Tsm
- 9 repo stars
- Updated May 31, 2026
- tashian/tsm
Manage secrets for AI coding agents on macOS behind a Touch-ID gate so credentials are accessed only with explicit biometric approval.
About
tsm is a Touch-ID-gated secrets manager for AI coding agents on macOS. It requires biometric approval before an agent can access stored credentials. The skill reduces the risk of agents leaking or misusing secrets by enforcing explicit user consent.
- Touch-ID-gated secrets
- For AI coding agents
- macOS native
- Biometric access control
Tsm by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
/plugin marketplace add tashian/tsm/plugin install tsm@tsmAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| repo stars | ★ 9 |
|---|---|
| Last updated | May 31, 2026 |
| Repository | tashian/tsm ↗ |
What it does
Manage secrets for AI coding agents on macOS behind a Touch-ID gate so credentials are accessed only with explicit biometric approval.
README.md
tsm Claude Code plugin
Adds first-class tsm credential support to Claude Code:
- Permission allowlist auto-approves read-only and lifecycle
tsmcommands so the agent does not prompt on every secret read. credential-usageskill teaches the agent to discover credentials in the vault first and pick the safe retrieval pattern per tool category.
The tsm CLI auto-spawns the tsmd daemon on first use, so no SessionStart hook is needed — the first agent call (typically tsm list --json) brings it up transparently.
Install
Inside Claude Code:
/plugin marketplace add tashian/tsm
/plugin install tsm@tsm
(tsm@tsm = plugin name tsm from marketplace name tsm.) Confirm with /plugin — it should appear under the Installed tab. Run /reload-plugins to apply.
Local development
The marketplace is registered at the repository root (.claude-plugin/marketplace.json), so you can also point at a local checkout:
/plugin marketplace add /absolute/path/to/tsm
/plugin install tsm@tsm
Requires
tsmCLI installed and onPATH(see the top-level repo README).- A vault initialized with
tsm init. - macOS with Touch ID.
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85