01
AES-256-GCM at rest
Every secret value is encrypted with a per-tenant key derived from VAULT_MASTER_KEY. Versioned + hashed for rotation tracking.
AES-256-GCM encrypted secrets with .env/Doppler import, a token-authed env-injection CLI, and an AI-agent reference endpoint that lets agents see keys without ever seeing values.
Agents see keys, not values. Toggle agentReference on any secret so AI agents can discover it exists without being able to read it.
$ ms-vault run --token $VAULT_TOKEN \
--project proj_abc \
-- npm start
{
"DATABASE_URL": "postgres://…",
"STRIPE_SECRET_KEY": "sk_live_…",
"OPENAI_API_KEY": "sk-…"
}200 OK · decrypted into child env
Standard Vault is an encrypted secrets manager designed for the AI-agent era. Store production secrets with AES-256-GCM, inject them into subprocess environments via a token-authed CLI shim, import from .env or Doppler JSON, and expose a reference endpoint that tells AI agents what keys exist without leaking values — so an agent can ask 'does this project have a STRIPE_SECRET_KEY?' without ever being able to exfiltrate it.
Every secret value is encrypted with a per-tenant key derived from VAULT_MASTER_KEY. Versioned + hashed for rotation tracking.
ms-vault run --project X --token Y -- npm start injects decrypted secrets into the child process env — never written to disk.
Paste a .env file or Doppler JSON payload to bulk-import secrets. Comments become notes. Quotes stripped.
Per-secret flag exposes key + version (never value) at /api/projects/{id}/references — share with agents safely.
Mint short-lived or long-lived tokens scoped to a single project. Revoke any time. Last-used tracking.
Every create, rotate, delete, decrypt, and token mint is logged with actor + metadata.
Start free. Upgrade when you outgrow limits or want to remove the powered-by badge.
1 project · 25 secrets · agent reference
Unlimited projects · tokens · audit log
Three focused products, one portfolio. Each app is built to spread your brand while solving one job extremely well.
Open Dashboard| Feature | Spreadsheets | Generic SaaS | Market Standard Market Standard |
|---|---|---|---|
| Purpose-built for the workflow | No | Partial | Yes |
| Free tier with no credit card | — | Sometimes | Yes |
| Open schema (Postgres + Drizzle) | No | No | Yes |
| Viral powered-by badge on free tier | No | No | Yes |
| Cross-sells into the rest of the suite | No | No | Yes |
| Self-hostable source-available code | No | No | Yes |
Everything you need to know before signing up.