ak-vault

Opt-in, local-first, end-to-end encrypted sync for AgentKit secrets (ak secrets) between your trusted devices. The server stores ciphertext and a small, documented set of operational metadata; it never holds a key that can decrypt your secrets.

Landing page: https://vault.agentkit.best

Status

The current state of every surface (local vault, sync, dashboard, remote MCP) and its gate is on one page: docs/status.md.

• Design: Accepted by the owner (2026-10-16): ADR 0001.
• Security review: accepted by the owner (2026-10-16, owner instruction recorded by an agent on #8, no written findings). By owner decision the reviewer is the owner, not an independent third party.
• Sync is not generally available. Do not store production credentials in it. By owner decision on #8 the production sync API is live as a pre-release preview, enabled before the owner's review: any logged-in user running the preview ak secrets sync commands can sync to it. It is not independently reviewed and not yet recommended for production credentials. Open items are in the release gates.

AgentKit's local vault works without this service and without a network connection. Sync is off unless you turn it on.

Remote access (pre-release; on in production by owner decision, before its release gate): a browser dashboard at /app, where the browser is an enrolled device, and a remote MCP endpoint at /mcp for hosted AI tools. During a remote MCP call plaintext passes through Worker memory; it is never stored or logged (ADR 0002 D7). User steps are in the guide, operations in the runbooks.

Why

AgentKit vault v1 keeps secrets on one machine. Using them on a second device, and later in shared or CI vaults, needs sync that does not trust the server with the secrets, does not lose concurrent edits, and does not let a stale device bring back a deleted credential. The reasoning and the limits are in the ADR and the threat model.

What is in this repository

Path	Contents
docs/protocol/v1/spec.md	Normative protocol v1 wire spec
protocol/v1/vectors/	Deterministic test vectors shared by every implementation
packages/protocol/	TypeScript reference implementation
go/	Go implementation
worker/	Cloudflare Worker and per-vault SQLite Durable Object; worker/public/ is the landing page
docs/	Design, security and operations docs (index)

The AgentKit CLI and Desktop client live in bestagentkits/agentkit; account login and vault tokens in bestagentkits/ak-web.

Contributing

Requires Node 22+, pnpm (version pinned in package.json) and Go.

pnpm install
pnpm typecheck
pnpm test
pnpm build
cd go && go test ./...

Read AGENTS.md before starting: it covers the issue and label workflow, security rules, and what a spec change requires. Reviews follow REVIEW.md.

• Issues: https://github.com/bestagentkits/ak-vault/issues
• Epic: #1

Do not post exploit details or secrets in public issues. Report vulnerabilities privately through GitHub's private vulnerability reporting.

License

MIT