strands-agents / box

Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.

cachix / secretspec

A declarative interface for every secret provider.

ghuntley / preflight

A local proxy that scans LLM requests and attachments for secrets before they reach the model.

fwdai / rowel

🔑 Local-first Secrets Manager

mongodb / kingfisher

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

automic-vault / automic-vault

CLI security is broken. The packaging layer is where we fix it.

cachix / factorseal

Factorseal is a local secrets vault for Linux, macOS, and Windows.

Mouseww / veil

使用大模型时，隐藏你的密码、token 等敏感信息。适配市面上各种工具，一键安装即可用。 / Hide passwords, tokens and secrets from the model. Works with everyday tools — one-click install.

aws / aws-workload-credentials-provider

The AWS Workload Credentials Provider (formerly the AWS Secrets Manager Agent) is a client-side solution that helps you standardize how you consume credentials from AWS services across your compute environments.

matiaskorhonen / paper-age

Easy and secure paper backups of secrets

omaekumiko2-create / OpenKeylet

OpenKeylet — Local password and credential manager for AI agents via MCP. Use passwords, API keys, SSH, and TOTP while keeping hidden plaintext out of model context by default.

MildyNora / envault

A local, minimum, encrypted secrets vault for coding agents — let your AI works with your keys and secret, but never sees them.

skalenetwork / microsandbox-reef

Run OpenClaw, Hermes and your own agents in microsandbox microVMs. One reviewable TOML role sets image, allowed domains and host-bound secrets. No daemon.

dopbase / dopbase

DevOps secrets base: lightweight, self-hosted secrets manager in a single file