rutilev1.4.0

Secrets for AI agents:
scoped, local, auditable.

GitHub
gold needles, sealed in quartz.
age-encrypted
policy-scoped
audited
MCP-native
~/work/api: rutile session
vault: sealed · audit: on
*what the policy engine does

01: policy is a file

policy.yaml
rules:
- agent: claude
  pattern: "dev/**"
  expires_at: 18:42
  one_time: false

everything else: denied by default · reviewable in git

02: avoid direct broker disclosure

agent sees$STRIPE_KEYthe name
process gets••••••••••••injected at exec
caveatchild outputcan still expose env

$ rutile run -e STRIPE_KEY=dev/stripe/sk_test -- ./deploy.sh

03: scope shrinks down the chain

orchestratordev/** · 1h
└─coder-agentdev/api/** · 20m
×further delegationblocked · depth 1

child ⊆ parent, always · revoke the parent and every child stops working

*included: one binary, no cloud service
default-deny policyper-agent globs · --for ttl · --one-time burns after first read
human-in-the-loopa denied agent files a request; you run: rutile approve <id>
sub-agent delegationchild = its patterns ∩ parent policy · ttl ≤ 24h · dies with parent
context-minimizing runenv injection avoids direct broker disclosure · child output still matters
tamper-evident audithash-chained log: who, what, when, why · verify offline
key rotationfresh age identity, crash-safe re-encrypt of the whole store
token hygieneevery token: --type · --expires 30d · --local-only
network hardeningTLS · mTLS client certs · SPIFFE IDs · per-IP rate limit
system modedaemon under a dedicated uid · kernel peer-cred checks
git versioningevery change auto-committed · rutile git push to sync
one-shot migrationrutile import pass / passage / .env
zero ceremonydaemon self-spawns · unlock on demand · auto-lock after 30m
*MCP tools available to agents; full contract in AGENTS.md
get_secretread a value; `reason` lands in the audit log
list_secretsonly the paths this agent may see
request_accessask the human, never retry-loop
delegate_accessmint a scoped sub-token for a helper
store_statuslocked? how many secrets visible?
*works where your agents work
mcp · stdioclaude codeclaude desktopcursorwindsurfzedcline / roo codecontinue
mcp · httpopenai agents sdklangchain / langgraphcrewaiautogencustom orchestratorsbearer or mTLS/SPIFFE
runs onmacoslinuxdockersystemd / launchdgithub actionsone static binary
no mcp at all?any process:rutile run -e KEY=path -- cmdbroker need not return the value
hash-chained audit log
tamper-evident, verifiable offline
one static binary · no cloud service
your machine or your host: TLS, mTLS, SPIFFE
honest threat model
read SECURITY.md