diff --git a/pkgs/tools/security/keyscope/default.nix b/pkgs/tools/security/keyscope/default.nix
new file mode 100644
index 000000000000..163ebc592c5e
--- /dev/null
+++ b/pkgs/tools/security/keyscope/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, stdenv
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "keyscope";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "spectralops";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0dv559a5al7p8r3l90sky4fx4qsxwxlm0ani8qn75pxb70z22qj5";
+  };
+
+  cargoSha256 = "sha256-+6O1EY67MVxWrco7a0QTF7Ls1w9YWwNYjiaEe9ckCkg=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
+
+  # build script tries to get information from git
+  postPatch = ''
+    echo "fn main() {}" > build.rs
+  '';
+
+  VERGEN_GIT_SEMVER = "v${version}";
+
+  meta = with lib; {
+    description = "A key and secret workflow (validation, invalidation, etc.) tool";
+    homepage = "https://github.com/spectralops/keyscope";
+    changelog = "https://github.com/spectralops/keyscope/blob/v${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bf02ea29a2c1..2fb64395b148 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6602,6 +6602,10 @@ with pkgs;
 
   keyfuzz = callPackage ../tools/inputmethods/keyfuzz { };
 
+  keyscope = callPackage ../tools/security/keyscope {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   keystore-explorer = callPackage ../applications/misc/keystore-explorer {
     jdk = jdk11;
   };