blindfold: let AI agents use credentials without seeing them

If you've ever pasted an API key into Claude Code, or let it read your .env, that key now lives in a transcript on your disk and in a request that went to the model provider. I built a small tool call