baton-auth 0.1.3__tar.gz

baton_auth-0.1.3/.github/workflows/package.yml

@@ -0,0 +1,107 @@
+name: Package
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test-and-build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12", "3.14"]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          version: "0.13.5"
+
+      - name: Install package and test dependencies
+        run: uv sync --locked --extra dev --python ${{ matrix.python-version }}
+
+      - name: Test
+        run: uv run --no-sync pytest tests -q
+
+      - name: Build source archive and wheel
+        run: uv build
+
+      - name: Install and run the wheel in a clean environment
+        run: |
+          uv venv .package-venv --python ${{ matrix.python-version }}
+          uv pip install --python .package-venv/bin/python dist/*.whl
+          .package-venv/bin/python -m baton_auth --version
+          .package-venv/bin/baton-auth --version
+          .package-venv/bin/python -c 'import baton_auth, importlib.metadata; assert baton_auth.__version__ == importlib.metadata.version("baton-auth")'
+          .package-venv/bin/baton setup --state-dir "$RUNNER_TEMP/baton-smoke" > .package-venv/mcp-config.json
+          .package-venv/bin/python -c 'import json; from pathlib import Path; assert json.loads(Path(".package-venv/mcp-config.json").read_text())["mcpServers"]["baton"]["args"] == ["-m", "baton_auth.mcp_server"]'
+          .package-venv/bin/baton setup --client muse-code --output .package-venv/muse-settings.json --state-dir "$RUNNER_TEMP/baton-smoke"
+          .package-venv/bin/baton setup --client hermes-agent --output .package-venv/hermes-config.yaml --state-dir "$RUNNER_TEMP/baton-smoke"
+          .package-venv/bin/python -c 'import json; from pathlib import Path; from ruamel.yaml import YAML; assert json.loads(Path(".package-venv/muse-settings.json").read_text())["mcpServers"]["baton"]["type"] == "stdio"; assert YAML().load(Path(".package-venv/hermes-config.yaml").read_text())["mcp_servers"]["baton"]["command"]'
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: test-and-build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          version: "0.13.5"
+
+      - name: Check that the tag matches the package version
+        run: test "v$(uv version --short)" = "$GITHUB_REF_NAME"
+
+      - name: Build release files
+        run: |
+          uv build --no-sources
+          sha256sum dist/*.whl dist/*.tar.gz > dist/SHA256SUMS
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" dist/*.whl dist/*.tar.gz dist/SHA256SUMS --verify-tag --generate-notes
+
+      - name: Save distributions for PyPI
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pypi-distributions
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+
+  publish-pypi:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          version: "0.13.5"
+          enable-cache: false
+
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: pypi-distributions
+          path: dist/
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always dist/*.whl dist/*.tar.gz

baton_auth-0.1.3/.gitignore

@@ -0,0 +1,9 @@
+.DS_Store
+__pycache__/
+*.pyc
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.orka/

baton_auth-0.1.3/PKG-INFO

@@ -0,0 +1,78 @@
+Metadata-Version: 2.5
+Name: baton-auth
+Version: 0.1.3
+Summary: Local authentication broker for AI agents and MCP tools
+Project-URL: Homepage, https://github.com/DanDekker/baton
+Project-URL: Documentation, https://github.com/DanDekker/baton/blob/main/docs/guide.md
+Project-URL: Issues, https://github.com/DanDekker/baton/issues
+Project-URL: Source, https://github.com/DanDekker/baton
+Keywords: AI agents,MCP,authentication,credential management,secrets management
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: argon2-cffi>=25
+Requires-Dist: blake3>=1.0
+Requires-Dist: cryptography>=45
+Requires-Dist: httpx>=0.27
+Requires-Dist: keyring>=24
+Requires-Dist: mcp>=2.0
+Requires-Dist: ruamel-yaml>=0.18.16
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+<img src="https://raw.githubusercontent.com/DanDekker/baton/main/assets/baton-banner.svg" alt="baton — Pass the baton, never the secret." width="100%">
+
+<p><a href="#try-it">Try it</a> · <a href="https://github.com/DanDekker/baton/blob/main/docs/guide.md">User guide</a> · <a href="https://github.com/DanDekker/baton/blob/main/docs/security.md">Security</a></p>
+
+<p><a href="https://github.com/DanDekker/baton/actions/workflows/package.yml"><img src="https://github.com/DanDekker/baton/actions/workflows/package.yml/badge.svg?branch=main" alt="Package CI"></a></p>
+
+</div>
+
+---
+
+**baton is a local authentication broker for AI agents and MCP tools.** It lets an agent use your GitHub, cloud, or API credentials without putting the secret value into its chat or tool output.
+
+Save a credential once, group it into a **context** such as `work`, then give an agent a **lease**: a temporary pass that can expire or be revoked. baton uses the credential for a command or HTTP request and hides known secrets in the result.
+
+## Try it
+
+Requires Python 3.10+ and [uv](https://docs.astral.sh/uv/). Install the package from GitHub:
+
+```bash
+uv tool install git+https://github.com/DanDekker/baton.git
+
+baton cred add gh-work --provider github --field token --context work
+
+baton run work -- gh api /user
+baton http work https://api.github.com/user
+baton lease new work --ttl 600 --uses 20
+baton setup  # prints MCP config for an agent client
+```
+
+The bare `--field token` prompts privately. Commands run with a temporary `HOME` containing that context's CLI settings.
+
+`baton setup --client CLIENT` connects Codex, Claude Code, Cursor, VS Code, Muse Code, or Hermes Agent. `baton setup` prints portable MCP config for other clients. Agents with command access can use `baton run` or `baton http`.
+
+## Cryptography at a glance
+
+| Name | How baton uses it |
+| --- | --- |
+| AES-256-GCM-SIV; ChaCha20-Poly1305 fallback | Encrypts credentials in the local vault. |
+| BLAKE3 | Derives separate keys, authenticates leases and vault records, and links audit entries. |
+| Argon2id | Turns a passphrase into the vault key when passphrase mode is used. |
+| HMAC-SHA-256 | Signs AWS requests using Signature Version 4. |
+
+## Learn more
+
+- [User guide](https://github.com/DanDekker/baton/blob/main/docs/guide.md) — contexts, leases, providers, refresh, and MCP tools.
+- [Security and limits](https://github.com/DanDekker/baton/blob/main/docs/security.md) — what baton protects, how it stores secrets, and where its boundary ends.
+
+The distribution is named `baton-auth` and also provides the `baton-auth` command. The Python import is `baton_auth`.
+
+baton runs locally for one user on one machine. A temporary `HOME` keeps CLI configuration separate; it is not a full operating-system sandbox.

baton_auth-0.1.3/README.md

@@ -0,0 +1,52 @@
+<div align="center">
+
+<img src="https://raw.githubusercontent.com/DanDekker/baton/main/assets/baton-banner.svg" alt="baton — Pass the baton, never the secret." width="100%">
+
+<p><a href="#try-it">Try it</a> · <a href="https://github.com/DanDekker/baton/blob/main/docs/guide.md">User guide</a> · <a href="https://github.com/DanDekker/baton/blob/main/docs/security.md">Security</a></p>
+
+<p><a href="https://github.com/DanDekker/baton/actions/workflows/package.yml"><img src="https://github.com/DanDekker/baton/actions/workflows/package.yml/badge.svg?branch=main" alt="Package CI"></a></p>
+
+</div>
+
+---
+
+**baton is a local authentication broker for AI agents and MCP tools.** It lets an agent use your GitHub, cloud, or API credentials without putting the secret value into its chat or tool output.
+
+Save a credential once, group it into a **context** such as `work`, then give an agent a **lease**: a temporary pass that can expire or be revoked. baton uses the credential for a command or HTTP request and hides known secrets in the result.
+
+## Try it
+
+Requires Python 3.10+ and [uv](https://docs.astral.sh/uv/). Install the package from GitHub:
+
+```bash
+uv tool install git+https://github.com/DanDekker/baton.git
+
+baton cred add gh-work --provider github --field token --context work
+
+baton run work -- gh api /user
+baton http work https://api.github.com/user
+baton lease new work --ttl 600 --uses 20
+baton setup  # prints MCP config for an agent client
+```
+
+The bare `--field token` prompts privately. Commands run with a temporary `HOME` containing that context's CLI settings.
+
+`baton setup --client CLIENT` connects Codex, Claude Code, Cursor, VS Code, Muse Code, or Hermes Agent. `baton setup` prints portable MCP config for other clients. Agents with command access can use `baton run` or `baton http`.
+
+## Cryptography at a glance
+
+| Name | How baton uses it |
+| --- | --- |
+| AES-256-GCM-SIV; ChaCha20-Poly1305 fallback | Encrypts credentials in the local vault. |
+| BLAKE3 | Derives separate keys, authenticates leases and vault records, and links audit entries. |
+| Argon2id | Turns a passphrase into the vault key when passphrase mode is used. |
+| HMAC-SHA-256 | Signs AWS requests using Signature Version 4. |
+
+## Learn more
+
+- [User guide](https://github.com/DanDekker/baton/blob/main/docs/guide.md) — contexts, leases, providers, refresh, and MCP tools.
+- [Security and limits](https://github.com/DanDekker/baton/blob/main/docs/security.md) — what baton protects, how it stores secrets, and where its boundary ends.
+
+The distribution is named `baton-auth` and also provides the `baton-auth` command. The Python import is `baton_auth`.
+
+baton runs locally for one user on one machine. A temporary `HOME` keeps CLI configuration separate; it is not a full operating-system sandbox.

baton_auth-0.1.3/assets/baton-banner.svg

@@ -0,0 +1,56 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 300" role="img" aria-labelledby="title desc">
+  <title id="title">baton</title>
+  <desc id="desc">Auth contexts for agents. Pass the baton, never the secret.</desc>
+  <defs>
+    <linearGradient id="background" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#050505"/>
+      <stop offset="1" stop-color="#0d0d0d"/>
+    </linearGradient>
+    <radialGradient id="glow" cx="0" cy="0" r="1" gradientTransform="translate(1000 78) rotate(90) scale(260 350)">
+      <stop stop-color="#ffffff" stop-opacity=".04"/>
+      <stop offset="1" stop-color="#ffffff" stop-opacity="0"/>
+    </radialGradient>
+    <linearGradient id="gold-body" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0" stop-color="#744414"/>
+      <stop offset=".18" stop-color="#c88b31"/>
+      <stop offset=".42" stop-color="#fff1ba"/>
+      <stop offset=".61" stop-color="#e5ad50"/>
+      <stop offset="1" stop-color="#8f581b"/>
+    </linearGradient>
+    <radialGradient id="gold-cap">
+      <stop stop-color="#fff6d1"/>
+      <stop offset=".65" stop-color="#dfaa4e"/>
+      <stop offset="1" stop-color="#8f5518"/>
+    </radialGradient>
+    <filter id="baton-shadow" x="-70%" y="-30%" width="240%" height="170%">
+      <feGaussianBlur stdDeviation="5"/>
+    </filter>
+    <clipPath id="frame">
+      <rect width="1200" height="300" rx="22"/>
+    </clipPath>
+  </defs>
+
+  <g clip-path="url(#frame)">
+    <rect width="1200" height="300" fill="url(#background)"/>
+    <rect width="1200" height="300" fill="url(#glow)"/>
+    <path d="M785 0v300M865 0v300M945 0v300M1025 0v300M1105 0v300" stroke="#ffffff" stroke-opacity=".06"/>
+    <path d="M740 72h398M740 150h398M740 228h398" stroke="#ffffff" stroke-opacity=".06"/>
+
+    <rect x="67" y="76" width="144" height="144" rx="34" fill="#252525" stroke="#484848" stroke-width="2"/>
+    <g transform="translate(139 148) rotate(45)">
+      <rect x="-16" y="-59" width="37" height="119" rx="16" fill="#000000" opacity=".5" filter="url(#baton-shadow)"/>
+      <rect x="-15" y="-58" width="30" height="116" rx="14" fill="url(#gold-body)" stroke="#6c3f11" stroke-width="1.5"/>
+      <path d="M-7 -43v86" stroke="#fff6d6" stroke-opacity=".65" stroke-width="2" stroke-linecap="round"/>
+      <path d="M9 -44v88" stroke="#5d340d" stroke-opacity=".35" stroke-width="3" stroke-linecap="round"/>
+      <ellipse cx="0" cy="-55" rx="14" ry="6" fill="url(#gold-cap)"/>
+      <ellipse cx="0" cy="55" rx="14" ry="6" fill="url(#gold-cap)"/>
+    </g>
+
+    <text x="252" y="94" fill="#b9b9b9" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16" font-weight="700" letter-spacing="3.5">AUTH CONTEXTS FOR AGENTS</text>
+    <text x="246" y="184" fill="#f6f6f6" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="82" font-weight="750" letter-spacing="-3">baton</text>
+    <text x="251" y="229" fill="#c8c8c8" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="25">Pass the baton, never the secret.</text>
+
+    <path d="M849 121l47-47m-47 126l125-126m-47 126l125-126m-47 126l125-126" stroke="#ffffff" stroke-opacity=".07" stroke-width="16" stroke-linecap="round"/>
+    <path d="M0 298h1200" stroke="#ffffff" stroke-opacity=".14" stroke-width="4"/>
+  </g>
+</svg>

baton_auth-0.1.3/docs/guide.md

@@ -0,0 +1,124 @@
+# Using baton
+
+[Back to overview](../README.md) · [Security and limits](security.md)
+
+baton keeps credentials on your machine and uses them on an agent's behalf. Three terms are enough to get started:
+
+| Term | What it means |
+| --- | --- |
+| **Credential** | A token, password, key, or config file you store in baton. |
+| **Context** | A named group of credentials, such as `work` or `staging`. |
+| **Lease** | A temporary pass to use a context. It can expire, run out of uses, or be revoked. |
+
+## Set up a context
+
+Install with Python 3.10+ and [uv](https://docs.astral.sh/uv/), then add a GitHub token. A bare `--field token` prompts without showing the value or putting it in shell history.
+
+```bash
+uv tool install git+https://github.com/DanDekker/baton.git
+
+baton cred add gh-work --provider github --field token --context work
+baton ctx list
+```
+
+Run a command or send an HTTP request with the `work` context:
+
+```bash
+baton run work -- gh api /user
+baton http work https://api.github.com/user
+```
+
+For `baton run`, put baton options before the context name and the child command after `--`. The child gets a temporary `HOME` with this context's CLI configuration. Output is checked for known secrets before it is returned.
+
+## Give an agent temporary access
+
+```bash
+baton lease new work --ttl 600 --uses 20
+baton lease list
+baton lease revoke LEASE_ID
+```
+
+The first command prints a lease token. Give that token only to the agent that needs it: anyone holding a live lease can use its allowed context. `--ttl` is in seconds; `--uses` sets a use limit. Add `--service github` to restrict a lease to that service.
+
+## Connect an MCP client
+
+Connect a local agent with one command:
+
+```bash
+baton setup --client codex
+baton setup --client claude-code
+baton setup --client cursor
+baton setup --client vscode
+baton setup --client muse-code
+baton setup --client hermes-agent
+```
+
+Codex and Claude Code use their own setup commands. Cursor gets a personal `~/.cursor/mcp.json`; VS Code gets `.vscode/mcp.json` in the current project. For another MCP client, run `baton setup` to print JSON, or `baton setup --output PATH` to merge into its JSON config. Add `--root servers` if that client uses a `servers` key. baton uses its installed Python environment and includes the vault path, so the client opens the same vault. Setup leaves other configured servers alone.
+
+Muse Code gets `~/.config/muse/settings.json` (or `$XDG_CONFIG_HOME/muse/settings.json`); Hermes Agent gets `~/.hermes/config.yaml` (or `$HERMES_HOME/config.yaml`). Both keep their existing settings and other MCP servers. Use `--output PATH` to target another config file.
+
+Client formats follow the current [Codex](https://learn.chatgpt.com/docs/extend/mcp), [Claude Code](https://code.claude.com/docs/en/mcp), [Cursor](https://cursor.com/docs/mcp), [VS Code](https://code.visualstudio.com/docs/agents/reference/mcp-configuration), [Muse Code](https://meta-models.github.io/muse-code-sdk/next/guides/extend/mcp-servers/), and [Hermes Agent](https://github.com/NousResearch/hermes-agent/blob/main/website/docs/reference/mcp-config-reference.md) MCP guides.
+
+If you use `BATON_MASTER_KEY` or `BATON_PASSPHRASE`, supply it to the client through its environment; setup never writes a key into the config. Agents without MCP can call `baton run` or `baton http` through a command tool. A local MCP server must be installed on the machine where the agent runs.
+
+| What an agent needs to do | MCP tools |
+| --- | --- |
+| See available contexts and metadata | `baton_contexts`, `baton_credentials`, `baton_info` |
+| Get or manage a pass | `baton_lease`, `baton_leases`, `baton_revoke` |
+| Use a context | `baton_run`, `baton_http` |
+| Refresh or inspect history | `baton_refresh`, `baton_audit` |
+
+These tools do not return stored credential values. The server uses MCP Python SDK 2.x.
+
+## Use other services
+
+Run `baton info` to see the fields expected by each preset. Built-in presets are `aws`, `gcp`, `github`, `gitlab`, `npm`, `docker`, `kube`, `ssh`, and `generic`. Any other provider name uses bearer token auth by default.
+
+```bash
+baton cred add kube-prod --provider kube --field-file kubeconfig=~/.kube/config
+baton cred add registry --provider docker \
+  --field username --field password --field registry=ghcr.io
+baton cred add my-api --provider my-service --field api_key \
+  --auth header:x-api-key --auth-field api_key \
+  --env 'MY_SERVICE_KEY={api_key}' --context work
+```
+
+Presets decide how baton sets environment variables, writes CLI config files, or attaches HTTP authentication. For a custom provider, `--auth` also accepts `bearer`, `query:NAME`, `basic` (with `username` and `password` fields), and `none` for CLI-only use. Use `--field-file NAME=PATH` for a file or longer value. Avoid `--field NAME=VALUE` for secrets because the value can appear in shell history and process listings.
+
+## Refresh expiring tokens
+
+baton can refresh an expiring credential before use. OAuth 2.0 refresh tokens, external commands, and custom Python handlers are supported. For OAuth, keep the client secret and refresh token in prompted fields:
+
+```bash
+baton cred add api --provider generic \
+  --field token --field refresh_token --field client_secret \
+  --refresh-provider oauth2 \
+  --refresh-token-url https://auth.example.com/token \
+  --refresh-client-id my-client-id
+
+baton cred refresh api --force
+```
+
+OAuth refresh can rotate the refresh token and update the expiry from `expires_in`. Python integrations can register other handlers with `register_refresh_provider(name, handler)`.
+
+## Useful commands
+
+| Command | Purpose |
+| --- | --- |
+| `baton status` | Show vault status and counts. |
+| `baton cred list` / `baton ctx list` | See stored names without revealing values. |
+| `baton env work` | See which environment variables a context sets. |
+| `baton audit` | Check the audit chain and recent activity. |
+| `baton --help` | See all commands and examples. |
+
+Use `--state-dir PATH` to choose another vault directory. `baton env --reveal` prints values for a human operator on explicit request; never use it in an agent transcript.
+
+## Work on the package
+
+The distribution name is `baton-auth` because `baton` is an unrelated PyPI project. The import name is `baton_auth`. This repository installs the `baton`, `baton-auth`, and `baton-mcp` commands. It is installable from GitHub; a PyPI release has not been published yet.
+
+```bash
+uv sync --extra dev
+.venv/bin/python -m pytest tests -q
+uv build
+```

baton_auth-0.1.3/docs/security.md

@@ -0,0 +1,40 @@
+# Security and limits
+
+[Back to overview](../README.md) · [User guide](guide.md)
+
+baton keeps stored credential values away from MCP tools. Agents can see context names and use a temporary lease, while baton applies the real credential to a command or HTTP request. The returned output is checked for known secret values and recognized token shapes.
+
+## What baton protects
+
+| Area | How it works |
+| --- | --- |
+| Vault | Credential records are encrypted and tied to their record identity. The database file alone cannot decrypt them. |
+| Leases | Handles expire, can be revoked or limited by service and use count, and are stored only as token digests. |
+| CLI commands | Each run gets a temporary `0700` home with its context's auth files. Common inherited code injection variables are removed. |
+| HTTP requests | baton attaches bearer, header, basic, query, or AWS SigV4 auth. It rejects disallowed URL schemes, metadata endpoints, link-local addresses, and private networks by default. Redirects are returned without being followed. |
+| Results | Known secret values and common provider token patterns are redacted before a broker result is returned. |
+| Audit | Actions are recorded in a BLAKE3 hash chain. SQLite uses WAL and atomic lease use updates. |
+
+The master seed is resolved in this order: `BATON_MASTER_KEY` → `BATON_PASSPHRASE` with Argon2id → OS keyring → a `0600` keyfile. Mutable key buffers are wiped when the vault closes.
+
+## Where the boundary ends
+
+- baton is local to one user on one machine. It does not sync vaults between hosts.
+- A temporary `HOME` separates CLI settings; it is not an operating-system sandbox. Child processes keep their normal filesystem permissions.
+- A lease is a bearer token. Share it only with the intended agent and revoke it when it is no longer needed.
+- Redaction is based on known values and token patterns. It cannot undo a leak that happened through another tool or guarantee that every possible encoding is caught.
+- Hostnames are checked before HTTP connections. DNS can change between validation and connection; use network-level egress controls for untrusted destinations.
+- `baton env --reveal` prints values when an operator explicitly asks for them. MCP has no reveal tool.
+
+## Cryptographic construction
+
+| Purpose | Primitive |
+| --- | --- |
+| Record encryption | AES-256-GCM-SIV (RFC 8452) when available; ChaCha20-Poly1305 fallback |
+| Envelope commitment | BLAKE3 keyed tag over header, associated data, and ciphertext |
+| Subkeys | BLAKE3 `derive_key`, separated by purpose |
+| Lease MACs and audit chain | BLAKE3 keyed mode |
+| Passphrase derivation | Argon2id, 64 MiB memory, 3 iterations, parallelism 4 |
+| Record identity | Associated data `cred:<id>:<name>` |
+
+AWS SigV4 uses SHA-256 as required by that protocol. The implementation lives in [`src/baton_auth/crypto.py`](../src/baton_auth/crypto.py), [`src/baton_auth/vault.py`](../src/baton_auth/vault.py), and [`src/baton_auth/broker.py`](../src/baton_auth/broker.py).

baton_auth-0.1.3/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "baton-auth"
+description = "Local authentication broker for AI agents and MCP tools"
+version = "0.1.3"
+requires-python = ">=3.10"
+readme = "README.md"
+keywords = ["AI agents", "authentication", "MCP", "credential management", "secrets management"]
+classifiers = [
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security",
+  "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+  "cryptography>=45",
+  "blake3>=1.0",
+  "argon2-cffi>=25",
+  "keyring>=24",
+  "mcp>=2.0",
+  "httpx>=0.27",
+  "ruamel.yaml>=0.18.16",
+]
+
+[project.urls]
+Homepage = "https://github.com/DanDekker/baton"
+Documentation = "https://github.com/DanDekker/baton/blob/main/docs/guide.md"
+Issues = "https://github.com/DanDekker/baton/issues"
+Source = "https://github.com/DanDekker/baton"
+
+[project.scripts]
+baton = "baton_auth.cli:main"
+baton-auth = "baton_auth.cli:main"
+baton-mcp = "baton_auth.mcp_server:main"
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/baton_auth"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

baton_auth-0.1.3/src/baton_auth/__init__.py

@@ -0,0 +1,45 @@
+"""baton: pass auth context between agents as leases, never as secrets."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+from .crypto import CryptoError, zeroize
+from .models import (
+    BatonError,
+    Context,
+    Credential,
+    Lease,
+    LeaseError,
+    RefreshError,
+    UnknownContext,
+    UnknownCredential,
+    VaultLocked,
+)
+
+try:
+    __version__ = version("baton-auth")
+except PackageNotFoundError:  # running from an unpackaged source tree
+    __version__ = "0+local"
+
+__all__ = [
+    "BatonError",
+    "Context",
+    "Credential",
+    "CryptoError",
+    "Lease",
+    "LeaseError",
+    "RefreshError",
+    "UnknownContext",
+    "UnknownCredential",
+    "VaultLocked",
+    "Vault",
+    "zeroize",
+    "__version__",
+]
+
+
+def __getattr__(name: str):
+    if name == "Vault":
+        from .vault import Vault
+
+        return Vault
+    raise AttributeError(name)

baton_auth-0.1.3/src/baton_auth/__main__.py

@@ -0,0 +1,7 @@
+"""Run the operator CLI with ``python -m baton_auth``."""
+
+from .cli import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())