Store encrypted secrets. Inject them into subprocesses.
Claude Code, Cursor, Copilot — the AI never sees the values.
23.8M secrets leaked on GitHub in 2024 — up 25% year over year. Repos using AI coding assistants leaked at a rate 40% higher than those without.
Your AI coding assistant needs database credentials, API keys, and tokens to run tests, deploy code, and call services. But every secret you paste into Claude Code or Cursor lives in the model's context window, flows through Anthropic's API, and may be logged anywhere along the way.
Existing secret managers weren't built for AI agents. OpaqueVault was.
Source: GitGuardian State of Secrets Sprawl 2025
Run ov scan in any repo. No signup. No telemetry.
It walks your git-tracked files and surfaces secrets you may not know are there —
AWS keys, Stripe tokens, private keys, connection strings, high-entropy blobs.
Every project has a DATABASE_URL. OpaqueVault scopes secrets
by app and environment — so they never collide and you never need
MYSAAS_PROD_DATABASE_URL again.
.ov.yaml# .ov.yaml — commit this file, it has no secrets
app: my-saas
env: stagingDrop this in your repo root. Every ov command and ov mcp serve picks up the context automatically.
Decryption happens locally on your machine. The cloud stores only ciphertext.
.ov.yaml sets the context
A two-line file in your repo root — app: my-saas, env: staging —
tells ov mcp serve which project and environment to operate in.
No flags. No ambient ambiguity.
vault_runClaude Code calls the MCP tool with a command and secret names. The bridge already knows which app and environment to pull from — Claude never needs to specify them.
ov mcp serve fetches the encrypted blob for that app + environment,
decrypts locally with your KEK, and spawns the subprocess with the secret as an env var.
The value is zeroed from memory after use.
The MCP response contains stdout, stderr, and exit code. The plaintext secret value is never in the response. Ever.
Store secrets with the CLI. Reference them from Claude Code. Your AI agent runs commands with full access — and zero visibility.
.env files on disk Not a roadmap item. Not a v2 feature. Every secret stored today is protected against harvest-now-decrypt-later attacks.
Transport uses a hybrid post-quantum KEM: X25519 for classical security + ML-KEM-768 (NIST FIPS 203) for quantum resistance. If either is broken, the other protects you. Zero X25519-only fallback. No downgrades.
Powered by cloudflare/circl · Pure Go · No CGO vault_run, vault_inject_env, vault_list_secrets,
and 4 more. Designed so AI agents can do their job without ever seeing secret values.
vault_run vault_inject_env vault_list_secrets vault_create_secret vault_status The server stores ciphertext only. No decrypt endpoint. No key escrow. A compromised server exposes nothing.
ov includes mcp serve. One install. No version skew.
brew install opaquevault-brew/tap/ov ov mcp serve sits between Claude and everything else. If a raw secret
slips into context — accidentally pasted AWS key, leaked token in a stack trace —
the interceptor blocks it before the model ever sees it.
AKIAIOSFODNN7EXAMPLE ov secret set instead Every read, write, delete — and every interception. Secret references stored as HMAC hashes. The log proves access without revealing names.
ML-KEM-768 on transport means adversaries capturing your encrypted traffic today cannot decrypt it when quantum computers arrive.
my-saas / staging / DATABASE_URL. Secrets scoped by app and environment.
No more manual prefixes. Drop a .ov.yaml in your repo — context is automatic.
Scoped API keys. Read-only CI tokens. One credential in GitHub secrets, all your real secrets behind zero-knowledge encryption.
Install, create an app, drop a .ov.yaml in your repo root,
and connect to Claude Code. Every MCP tool call is automatically scoped
to the right project — no flags needed.
brew install opaquevault-brew/tap/ov
ov login.ov.yamlov app create my-saas
ov env create production --app my-saas
echo "app: my-saas\nenv: production" > .ov.yamlov secret set DATABASE_URL
ov secret set OPENAI_API_KEY{
"mcpServers": {
"opaquevault": {
"command": "ov",
"args": ["mcp", "serve"]
}
}
}Secrets inject as env vars. Claude never sees values.
Zero-knowledge, MCP-native, quantum-safe — and the only one that namespaces secrets by app and environment out of the box.
| Feature | OpaqueVault | 1Password MCP | Doppler | HashiCorp Vault |
|---|---|---|---|---|
| Zero-knowledge | ✓ | ✗ | ✗ | ✗ |
| Claude never sees plaintext | ✓ | ✗ | ✗ | ✗ |
| Quantum-safe (ML-KEM-768) | ✓ | ✗ | ✗ | ✗ |
| MCP-native | ✓ | Partial | ✗ | ✗ |
| Multi-app namespacing | ✓ | ✗ | Partial | Partial |
| Price | Free / $9mo | $3/mo+ | $6/mo+ | Self-hosted |
1Password MCP returns plaintext values in MCP responses, making them visible in Claude's context window. OpaqueVault structurally prevents this via the two-process model.
Zero-knowledge. Quantum-safe. MCP-native.
Free to start. No credit card required.