Everything reads everything
One exported variable is readable by every process in the environment, and nothing records which of them actually used it.
Secrets for agent workloads
One field. One use. No standing secret.
Skarbiec stores your keys, logins, sessions and tokens as per-recipient ciphertext, then hands a workload exactly the one field it signed for — once, within thirty seconds, and never again on replay.
- Ed25519 workload proofs
- 30-second one-use tokens
- Hash-chained local journal
- Loopback broker only
- Apache-2.0 local core
A read token you issued once is a token that never expires
Long-lived environment variables and copied credential files give every process that can read them the whole secret, for an indefinite period. An agent workload makes that boundary harder to review, not easier.
Nobody can answer who asked
Operators need to know which identity requested which field, reject replay, revoke access, and rotate recipients. A file on disk answers none of that.
Plaintext leaks into the trail
The moment a secret is used to debug a workload, it tends to end up in a prompt, a log line, or an audit record that outlives the incident.
How a workload borrows one field
The operator grants an exact capability, the workload proves who it is, and the capability is destroyed by its own first use. There is no step in which a standing bearer exists.
Grant one exact field
The operator registers a single
acquire:item#fieldcapability and an Ed25519 workload public key. Wildcards and direct capabilities cannot be mixed into that identity.Sign the request
The workload signs the consumer, item, field, workload id, timestamp, and nonce. Skarbiec rejects stale proofs, capability mismatches, and replayed proof hashes.
Spend it once
Skarbiec issues an opaque bearer with a default 30-second TTL. The first successful matching read deletes its stored hash before returning the field.
Leave a reviewable trail
Issuance and consumption append non-sensitive identifiers to a hash-chained local journal. Secret values, one-use tokens, signatures, and public keys are excluded from it.
The first read succeeds. The identical retry does not.
This is the product's defining path, and it is executable rather than a transcript that can drift: a disposable vault, an isolated GPG keyring, and the literal non-secret value not-a-secret.
$ SKARBIEC_EXAMPLE_DIR="${TMPDIR:-/tmp}/skarbiec-acquisition-quickstart" \
sh docs/examples/acquire-one-field.sh
# register demo-workload for exactly demo-note#value
{ "workload_bound": true, "token": null, "capabilities": ["acquire:demo-note#value"] }
# first read, against a signed and nonced proof
{
"consumer": "demo-workload",
"field": "value",
"item": "demo-note",
"ok": true,
"value": "not-a-secret"
}
# same capability, replayed
{
"error": "unauthorized",
"ok": false
}
# audit query: identifiers only
acquisition-issued demo-workload demo-note#value
acquisition-consumed demo-workload demo-note#valueWhat leaves the host, in full
A secrets broker is worth exactly as much as its egress list. Skarbiec's is short enough to print, and the MCP surface deliberately withholds the operations that would make it longer.
| Surface | Binding or scope | Leaves the host |
|---|---|---|
| HTTP broker | 127.0.0.1 only, port 8787 unless --port says otherwise | No |
| breach-check | First five characters of a SHA-1 to api.pwnedpasswords.com | Prefix only; suffixes matched locally |
| MCP surface | Raw item reads, minting, rotation and export excluded | No |
| Browser extension | Never receives a vault bearer or private key | No |
| Vault file | Per-recipient ciphertext; no plaintext values | No |
What Skarbiec does not protect you from
Is this production-ready?
Skarbiec is an early public 0.1.x release, not a hosted secrets service. Deploy an exact release tag and checksum rather than inferring readiness from Cargo.toml or a mutable latest pointer.
Does it survive a compromised machine?
No. Skarbiec does not protect secrets from a host already compromised while the matching owner key is usable, and it does not encrypt item names or other vault metadata.
What happens if the local broker cannot decrypt?
The integration is unavailable. There is no automatic cloud fallback, because a fallback that reaches for a hosted copy would defeat the boundary the product exists to hold.
What does it cost, and what does it phone home to?
The Apache-2.0 local core has no licence fee and no hosted dependency. No hosted control plane is required to run the CLI, MCP server, native messaging, or the HTTP broker.
Can I change the owner key later?
rotate-owner rewraps every current and historical ciphertext onto the new recipient set, and the recovery recipient is preserved through owner rotation.
Install it and run the acquisition proof yourself
The quick start builds a disposable vault, spends one capability, and shows you the replay being refused. It stores nothing but the literal value not-a-secret, and it deletes cleanly when you are done.