Secrets infrastructureStart
Skarbiec
Self-contained encrypted vault
Skarbiec stores per-recipient encrypted items, shares and revokes access, mints scoped service grants, injects secrets at runtime, and exposes intentionally narrower local HTTP and MCP boundaries.
Product contract
- Each item is armored ciphertext sealed to the public keys of its recipient group; the vault file is safe at rest.
- Human recipients use their local private key, while machine consumers redeem scoped grants and never receive a recipient private key.
- The CLI is the complete operator surface; loopback HTTP and MCP deliberately expose a smaller programmatic surface.
- SSO and directory provisioning are external identity-provider integrations, not a feature of the vault engine.
Connected systems
- Brama
- Jeden
- MCP clients
- Desktop clients
- GPG
- OpenSSL