1305 fallback | Encrypts credentials in the local vault. |
| BLAKE3 | Derives separate keys, authenticates leases and vault records, and links audit entries. |
| Argon2id | Turns a passphrase into the vault key when passphrase mode is used. |
| HMAC-SHA-256 | Signs AWS requests using Signature Version 4. |

## Learn more

- [User guide](https://github.com/DanDekker/baton/blob/main/docs/guide.md) — contexts, leases, providers, refresh, and MCP tools.
- [Security and limits](https://github.com/DanDekker/baton/blob/main/docs/security.md) — what baton protects, how it stores secrets, and where its boundary ends.

The distribution is named `baton-auth` and also provides the `baton-auth` command. The Python import is `baton_auth`.

The vault stays on the broker machine. A temporary `HOME` keeps local CLI configuration separate; it is not a full operating-system sandbox.
