diff --git a/.gitignore b/.gitignore
index 73508c5..e7b18e0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@
 /boxen-*.gem
 /log
 /puppet
+/script/Boxen.dSYM
diff --git a/script/Boxen b/script/Boxen
new file mode 100755
index 0000000..4267f23
Binary files /dev/null and b/script/Boxen differ
diff --git a/script/build-keychain-helper b/script/build-keychain-helper
new file mode 100755
index 0000000..0eb297c
--- /dev/null
+++ b/script/build-keychain-helper
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -e
+
+cd $(dirname "$0")/..
+cc -g -O2 -Wall -framework Security -o script/Boxen src/keychain-helper.c
diff --git a/src/keychain-helper.c b/src/keychain-helper.c
new file mode 100644
index 0000000..4e72702
--- /dev/null
+++ b/src/keychain-helper.c
@@ -0,0 +1,27 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <Security/Security.h>
+
+int main(int argc, char **argv) {
+  const char *service = argv[1];
+  const char *login   = argv[2];
+
+  if (!(argv[1] && argv[2])) {
+    printf("Usage: %s <service> <account>\n", argv[0]);
+    exit(1);
+  }
+
+  void *buf;
+  UInt32 len;
+  SecKeychainItemRef item;
+
+  int ret = SecKeychainFindGenericPassword(
+    NULL, strlen(service), service, strlen(login), login, &len, &buf, &item);
+
+  if (ret) {
+    exit(1);
+  }
+
+  fwrite(buf, 1, len, stdout);
+  exit(0);
+}