yao

Secret Management

Agents can read user-configured secrets at runtime using the tai tool CLI. Secrets are encrypted at rest (AES-256-GCM) and decrypted only when read.

Available Tools

Usage

Bash

# List available secrets
tai tool secret_list

# Read a secret
TOKEN=$(tai tool secret_read '{"name": "GITHUB_TOKEN"}' | jq -r '.value')
git clone "https://${TOKEN}@github.com/org/repo.git"

Node.js

const { execSync } = require("child_process");

function readSecret(name) {
  const raw = execSync(
    `tai tool secret_read '${JSON.stringify({ name })}'`,
    { encoding: "utf-8" }
  );
  return JSON.parse(raw).value;
}

const token = readSecret("GITHUB_TOKEN");

Python

import json
import subprocess

def read_secret(name: str) -> str:
    result = subprocess.run(
        ["tai", "tool", "secret_read", json.dumps({"name": name})],
        capture_output=True, text=True, check=True,
    )
    return json.loads(result.stdout)["value"]

token = read_secret("GITHUB_TOKEN")