jdx / fnox
encrypted/remote secret manager
jdx / fnox
cachix / secretspec
A declarative interface for every secret provider.
mongodb / kingfisher
Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.
fwdai / rowel
🔑 Local-first Secrets Manager
aws / aws-workload-credentials-provider
The AWS Workload Credentials Provider (formerly the AWS Secrets Manager Agent) is a client-side solution that helps you standardize how you consume credentials from AWS services across your compute environments.
matiaskorhonen / paper-age
Easy and secure paper backups of secrets
quiet-node / thuki
context-ware floating secretary
automic-vault / automic-vault
CLI security is broken. The packaging layer is where we fix it.
strands-agents / box
Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.
dopbase / dopbase
DevOps secrets base: lightweight, self-hosted secrets manager in a single file
omaekumiko2-create / OpenKeylet
OpenKeylet — Local password and credential manager for AI agents via MCP. Use passwords, API keys, SSH, and TOTP while keeping hidden plaintext out of model context by default.
ghuntley / preflight
A local proxy that scans LLM requests and attachments for secrets before they reach the model.
MildyNora / envault
A local, minimum, encrypted secrets vault for coding agents — let your AI works with your keys and secret, but never sees them.
cachix / factorseal
Factorseal is a local secrets vault for Linux, macOS, and Windows.
Mouseww / veil
使用大模型时，隐藏你的密码、token 等敏感信息。适配市面上各种工具，一键安装即可用。 / Hide passwords, tokens and secrets from the model. Works with everyday tools — one-click install.
skalenetwork / microsandbox-reef
Run OpenClaw, Hermes and your own agents in microsandbox microVMs. One reviewable TOML role sets image, allowed domains and host-bound secrets. No daemon.