Secretive

Secretive manages SSH keys and provides an SSH agent for supported Mac workflows. Secure Enclave keys remain non-exportable, while public keys can be registered with SSH servers or Git hosting services. Supported smart cards provide an alternative for Macs without a Secure Enclave.

Key access and integration

Keys can require Touch ID or supported Apple Watch authentication, and the app reports key use. SSH and Git command-line tools use the SSH_AUTH_SOCK environment variable; third-party clients may require their own configuration. Use the app's setup and integrations guidance, then register the correct public key with the destination. Secretive 4 adds SSH certificate presentation, pending-request handling and host lookup from known_hosts.

Requirements and hardware

The official 4.0.0 release requires macOS 15.0 or later; earlier 3.0.4 and 3.0.3 releases document macOS 14.0. The exact current ZIP contains 22831028 bytes. A read-only inspection of its main executable finds Intel x86_64, ARM64 and ARM64e Mach-O slices. No binary was installed or executed to establish those facts.

Secure Enclave storage requires compatible hardware; smart-card signing requires a supported card and its appropriate setup. Authentication options depend on the Mac and operating-system settings. Post-quantum MLDSA support introduced in the 3.0 line depends on macOS Tahoe and should not be confused with a promise that every Secure Enclave key type supports it.

Backups and permissions

Secure Enclave private keys cannot be imported, exported, backed up or transferred to a new Mac. Create separate keys on a replacement machine and update authorized public keys. Losing access to a machine without another registered key or recovery method can prevent access to remote accounts.

Secretive relies on Keychain access associated with its app bundle identity. A custom source build using a different identity may not see keys created by the publisher build. Approve signing requests only when you recognize the operation; agent forwarding extends access to the remote session and deserves careful configuration.

License and data

Secretive is distributed as an MIT-licensed open-source project. Its release build and artifact attestations are auditable through GitHub Actions. The official FAQ documents GitHub API requests for update checks. Local key protection does not establish that SSH destinations or other applications never transmit data.

The screenshot is the publisher's genuine dark-mode README image, showing public-key details; its exact build is unspecified. The packaged icon is an ICNS asset, which the MCP raster URL uploader cannot directly import; that media gap is retained.

Official repository · Official releases · Setup and FAQ

Icon source

The icon is an original complete publisher PNG from the official 2.4.1 source tag. It identifies the same product, but is historical artwork rather than a claim about the current binary icon.