Automic Vault

Keychain-backed secrets

Tools get secrets. Agents do not.

Automic Vault patches critical tools so credentials can move out of plaintext files and into local protected storage. The tool can still do its job; the agent loses the easy read path.

• gh
• aws-cli
• av inject
• secret scanner

Human approval gates

Approval belongs beneath the agent, not inside it.

Built-in agent controls help, but a compromised agent controls its own policy surface. Automic Vault places gates at the local tool layer, where token export, package publishing, and other sensitive actions actually happen.

Nucleus package manager

Install the agent's tools into a root it cannot rewrite.

Nucleus installs Homebrew, npm, and PyPI packages with hardened roots. Agents can run approved tools without turning the whole developer environment into writable ambient state.

Plaintext exposure scan

Find what an agent can see before you start the run.

av secret-scanner searches for credentials that are already exposed in local files. Use it as a fast preflight before giving an autonomous run broad filesystem access.

Automic Vault.app

A native Mac surface for package control.

Search packages, inspect metadata, approve installs with Touch ID, follow updates, and use the av CLI when the terminal is the right interface.