Opaque is a local approval-gated secrets broker for AI coding tools. LLMs get operations — never plaintext values.
curl -fsSL https://opaque.dev/install.sh | shMost secret-consuming workflows are write-only from the agent's perspective. Agents don't need plaintext — they just need to request the operation.
Environment variables and config files expose secrets directly to LLM context windows. One hallucination away from leaking credentials.
AI agents act on secrets without human confirmation. There's no biometric check, no intent dialog — just blind trust in a probabilistic model.
When something goes wrong, there's no record of which agent accessed what secret, when, or why. Incident response starts from zero.
Every operation passes through a strict five-stage pipeline enforced by Rust's type system. There are no shortcuts.
Deny-by-default engine evaluates allowlist rules matching on operation name, client identity, and target fields.
Touch ID on macOS or polkit on Linux. Real biometric or password confirmation for every sensitive operation.
Operations run inside a trusted daemon. Secrets are resolved from providers and used — but never returned to the caller.
Rust's type system guarantees only sanitized responses can reach clients. Regex-based scrubbing adds defense in depth.
Every operation is logged to SQLite with correlation IDs, full-text search, and real-time streaming via SSE.
# Deny-by-default: only listed operations are allowed
[[rules]]
name = "Allow GitHub secret sync"
operations = ["github.set_secret", "github.list_secrets"]
clients = ["claude-code"]
effect = "allow"
approval = "biometric"
[[rules]]
name = "Allow Vault reads"
operations = ["vault.get_secret"]
clients = ["*"]
effect = "allow"
approval = "lease"
lease_ttl = 300Every feature exists to keep secrets out of LLM context while maximizing agent capabilities.
Rust's type system makes it a compile-time error to return unsanitized responses. Not a convention — a guarantee.
Native OS approval for every sensitive operation. Touch ID on macOS, polkit on Linux. Real biometric trust.
First-class Model Context Protocol server. Claude Code sees Opaque operations as native tools — zero configuration.
Approve once, reuse the lease. Prevents approval fatigue without compromising security. Configurable TTL per rule.
Every operation logged to SQLite with correlation IDs and full-text search. Live streaming via Server-Sent Events.
Unix peer credentials + executable SHA-256 hash + optional macOS Team ID. Know exactly which process is asking.
Opaque connects to the providers you already use. Resolve secrets from any source with a unified reference scheme.
Plus macOS Keychain · Linux secret-tool · Environment variables · Execution profiles
Agents invoke named operations with safety classifications. The daemon resolves secrets internally and returns only sanitized results.
| Operation | Provider | Description | Safety |
|---|---|---|---|
| github.set_secret | GitHub | Set an Actions, Codespaces, or Dependabot secret | Sensitive |
| github.list_secrets | GitHub | List secret names (never values) for a repository | Safe |
| gitlab.set_variable | GitLab | Set a CI/CD variable with full options (protected, masked) | Sensitive |
| vault.get_secret | Vault | Read a KV v1/v2 secret with lease-aware caching | Sensitive |
| vault.put_secret | Vault | Write a secret to Vault KV store | Dangerous |
| onepassword.get_item | 1Password | Retrieve an item from a 1Password vault | Sensitive |
| bitwarden.get_secret | Bitwarden | Fetch a secret via Bitwarden Secrets Manager | Sensitive |
| sandbox.exec | System | Execute a command with injected secrets in a sandbox | Dangerous |
| test.noop | System | No-op for testing the pipeline end-to-end | Safe |
“AI coding tools and strong security
are not at odds.”
The Opaque Manifesto
Single-line install script, or build from source with cargo install.
Run opaque init to generate a policy file and set up your first provider.
Add the MCP server to Claude Code. Agent tools appear automatically.
# Install Opaque
$ curl -fsSL https://opaque.dev/install.sh | sh
# Initialize configuration
$ opaque init
Creating ~/.opaque/config.toml...
Generating web dashboard token...
Done! Run `opaqued` to start the daemon.
# Start the daemon
$ opaqued
Listening on /tmp/opaque.sock
Web dashboard: http://127.0.0.1:7380
Policy loaded: 3 rules, 0 warnings
# Add to Claude Code
$ opaque mcp install
MCP server registered with Claude Code
Available tools: 9 operationsOpen source under Apache-2.0. Works on macOS and Linux. Built with Rust.