A credential vault for agents and humans alike.

Authorized clients can list scoped credential metadata and request attributed leases through remote HTTP MCP. Client authentication and secret handling must match the deployment.

Requests return leases bound to the agent run id. The server enforces configured lease bounds. Expiry prevents later redemption; it does not invalidate a secret already returned.

Every access records which agent type, which user, which run, what justification. The audit log is append-only and survives tenant deletion so incident response has history to read.

The MCP read tool returns plaintext by default. Keeping it out of model context requires a client that implements credential-reference substitution; ordinary MCP support alone does not provide that isolation.

Scope credentials to specific agent types, not just users. A scoring agent that never needs production DB creds never gets asked about them.

A Manifest V3 extension for both browsers auto-fills usernames and passwords on the sites you log in to every day. Sign in once via identity OAuth in a popup; the extension reads stored `login` credentials over the same REST API your CLI uses.

Match is scheme-strict (HTTPS only by default), Punycode-normalized to defeat homograph attacks, and port-aware. Subdomain match is opt-in per credential. The fill button only appears when the URL passes every check.

Each fill issues and redeems a fresh single-use lease. The reviewed extension uses a 600-second redemption deadline, not a promise that a filled password expires. No persistent credential cache is part of this path.

Each fill writes lease.issued, lease.consumed, lease.read to the tamper-evident audit chain with the user attribution and a session correlation id. Indistinguishable from a CLI reveal or a manual web-ui copy.