A fuse for your AI keys. It blows before your bill does.

Keyfuse watches each AI API key on its own. When one starts spending like a stolen key, it cuts that key off and helps you swap in a new one.

Get early access
Per key, not per account Checker runs locally Open source checker
Illustration of the hosted service. Sample keys and numbers.
Free checker, coming soon

See which paid keys your agents can reach.

Claude Code, Cursor, Codex and MCP servers can read most of your disk. So can anything that hijacks them.

$ keyfuse scan
41 files checked, plus your shell env

! OpenAI Project key  sk-proj-****7rTz
  .env:1  OPENAI_API_KEY
✗ Anthropic API key  sk-ant-api03-****s2Pq
  ~/.zsh_history:1  ANTHROPIC_API_KEY
! OpenRouter API key  sk-or-v1-****58e2
  ~/.cursor/mcp.json:6  (MCP server: research)
! OpenAI Project key  sk-proj-****7rTz
  $OPENAI_API_KEY  inherited by every agent

3 keys from 3 providers in 4 places.
Run `keyfuse check` for advice on each key.
  • Env files and configs.env, .envrc, .npmrc and friends
  • MCP and agent configsCursor, Claude Code, Claude Desktop, Codex
  • Shell profiles and historyThat one export you typed in March
  • Your live environmentWhat every agent you start inherits

Runs on your machine. Sends nothing. Never prints a full key.

The hosted fuse

One key goes rogue. Only that key goes dark.

Account budgets alert on the total, often after the money is gone. Keyfuse watches each key against its own normal.

Learn

Builds a normal usage rate for every key.

Spot

Checks every few minutes and flags a key that jumps.

Blow

Switches that one key off, where the provider allows it.

Rotate

Guides the swap: new key live first, old key revoked last.

Switch-off depends on each provider's API. We will list which providers support it before the hosted service opens.

Free breach feed

Your keys leak through vendors you trust.

When a developer platform leaks keys, the feed has it immediately, with what to rotate.

Oct 21, 2026Rotate

Railway

Secrets exposed for a subset of users. Everyone who signed up before Oct 21 was told to rotate.

Railway report
Oct 17, 2026Rotate

OpenCode Console

Stored OpenAI, Anthropic and Google keys were used overnight. Some users saw charges above $1,000.

TechCrunch
Oct 14, 2026Rotate

Zeabur

About 3.2 million environment variable records read. Users told to replace every stored key.

BleepingComputer
On paid plans, Keyfuse tells you which of your own keys were on the breached platform.Web and RSS at launch
For teams running agents

Keep real keys out of your agents.

Two Team plan features, planned for the hosted service.

Runtime secret broker

Agents ask for a key when they need one. They get a short-lived token, or one command run with the key set. The real value never enters their context.

$ keyfuse run --agent research ./crawl ✓ policy ok, openrouter, 15 min the agent never sees the real key

Agent policies

Decide once which agent may use which key, for how long, and up to what spend. Every request is logged.

# keyfuse.policy.yml research: keys: [openrouter] max_spend: $5/day ttl: 15m
Pricing

Priced per key, not per seat.

Start free. Pay when you want each key watched for you.

Free

For checking your own machine.

$0

Open source, coming soon

  • keyfuse scan and check
  • CI workflow for pull requests
  • Public breach feed
  • Community support
Get notified
Early access

Solo

For one developer paying for AI APIs.

$15/mo

Up to 5 keys

  • Everything in Free
  • Checks every 5 minutes
  • Per-key spike alerts by email
  • Switch-off where supported
  • Breach matching for your keys
  • 30 days of history
Join early access

Team

For teams whose agents spend real money.

$79/mo

Up to 50 keys, 10 members

  • Everything in Solo
  • Checks every minute
  • Guided rotation
  • Runtime secret broker
  • Agent policies
  • Slack alerts
  • Evidence pack for billing disputes
  • 1 year audit log
Join early access

Enterprise

For security and compliance needs.

Custom

Unlimited keys

  • Everything in Team
  • SSO (SAML) and SCIM
  • Self-hosted or on-prem broker
  • Custom retention and DPA
  • SOC 2 on the roadmap, not audited yet
  • Priority support
[email protected]

Paid plans are in early access. Nobody is charged until you agree to a plan.

FAQ

Short answers.

Does the checker send my keys anywhere?

No. It runs offline and makes no network requests. It shows only the prefix and last 4 characters, like sk-ant-api03-****s2Pq.

Which providers does it know?

OpenAI, Anthropic, Google Gemini, OpenRouter, xAI, Groq, Hugging Face, Replicate and Perplexity by key format. Mistral, Cohere, DeepSeek, Together and Fireworks by variable name.

Why not just use provider budgets?

Use them too. Budgets cover the whole account. A stolen key can burn the full budget before the alert reaches you, and the alert will not say which key.

How will the hosted service see my usage?

Through each provider's usage or admin API, with read access where the provider offers it. Switch-off needs more access, so it stays opt-in per key.

Who builds Keyfuse?

A small independent team. I built the checker first because I wanted it myself. The checker will be open source, so you will not have to take my word for what it does.

What does early access mean?

The hosted plans are being built with the people on this list. You hear first when one is ready to try. No card needed.

Early access

Get the fuse before you need it.

The free checker and the hosted plans go to this list first.

Only used to email you about Keyfuse. Never sold. Deleted on request at [email protected].

You are on the list.

Thanks. We will email you when a hosted plan is ready to try.