Store encrypted secrets. Inject them into subprocesses.
Claude Code, Cursor, Copilot — the AI never sees the values.
23.8Msecrets leaked on GitHub in 2024 — up 25% year over year. Repos using AI coding assistants leaked at a rate 40% higher than those without.
Your AI coding assistant needs database credentials, API keys, and tokens to run tests, deploy code, and call services. But every secret you paste into Claude Code or Cursor lives in the model's context window, flows through Anthropic's API, and may be logged anywhere along the way.
Existing secret managers weren't built for AI agents. OpaqueVault was.
Source: GitGuardian State of Secrets Sprawl 2025
Run ov scan in any repo. No signup. No telemetry. It walks your git-tracked files and surfaces secrets you may not know are there — AWS keys, Stripe tokens, private keys, connection strings, high-entropy blobs.
Every project has a DATABASE_URL. OpaqueVault scopes secrets by app and environment — so they never collide and you never needMYSAAS_PROD_DATABASE_URL again.
.ov.yaml# .ov.yaml — commit this file, it has no secrets
app: my-saas
env: stagingDrop this in your repo root. Every ov command and ov mcp serve picks up the context automatically.
Decryption happens locally on your machine. The cloud stores only ciphertext.
.ov.yaml sets the contextA two-line file in your repo root — app: my-saas, env: staging — tells ov mcp serve which project and environment to operate in. No flags. No ambient ambiguity.
vault_runClaude Code calls the MCP tool with a command and secret names. The bridge already knows which app and environment to pull from — Claude never needs to specify them.
ov mcp serve fetches the encrypted blob for that app + environment, decrypts locally with your KEK, and spawns the subprocess with the secret as an env var. The value is zeroed from memory after use.
The MCP response contains the exit code and injection metadata — stdout and stderr are structurally omitted, and the plaintext secret value is never in the response. Ever.
Store secrets with the CLI. Reference them from Claude Code. Your AI agent runs commands with full access — and zero visibility.
.env files on diskNot a roadmap item. Not a v2 feature. Every secret stored today is protected against harvest-now-decrypt-later attacks.
Transport uses a hybrid post-quantum KEM: X25519 for classical security + ML-KEM-768 (NIST FIPS 203) for quantum resistance. If either is broken, the other protects you. Zero X25519-only fallback. No downgrades.
TLS 1.3 X25519MLKEM768 · Pure Go · No CGOvault_run, vault_list_secrets, vault_secret_exists, and 5 more. Designed so AI agents can do their job without ever seeing secret values.
vault_runvault_list_secretsvault_secret_existsvault_create_secretvault_statusThe server stores ciphertext only. No decrypt endpoint. No key escrow. A compromised server exposes nothing.
ov includes mcp serve. One install. No version skew.
brew install opaquevault-brew/tap/ovUnlock, lock and browse from the menu bar. Names and metadata only — it spawns the same signed ov you already have and opens no sockets of its own.Desktop Lite docs →
get.opaquevault.com/desktopvault_run doesn't return the subprocess's stdout or stderr — they are never read into the response at all. Behind that, the interceptor scans every result the MCP tools do return and drops any that carries a secret pattern.
AKIAIOSFODNN7EXAMPLEEvery read, write, and delete. Secret references stored as HMAC hashes. The log proves access without revealing names.
ML-KEM-768 on transport means adversaries capturing your encrypted traffic today cannot decrypt it when quantum computers arrive.
my-saas / staging / DATABASE_URL. Secrets scoped by app and environment. No more manual prefixes. Drop a .ov.yaml in your repo — context is automatic.
Scoped API keys. Read-only CI tokens. One credential in GitHub secrets, all your real secrets behind zero-knowledge encryption.
Install, create an app, drop a .ov.yaml in your repo root, and connect to Claude Code. Every MCP tool call is automatically scoped to the right project — no flags needed. Prefer a menu bar?Desktop Lite unlocks the same agent on macOS.
brew install opaquevault-brew/tap/ov
ov auth login.ov.yamlov app create my-saas
ov env create production --app my-saas
echo "app: my-saas\nenv: production" > .ov.yamlov secret set DATABASE_URL
ov secret set OPENAI_API_KEY{
"mcpServers": {
"opaquevault": {
"command": "ov",
"args": ["mcp", "serve"]
}
}
}Secrets inject as env vars. Claude never sees values.
Zero-knowledge, MCP-native, quantum-safe — and the only one that namespaces secrets by app and environment out of the box.
| Feature | OpaqueVault | Infisical | Doppler | HashiCorp Vault |
|---|---|---|---|---|
| Zero-knowledge | ✓ | ✗ | ✗ | ✗ |
| Claude never sees plaintext | ✓ | ✗ | ✗ | ✗ |
| Quantum-safe (ML-KEM-768) | ✓ | ✗ | ✗ | ✗ |
| MCP server for coding agents | ✓ | ✓ | ✓ | ✗ |
| Value-safe MCP tools (no tool returns a secret) | ✓ | ✗ | ✗ | ✗ |
| Price | Free / $5/mo | Free + paid tiers | $6/mo+ | Self-hosted |
Infisical and Doppler's MCP integrations return secret values in tool responses, placing them in the model's context window. OpaqueVault structurally prevents this via the two-process model — no tool can return a value. Full breakdown (including a fair note on 1Password, which matches OpaqueVault on this axis) on the compare page.
Not on any normal path. Secret values are never placed in the AI's context, your chat history, logs, or .env files. The agent calls the vault_run MCP tool, which injects secrets as environment variables into the subprocess it runs and returns only the exit code and injection metadata — subprocess output goes to your terminal or the agent log, not back to the model — so the model orchestrates the command without the plaintext entering its context. A process you deliberately hand a secret to can of course still use it; OpaqueVault's job is to keep values off the AI's normal and accidental paths, which is where leaks actually happen.
Never. The server stores only ciphertext. Your Key Encryption Key (KEK) is derived from your master password with Argon2id and never leaves your machine. There is no decrypt endpoint and no key escrow — OpaqueVault staff cannot read your secrets, even if subpoenaed.
Yes. OpaqueVault is MCP-native. ov mcp serve is a local bridge that any Model Context Protocol client connects to — Claude Code, Cursor, GitHub Copilot, Windsurf, and others. One binary, any client.
Yes. Transport uses an ML-KEM-768 + X25519 hybrid, which resists “harvest-now, decrypt-later” attacks — where an adversary stores your encrypted traffic today to break it with a future quantum computer. Secrets at rest are sealed with AES-256-GCM.
A .env file leaves plaintext on disk where any tool — including your AI agent — can read it. Traditional managers still hand the value to whatever asks. OpaqueVault injects secrets only into the subprocess that needs them, at run time, and never exposes the value to the AI model. The vault is zero-knowledge, so even the server cannot read them.
Yes. The vault is free to start — 10 secrets, all 8 MCP tools, and the context interceptor included. And ov scan, the local secret scanner, is free forever with no account required.
Zero-knowledge. Quantum-safe. MCP-native.
Free to start. No credit card required.