Guides and reference for the age-encrypted, agent-safe secrets manager.
Values are always read from a TTY (no echo) or piped stdin — never passed as arguments.
All paths are overridable so the store can live in your dotfiles while the audit log stays local.
The store is one file, and it has always been fine to sync it however you like (a gitrepo, a dotfiles manager). arca sync replaces "however you like" with a first-classanswer: replication through any…
arca's distinguishing feature is a set of per-secret controls for putting a secret safely infront of an AI agent — constraining not just whether an agent can see a value, but how,how often, and for…
arca takes values on stdin, so anything that can emit secrets pipes straight in. There arethree ingest shapes:
arca is a file-based secrets broker you can safely put in front of an AI agent:
This document describes arca's design: the actors that interact with it, thecomponents they touch, and the actions that flow between them. It complements thetrust model and thethreat model.
This document records the security assessment performed on arca: the assets itprotects, who might attack them, the threats considered most likely andimpactful, and how each is addressed. It is a…