Post

I've been running coding agents in VMs, and the worst part was always credentials. Either I pasted a token into the VM and hoped, or I did everything myself. So I built foca. It's basically ssh-agent for secrets: the VM asks, I tap Touch ID, it gets the token. github.com/bpinto/foca

When something in the VM wants a secret, I get a Touch ID prompt on my Mac saying which secret, which VM and which program. On Linux it's the normal polkit password dialog. If I say no, it gets nothing.

The prompt tells you who's asking. If the kernel can confirm the process, it shows it plainly. If it only has the VM's word for it, it says so: "gh via claude (unverified)". A caller can't sneak its own text into the prompt either.

Each VM or container gets its own socket and its own vault. If a secret isn't exposed to that VM, asking for it looks exactly like asking for one that doesn't exist.

My favourite bit: actions. Some things shouldn't be a token sitting in the VM, like AWS creds. So the host runs granted for it, with a fixed command and a checked profile name, and the VM only gets the short-lived output. credential_process = foca exec aws-creds --param profile=dev-admin