$0 / month
For your first project and a better way to handle its secrets.
Start free ↗- 10 secrets
- 1 app
- MCP tools and context interceptor
- Audit log
- Zero-knowledge encryption
Simple by designYour first secret.
Your first secret.
Your next big thing.
Start free. Make room as you grow.
The same privacy boundary on Free and Solo.
$5 / month
For the projects you’re shipping, and the ones you haven’t started yet.
Get Solo ↗- Unlimited secrets
- Unlimited apps
- MCP tools and context interceptor
- Audit log
- Zero-knowledge encryption
Free local scanner
Start with a look around.
ov scan finds exposed credentials in your repository. It runs locally, with no account required.
The details
Privacy comes standard.
| Included in your vault | Free | Solo |
|---|---|---|
| Secrets | 10 secrets | Unlimited |
| Apps | 1 app | Unlimited |
| MCP tools and context interceptor | Included | Included |
| Audit log | Included | Included |
| Secret version history and rollback | Included | Included |
| Zero-knowledge encryption | Included | Included |
| Hybrid post-quantum transport | Included | Included |
| Local repository scanner | Free, no account | Free, no account |
| Community support | Included | Included |
Before you get started
A little more clarity.
Is the MCP interceptor included?
Yes. Both plans include the MCP context interceptor. It checks returned content for secret-shaped patterns as a defense-in-depth measure. The primary boundary is structural: OpaqueVault MCP tools do not return secret values, and vault_run omits subprocess output.
Does ov scan send my code anywhere?
The default scan runs locally without an account. The optional --verify flag checks findings with their vendor, and --fix stores findings in your vault. Consult the scanner documentation before enabling those network operations.
What happens when I reach the free limit?
You will be prompted to upgrade when creating secrets beyond the free plan limit. Your existing secrets remain available to read, update, and delete.
Can OpaqueVault decrypt my secrets?
The service stores encrypted secret values without the keys needed to decrypt them. Encryption and decryption happen locally. Account and operational metadata remain visible to the service.
A better boundary starts here