The local vault
for AI agents.
Akasha intercepts sensitive data in agent tool calls and replaces it with
vault:// tokens. Secrets stay on your machine —
encrypted, post-quantum, fully audited.
$ akasha setup
Scanning for credentials...
✓ AWS default profile → vaulted
✓ AWS pk-website profile → vaulted
✓ SSH key id_ed25519 → vaulted
✓ Git token (gh) → vaulted
Key wrapped with ML-KEM-768 → OS keychain
Claude Code ready — restart it.Why Akasha
Secrets stay home.
Agents get tokens.
There is no unsafe way to use a credential the agent never holds.
Nothing leaves the machine
The vault is a local SQLite file encrypted with XChaCha20-Poly1305. The key lives in your OS keychain — never on disk, never in the cloud.
Credentials agents never hold
For git, GitHub and AWS the agent's tooling calls back through akasha helper per operation — the token reaches the tool, never the agent. vault_assume returns only a short-lived handle (0600, 1 hour TTL, RAM-backed); the raw secret never enters the context or the environment.
MCP-native, zero code
One command writes the MCP config. Claude Code, Codex and Cursor get vault_assume, vault_wrap and friends as native tools.
Every touch audited
Each wrap, retrieve and assume is logged with the tool, task, and the agent's reasoning trace — a forensic trail of everything agents touched.
Beneath the MCP stack
akasha exec injects vaulted credentials into other MCP servers at launch — your GitHub or Postgres server never holds a plaintext token in its config.
Cross-agent grants
Delegate over A2A without leaking: only tokens travel the wire, and grants are single-use, tool-restricted, and expire in minutes.
Integrate
Two lines from any agent.
Zero from Claude Code.
# The agent asks for AWS — and never sees the secret
vault_assume(provider="aws", profile="default")
→ {
"env": {
"AWS_SHARED_CREDENTIALS_FILE": "…/sessions/aws-default.creds", # RAM-backed
"AWS_PROFILE": "default"
},
"expires_at": "2026-06-11T15:02:11Z" # 1h TTL, audited
}from akasha import Akasha
vault = Akasha(agent_id="support-bot-v2", api_key="agt_…")
# Scan content before it reaches a tool or the LLM
result = vault.wrap("send_email", "card 4111111111111111")
# result.clean_content → "card vault://e4f5g6h7"
# Retrieve safely — zeroed after the block, tool enforced
with vault.use(result.token, tool="stripe_charge") as secret:
stripe.charge(secret.value)# Store anything discovery didn't find
$ akasha put env:stripe STRIPE_API_KEY
# Run any process with vaulted credentials injected
$ akasha exec --assume aws:default -- aws s3 ls
$ akasha exec --assume env:stripe -- ./charge.sh
# Tail the audit log
$ akasha logsBe the vault the other MCP servers run on
MCP servers can't see each other's traffic — but they all need credentials. Akasha sits beneath the stack: it brokers their secrets and records who used what, so nothing sits in plaintext in your config. For git and AWS the credential is resolved per operation; for a token-only server, it's injected at launch.
// Instead of a hardcoded token in your MCP config:
"github": {
"command": "akasha",
"args": ["exec", "--assume", "env:github",
"--", "github-mcp-server"]
}Plugins
Integrate any login as data.
No provider is compiled in. A login is a YAML file — a protocol, not a service.
Drop in a file, not a PR
AWS, GitHub, a bespoke internal API — each is a data-only plugin describing how a credential is shaped, discovered, delivered and brokered. The same git-credential-helper mechanism serves GitHub, GitLab and Bitbucket with no new code.
An untrusted plugin is inert until you approve it — a hash-bound
akasha template trust, or an Ed25519 signature from a publisher you trust.
# ~/.akasha/templates/datadog.yaml
kind: provider
name: datadog
credential:
fields:
api_key: {secret: true}
deliver:
- mode: env
env: {DD_API_KEY: "{api_key}"}Provenance
Know why, not just what.
Every audit entry captures the agent's task and reasoning — not just the access.
{
"token": "vault://abc12345",
"action": "VAULTED",
"category": "CreditCard",
"risk": "critical",
"agent_id": "support-bot-v2",
"tool_name": "send_email",
"task": "Process refund for order #8821",
"reasoning_trace": "User requested refund. Order verified. Initiating.",
"triggered_by": "user message: 'I want my money back'"
}Detection
Caught before it leaks.
Built-in patterns out of the box. Add your own in ~/.akasha/patterns.yaml.
| Category | Sample match | Risk |
|---|---|---|
| SSN | 429-21-0001 | critical |
| Credit card | 4111111111111111 | critical |
| API key (AWS) | AKIA… | critical |
| API key / password | sk-… / password: … | high |
| PII (email, phone) | user@example.com | medium |
| Risky tool watchlist | send_email, charge_card, … | varies |
Control
Use, don't read.
A local policy the daemon checks before any secret moves — allow, deny, or ask.
Brokered use, never raw reads
An agent uses a credential through the broker — git and AWS resolve it per operation, the token reaching the tool and never the model. Reading a raw secret into an agent's context is denied by default.
Rules match on agent, tool, provider, instance and risk; first match wins. An
ask pops a native, fail-closed approval — hold the risky handoffs for
a human, wave the routine ones through.
# ~/.akasha/policy.yaml — first match wins
rules:
# USE: brokered, per-operation → allow
- {action: retrieve, tool: akasha_helper, effect: allow}
# READ: raw secret into the agent → deny
- {action: retrieve, effect: deny}
# Delegating a high-risk secret onward → ask
- {action: grant, min_risk: high, effect: ask}Security