Self-hosted password manager
Give an agent one key, not the keyring.
You sign in with a browser. Your agents use scoped bearer keys over REST or MCP. One authorization service answers both, so they can never disagree about what a caller may see.
- No third-party requests
- Every agent disclosure audited
- MFA on sensitive actions
- Username
- svc_reporting
- Password
- k7-Rm2q-Wz9p-Lx4v
- Version
- 7
Reveal it, copy it. The clipboard clears on a timer.
- Username
- svc_reporting
- Password
- null withheld
- Version
- 7
Reading it is a second call, for one named field, and it is audited.
Agent authorization
A key that reaches less than you do.
Each key carries its own permission set and its own scope. Beyond that grant there is nothing to find: out-of-scope entries never appear in a list or a search.
Four verbs, nothing else
Read, create, update, delete. There is no administrator verb, no purge, and no route into account settings, because the domain model has none to grant.
Scope down to a single entry
A key is either global or scoped to chosen vaults, collections and entries, never both. The interface, the validation and the database schema each refuse the mix.
Delete parks, never destroys
An agent's delete moves the entry to pending deletion and stops there. Approving or rejecting is your decision; the agent cannot make it and cannot skip it.
Revocation lands on the next call
Grants are read fresh on every request, never cached into a session. Revoke a key or narrow its scope and the very next call obeys.
Model Context Protocol
The tool descriptions are part of the boundary.
A model picks a tool by reading its description, so every
description opens with the stakes:
DISCLOSES A SECRET, in capitals, on the tools
that reveal one; REDACTED on every tool that
never does. A test pins the exact wording.
| Tool | Discloses | Returns |
|---|---|---|
| vault_list_containers | Redacted | Vaults and collections, names and ids only |
| vault_list_entries | Redacted | Entry titles and ids in one container |
| vault_search_entries | Redacted | Titles and ids matching non-secret text |
| vault_get_entry | Redacted | One entry's structure and version, sensitive values null |
| vault_get_entry_field | Discloses a secret | The plaintext of one named field |
| vault_get_totp_code | Discloses a secret | The current two-factor code, never the seed |
| vault_create_entry | Redacted | Writes, and requires an idempotency key |
| vault_update_entry | Redacted | Writes, and requires the version it read |
| vault_delete_entry | Redacted | Parks the entry for its owner |
The most a tool can disclose is one field of one entry. A bulk read does not exist, by design.
REST v1
Two ways in, never two answers.
MCP is a second way in, not a second copy of the code. REST and MCP both go through the same authorization service, so both give the same answer. A test proves it by sending the identical request through each and checking the replies match.
curl https://vault.example.com/api/v1/entries/9f2c/fields/password \
-H "Authorization: Bearer <agent key>"
200 { "name": "password", "value": "k7-Rm2q-Wz9p-Lx4v" }
401 every rejection, with an empty body
Unknown, revoked, expired, or stripped of every grant: every bad key gets the same empty 401. A rejection reveals nothing about whether the key ever existed. Browser cookies are never accepted here, and a test sweeps every endpoint with a real signed-in session to prove it.
The human half
Still a password manager you would want to use.
Agents are the new half. The half you touch every day is a workbench built to find one entry fast and get you back out.
One surface browses everything
A three-pane workbench where your selection lives in the URL, rows are ordinary links, and every panel is rendered by the server.
Search that works with script off
The search box is a real GET form; the results that drop out of it only enhance it. Delete the JavaScript and search still works.
Accessible on the core flows
WCAG 2.2 AA, a keyboard path that matches the reading order, and no critical violation on the flows that matter. Enforced by tests, not intentions.
Autofill that checks the origin
The Edge extension fills a page only on an exact origin match, from an enrollment you approve and can revoke at any time.
Import and leave whenever you like
KDBX import, CSV export, and a portable encrypted backup that restores onto a clean host.
MFA where it actually counts
Widening an agent's reach, exporting plaintext or deleting the account each need a fresh MFA check. Revoking a key or narrowing a scope never does, and you can stop MFA asking at sign-in without any of these stopping.
Privacy
Nothing here calls anyone else.
No CDN, no web fonts, no analytics, no third-party assets: a strict Content-Security-Policy refuses them all. Even the typeface is the one your operating system already ships, so loading a page announces nothing to anyone.
Envelope encryption
Secrets are sealed with per-record keys, wrapped by a root key held outside the database and outside the application image. A stolen database is not a stolen password list.
An append-only audit trail
Which key read which field, and when. Every disclosure an agent causes is recorded, and no audit event ever carries a secret of its own.
Sessions you can end
Revoke one browser session or all of them at once; revoking all invalidates every cookie already issued. Either way, nothing outlives a 24-hour expiry.
Before you trust it
What Vault is not.
An honest tool states its limits. These come straight from the threat model, in the same words it uses.
- Not zero-knowledge The server decrypts what it is authorized to return. Vault is not end-to-end encrypted and does not claim to be.
- Not proof against whoever runs this service The operator can reach the running service and its root key. If you use Vault, you are trusting whoever hosts it.
- No HSM or KMS Key custody is a file on the server, not a hardware module. A deliberate scope choice, not an oversight.
- Your browser is your problem A compromised endpoint or a hostile browser extension is outside what any server can defend.
- Denial of service is bounded, not solved Requests are rate-limited and payloads are capped. Neither makes a determined flood go away.
- Clipboard clearing is best effort The platform does not guarantee it, so the interface says so instead of promising what it cannot keep.
Hold the keys your agents borrow.
Registration is open. You will set a password and enrol MFA before you reach a vault.