Open source CLI tool

Secrets that never surface

Zero-knowledge secret injection for AI agents. No read commands. No plaintext. Secrets flow through pipes, not prompts.

$ go install github.com/octokraft/agent-vault/cmd/agent-vault@latest

Built for a world with AI agents

Traditional secrets managers assume a human operator. Agent Vault assumes a machine -- and treats it as untrusted by default.

Zero-Knowledge by Design

There is no get or read command. Secrets can only be injected into processes -- never retrieved as plaintext.

Pipe-Based Injection

Secrets flow through Unix pipes and environment variables. They never appear in shell history, agent context windows, or log files.

AES-256-GCM Encryption

Secrets are encrypted at rest using AES-256-GCM with Argon2id key derivation. Industry-standard cryptography, zero shortcuts.

Policy Engine

Blocks shells, interpreters, and exfiltration commands by default. Per-secret command allowlists. Argument inspection catches -c and --eval flags.

Built for AI Agents

The human sets the vault passphrase. The agent uses the CLI. Secrets are injected into commands without the agent ever holding them.

Full-Featured CLI

12 commands: exec, pipe, import, rekey, verify, TTL expiry, and more. Works the Unix way.

Secrets never reach the agent

The vault sits between the human operator, the AI agent, and the target command. The agent orchestrates; it never holds secrets.

Human
Operator
passphrase + secrets
Vault
Encrypted store
names only, no values
Agent
AI Agent
exec / pipe
Command
Target process
Secrets flow directly from the vault to the target command -- the agent never holds them

Dead-simple CLI

The human initializes and stores secrets. The agent injects them into commands. Four commands to learn, zero plaintext exposure.

terminal
# Initialize a new vault (creates ~/.agent-vault/)
$ agent-vault init
# Enter passphrase when prompted -- this is the only secret the human types

# Store secrets (values are prompted, never passed as arguments)
$ agent-vault set db-password
# Enter secret value: ********

$ agent-vault set api-key
# Enter secret value: ********

$ agent-vault set github-token
# Enter secret value: ********
terminal -- agent session
# Inject secrets as environment variables into any command
$ agent-vault exec --env DB_PASS=db-password -- psql -U admin mydb

# Multiple secrets in one command
$ agent-vault exec \
    --env AWS_ACCESS_KEY_ID=aws-key \
    --env AWS_SECRET_ACCESS_KEY=aws-secret \
    -- aws s3 ls

# The command receives the secret; the agent never sees it
# The secret is not in shell history, env, or agent context
terminal -- agent session
# Pipe a secret into a command's stdin
$ agent-vault pipe github-token -- gh auth login --with-token

# Works with any command that reads from stdin
$ agent-vault pipe docker-password -- docker login -u user --password-stdin

# The secret flows: vault -> pipe -> command
# It never touches the agent's memory or context window
terminal
# List stored secret names (never values)
$ agent-vault list
  db-password
  api-key
  github-token

# Check vault status
$ agent-vault status
  Vault:     ~/.agent-vault/vault.enc
  Secrets:   3
  Cipher:    AES-256-GCM
  KDF:       Argon2id
  Created:   2026-03-19T10:30:00Z

Defense in depth, by default

Every design decision serves one goal: secrets must be impossible to exfiltrate through the agent.

01

No Read Primitive

The CLI has no get, read, or show command. There is no code path that outputs a secret as plaintext. This is not a configuration option -- the capability does not exist.

02

Shell & Interpreter Blocking

The policy engine blocks shells (bash, zsh, sh), interpreters (python, node, ruby), and exfiltration commands (cat, echo, curl) by default. Argument inspection catches -c and --eval flags.

03

Encryption & Atomic Writes

AES-256-GCM with Argon2id key derivation. Atomic write-then-rename prevents vault corruption on crash. Exclusive file locking prevents concurrent access. Memory is zeroed after use.

04

Process Isolation & Env Scrubbing

Secrets are injected via env vars or stdin pipes — never written to disk or CLI args. All AGENT_VAULT_* env vars are scrubbed from child processes so the passphrase itself cannot leak.

05

TTL & Secret Expiry

Secrets support time-to-live via --ttl. Expired secrets are rejected at injection time. The verify command reports vault health and expired entries.

Get started in 30 seconds

Requires Go 1.21 or later. Single binary, zero runtime dependencies.

terminal
# Install the binary
$ go install github.com/octokraft/agent-vault/cmd/agent-vault@latest

# Initialize your vault
$ agent-vault init

# Store your first secret
$ agent-vault set my-secret

# Use it
$ agent-vault exec --env SECRET=my-secret -- ./my-app
1
Install One go install command
2
Configure Human runs init + set
3
Deploy Agent uses exec and pipe