fob
Menu-bar SSH agent that signs only after Touch ID, keys locked in the Secure Enclave.
fob is an ssh-agent that stores keys inside the Mac's Secure Enclave — non-exportable, so nothing usable ever sits on disk — and requires Touch ID, Apple Watch, or a password for every fresh signature. Prompts name the actual destination host, verified by its host-key signature, and a key can be pinned to one host so a stolen socket can't redirect it elsewhere. It also signs git commits from the enclave for GitHub/GitLab's Verified badge, and keeps a SHA-256 hash-chained audit log of every decision.
What holds up
- +Private key never leaves the Secure Enclave — the on-disk blob is useless on any other device
- +Per-host pinning refuses a key for any host but the one it's bound to, before any prompt
- +Tamper-evident audit log — every decision hash-chained and independently verifiable
Mind the limits
- −macOS only — needs Secure Enclave hardware, so no Linux or Windows dev machines
- −Not a sandbox around your session — protects the key, not everything else on a compromised Mac
Featured here? Take the badge
Put it on your site — it links back to this review. Free for every listed product, always.
<a href="https://stillworks.dev/products/p/fob/"><img src="https://stillworks.dev/badge/fob.svg" alt="Picked by StillWorks" width="250" height="54"></a>