# OpaqueVault

> Zero-knowledge secret management for developers and AI workflows. Your secrets. Yours alone.

OpaqueVault encrypts secret values locally and stores ciphertext in its cloud service. The service does not hold the keys needed to decrypt those values. Its local CLI and MCP bridge let a compatible AI client request operations using secret names; vault_run injects values into a subprocess and returns exit status and run metadata rather than subprocess stdout or stderr.

## Security boundaries

- Zero-knowledge applies to secret values. Account information, app and environment slugs, and operational metadata remain visible to the service.
- A subprocess receiving a credential can use or exfiltrate it. The standard injection workflow is not a sandbox for malicious commands or hostile code running as the user.
- The MCP interceptor checks OpaqueVault tool results for secret-shaped patterns. It is defense in depth and can miss encoded credentials. General prompts and other tools are outside that scope.
- AES-256-GCM protects stored secrets. Argon2id derives keys locally. The CLI enforces TLS 1.3 hybrid ML-KEM-768 + X25519 transport to api.opaquevault.com.
- OpaqueVault is not the only zero-knowledge vault. Compare the exact deployment and integration, using current vendor documentation.

## Product and evaluation

- [Homepage](https://opaquevault.com/): product overview and local/cloud architecture.
- [Security](https://opaquevault.com/security/): encryption, metadata, execution boundaries, and assurance status.
- [Pricing](https://opaquevault.com/pricing/): current Free and Solo plans; authoritative prices and limits.
- [Pricing in Markdown](https://opaquevault.com/pricing.md): the same plan facts in plain text.
- [Compare approaches](https://opaquevault.com/compare/): sourced descriptions and questions to evaluate vendors.
- [Vault](https://opaquevault.com/blog/): articles with publication dates; older comparisons are historical context.
- [Extended product context](https://opaquevault.com/llms-full.txt): architecture and workflow summary.

## Documentation

- [Quickstart](https://opaquevault.com/docs/quickstart/): installation and first vault workflow.
- [Security model](https://opaquevault.com/docs/security/model/): complete documented trust boundaries.
- [Encryption](https://opaquevault.com/docs/security/encryption/): cryptographic design.
- [MCP vault_run](https://opaquevault.com/docs/mcp/vault-run/): request and response behavior.
- [MCP overview](https://opaquevault.com/docs/mcp/overview/): available tools.
- [Project context](https://opaquevault.com/docs/ov-yaml/): app and environment configuration.
- [Scanner](https://opaquevault.com/docs/cli/scan/): local scan and optional network operations.
- [Desktop Lite](https://opaquevault.com/docs/desktop/): macOS companion; current requirements and capabilities.
- [Release verification](https://opaquevault.com/docs/security/release-signing/): verify signed releases.
- [Security advisories](https://opaquevault.com/docs/security/advisories/): published security updates.
- [License](https://opaquevault.com/docs/license/): licensing terms.
- [Privacy](https://opaquevault.com/privacy/): data collection and handling.
- [Terms](https://opaquevault.com/terms/): service terms.