ak-vault
Opt-in, local-first, end-to-end encrypted sync for AgentKit secrets (ak secrets)
between your trusted devices. The server stores ciphertext and a small, documented
set of operational metadata; it never holds a key that can decrypt your secrets.
Landing page: https://vault.agentkit.best
Status
The current state of every surface (local vault, sync, dashboard, remote MCP) and
its gate is on one page: docs/status.md.
- Design: Accepted by the owner (2026-10-16):
ADR 0001.
- Security review: accepted by the owner (2026-10-16, owner instruction recorded
by an agent on #8, no written findings). By owner decision the reviewer is
the owner, not an independent third party.
- Sync is not generally available. Do not store production credentials in it.
By owner decision on #8 the production sync API is live as a pre-release
preview, enabled before the owner's review: any logged-in user running the preview
ak secrets sync commands can sync to it. It is not independently reviewed and not
yet recommended for production credentials. Open items are in the
release gates.
AgentKit's local vault works without this service and without a network
connection. Sync is off unless you turn it on.
Remote access (pre-release; on in production by owner decision, before its release gate): a
browser dashboard at /app, where the browser is an enrolled device, and a remote
MCP endpoint at /mcp for hosted AI tools. During a remote MCP call plaintext passes
through Worker memory; it is never stored or logged
(ADR 0002 D7). User steps
are in the guide, operations in the
runbooks.
Why
AgentKit vault v1 keeps secrets on one machine. Using them on a second device, and
later in shared or CI vaults, needs sync that does not trust the server with the
secrets, does not lose concurrent edits, and does not let a stale device bring back
a deleted credential. The reasoning and the limits are in the
ADR and the
threat model.
What is in this repository
| Path | Contents |
|---|
docs/protocol/v1/spec.md | Normative protocol v1 wire spec |
protocol/v1/vectors/ | Deterministic test vectors shared by every implementation |
packages/protocol/ | TypeScript reference implementation |
go/ | Go implementation |
worker/ | Cloudflare Worker and per-vault SQLite Durable Object; worker/public/ is the landing page |
docs/ | Design, security and operations docs (index) |
The AgentKit CLI and Desktop client live in
bestagentkits/agentkit; account
login and vault tokens in bestagentkits/ak-web.
Contributing
Requires Node 22+, pnpm (version pinned in package.json) and Go.
pnpm install
pnpm typecheck
pnpm test
pnpm build
cd go && go test ./...
Read AGENTS.md before starting: it covers the issue and label
workflow, security rules, and what a spec change requires. Reviews follow
REVIEW.md.
Do not post exploit details or secrets in public issues. Report vulnerabilities
privately through GitHub's
private vulnerability reporting.
License
MIT
