Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

ai-agents api-keys audit-log capability-based-security claude-code credential-management deny-by-default go golang least-privilege mcp model-context-protocol secret-management secrets-management security self-hosted ssh-agent vault
9 Open Issues Need Help Last updated: Oct 14, 2026

Open Issues Need Help

View All on GitHub
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
Signed releases 21 days ago
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
TOTP seeds 21 days ago
good first issue help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault
help wanted roadmap

Local credential broker for AI agents. Keep API keys and SSH keys in an encrypted vault on your own machine; give each agent its own scoped, expiring, revocable grants; let it use a credential over MCP or ssh-agent without ever seeing it. Deny by default, every attempt in a hash-chained audit log. Single user, local only, pre-release.

Go
#ai-agents#api-keys#audit-log#capability-based-security#claude-code#credential-management#deny-by-default#go#golang#least-privilege#mcp#model-context-protocol#secret-management#secrets-management#security#self-hosted#ssh-agent#vault