# Locksmith

> A Maven Extension to retrieve secrets from the MacOS Keychain, or a Unix Socket - exabrial/locksmith

- **Website:** https://github.com/exabrial/locksmith
- **Pricing:** unknown
- **Categories:** Developer Tools, Design
- **Tags:** developer-tools, design, ai-agents
- **Platforms:** macOS, Linux
- **Last verified:** 2026-09-10
- **Canonical page:** https://linkrena.com/tools/locksmith

## About

Give Maven the ability to use the macOS Keychain, or defer to a Unix Socket, giving you the ability to defer to a custom password manager.

Hide your plaintext secrets/passwords in ~/.m2/settings.xml . For those in regulated industries, this makes ~/.m2/settings.xml FIPS-140 compliant.

In general, storing your passwords or any gplat tokens in ~/.m2/settings.xml is a bad idea in the age of user-hostile software and unfettered outbound internet access... After all, we want to avoid having secrets getting sucked into a "misconfigured" LLM or a piece of software with an RCE.

So, for those of us with short attention spans, Locksmith allows your settings.xml to look like this:

If the macOS Keychain is unavailable, as it is happens on Linux, it defers to a Unix Socket. This socket could be anything, like a custom password manager, but a common use case is to support remote builds over ssh, where the socket is forwarded and a local script answers with items from the macOS Keychain.

If your Maven Build requires a lower JDK vesion that Java 25, set up the toolchains plugin for your project, so the Maven JDK and your project JDK are different.

Maven's DefaultSecDispatcher basically existence-checks settings-security.xml before it dispatches to any custom PasswordDecryptor s. The file must exist.

## Related tools

- [Reachpad CLI](https://linkrena.com/tools/reachpad-cli): The reachpad CLI: workspaces where Claude, Codex and other coding agents build full-stack apps and share them by link, from your terminal.
- [Agentconnect](https://linkrena.com/tools/agentconnect): The open-source, multi-agent alternative to Claude Tag.
- [Termux Dev](https://linkrena.com/tools/termux-dev): ⚡ Ultra-fast terminal AI coding agent & vibe-coding assistant built for Android (Termux), Windows, macOS & Linux.
- [RealDiff](https://linkrena.com/tools/realdiff): Runtime behavior diffs for pull requests.
- [Keydris](https://linkrena.com/tools/keydris): Keydris lets developers and builders control what AI agents can do before they do it.
- [WinZST](https://linkrena.com/tools/winzst): Windows archive utility with ZST support.