q-ring
OS keychain secrets for AI coding agents, over MCP.

Stop pasting API keys into plain-text .env files or wrestling with clunky secret managers. q-ring securely anchors your credentials to your OS's native vault (macOS Keychain, Linux Secret Service, Windows Credential Vault) and supercharges them with mechanics from quantum physics.
π View the Official Documentation for a complete CLI reference, MCP prompt cookbooks, and architecture details.
Why q-ring?
- Superposition: Store one key with multiple states (dev/staging/prod) that collapse based on context.
- Entanglement: Link keys across projects so rotating one automatically updates them all.
- Tunneling: Create ephemeral, in-memory secrets that self-destruct after a set time or read count.
- Teleportation: Securely pack and share AES-256-GCM encrypted secret bundles.
- Seamless AI Integration: 44 built-in MCP tools for native use in Cursor, Kiro, and Claude Code.
π Installation
q-ring is designed to be installed globally so it's available anywhere in your terminal. Pick your favorite package manager:
# pnpm (recommended)
pnpm add -g @i4ctime/q-ring
# npm
npm install -g @i4ctime/q-ring
# yarn
yarn global add @i4ctime/q-ring
# Homebrew (macOS / Linux)
brew install i4ctime/tap/qring
Docker (MCP server)
The repo ships a Dockerfile that builds the MCP server and exposes it through mcp-proxy β useful for hosted MCP deployments (e.g. Glama) or keeping the server off the host entirely:
git clone https://github.com/I4cTime/q-ring.git
cd q-ring
docker build -t qring-mcp .
docker run --rm -p 8080:8080 qring-mcp
Note: inside a container there is no OS keychain (GNOME Keyring / macOS Keychain), so this path is for the MCP protocol surface, ephemeral use, and CI experiments β not for durable local secret storage. For day-to-day use install the CLI natively via one of the package managers above.
β‘ Quick Start
# 1οΈβ£ Store a secret (prompts securely if value is omitted)
qring set OPENAI_API_KEY sk-...
# 2οΈβ£ Retrieve it anytime
qring get OPENAI_API_KEY
# 3οΈβ£ List all keys (values are never shown)
qring list
# 4οΈβ£ Generate a cryptographic secret and save it
qring generate --format api-key --prefix "sk-" --save MY_KEY
# 5οΈβ£ Run a full health scan
qring health
# Something not working? Diagnose the install (keyring, audit, MCP wiring)
qring doctor
# Tab completion for your shell
qring completion zsh > ~/.zsh/completions/_qring # also: bash, fish
Quantum Features
Superposition β One Key, Multiple Environments
A single secret can hold different values for dev, staging, and prod simultaneously. The correct value resolves based on your current context.
# Set environment-specific values
qring set API_KEY "sk-dev-123" --env dev
qring set API_KEY "sk-stg-456" --env staging
qring set API_KEY "sk-prod-789" --env prod
# Value resolves based on context
QRING_ENV=prod qring get API_KEY # β sk-prod-789
QRING_ENV=dev qring get API_KEY # β sk-dev-123
# Inspect the quantum state
qring inspect API_KEY
Wavefunction Collapse β Smart Environment Detection
q-ring auto-detects your environment without explicit flags. Resolution order:
--env flag
QRING_ENV environment variable
NODE_ENV environment variable
- Git branch heuristics (
main/master β prod, develop β dev)
.q-ring.json project config
- Default environment from the secret
# See what environment q-ring detects
qring env
# Project config (.q-ring.json)
echo '{"env": "staging", "branchMap": {"release/*": "staging"}}' > .q-ring.json
Quantum Decay β Secrets with TTL
Secrets can have a time-to-live. Expired secrets are blocked from reads. Stale secrets (75%+ lifetime) trigger warnings.
# Set a secret that expires in 1 hour
qring set SESSION_TOKEN "tok-..." --ttl 3600
# Set with explicit expiry
qring set CERT_KEY "..." --expires "2026-06-01T00:00:00Z"
# Health check shows decay status
qring health
Observer Effect β Audit Everything
Every secret read, write, and delete is logged with a tamper-evident hash chain. Access patterns are tracked for anomaly detection.
# View audit log
qring audit
qring audit --key OPENAI_KEY --limit 50
# Detect anomalies (burst access, unusual hours, chain tampering)
qring audit --anomalies
# Verify audit chain integrity
qring audit:verify
# Export audit log
qring audit:export --format json --since 2026-03-01
qring audit:export --format csv --output audit-report.csv
Quantum Noise β Secret Generation
Generate cryptographically strong secrets in common formats.
qring generate # API key (default)
qring generate --format password -l 32 # Strong password
qring generate --format uuid # UUID v4
qring generate --format token # Base64url token
qring generate --format hex -l 64 # 64-byte hex
qring generate --format api-key --prefix "sk-live-" --save STRIPE_KEY
Entanglement β Linked Secrets
Link secrets across projects. When you rotate one, all entangled copies update automatically.
# Entangle two secrets
qring entangle API_KEY API_KEY_BACKUP
# Now updating API_KEY also updates API_KEY_BACKUP
qring set API_KEY "new-value"
# Unlink entangled secrets
qring disentangle API_KEY API_KEY_BACKUP
Tunneling β Ephemeral Secrets
Create secrets that exist only in memory. They never touch disk. Optional TTL and max-read self-destruction.
# Create an ephemeral secret (returns tunnel ID)
qring tunnel create "temporary-token-xyz" --ttl 300 --max-reads 1
# Read it (self-destructs after this read)
qring tunnel read tun_abc123
# List active tunnels
qring tunnel list
Teleportation β Encrypted Sharing
Pack secrets into AES-256-GCM encrypted bundles for secure transfer between machines. Keys are derived with PBKDF2-HMAC-SHA512 (210 000 iterations) from your passphrase; each bundle records its iteration count, so bundles produced by older versions still unpack.
# Pack secrets (prompts for passphrase)
qring teleport pack --keys "API_KEY,DB_PASS" > bundle.txt
# On another machine: unpack (prompts for passphrase)
cat bundle.txt | qring teleport unpack
# Preview without importing
qring teleport unpack <bundle> --dry-run
Import β Bulk Secret Ingestion
Import secrets from .env files directly into q-ring. Supports standard dotenv syntax including comments, quoted values, and escape sequences. The CLI accepts either a file path or raw content; the import_dotenv MCP tool only accepts raw content (it never reads files from disk) so an agent can't coerce it into reading arbitrary local files.
# Import all secrets from a .env file
qring import .env
# Import to project scope, skipping existing keys
qring import .env --project --skip-existing
# Preview what would be imported
qring import .env --dry-run
Selective Export
Export only the secrets you need using key names or tag filters.
# Export specific keys
qring export --keys "API_KEY,DB_PASS,REDIS_URL"
# Export by tag
qring export --tags "backend"
# Combine with format
qring export --keys "API_KEY,DB_PASS" --format json
Secret Search and Filtering
Filter qring list output by tag, expiry state, or key pattern.
# Filter by tag
qring list --tag backend
# Show only expired secrets
qring list --expired
# Show only stale secrets (75%+ decay)
qring list --stale
# Glob pattern on key name
qring list --filter "API_*"