{
  "name": "Automic Vault",
  "category": "Local execution security and secrets management",
  "platform": "macOS",
  "license": "Apache License 2.0",
  "title": "Your secrets manager should know what the secrets do.",
  "description": "Automic Vault checks the complete operation before applying a developer credential.",
  "difference": {
    "conventional_model": "Check an identity and Secret Name before returning the stored value.",
    "automic_vault_model": "Check the complete operation before applying requested Secrets.",
    "request_inputs": [
      "Verified Launcher",
      "Tool",
      "Target",
      "command and arguments",
      "working directory",
      "Secret Names",
      "selected Secret Value sources"
    ],
    "boundary": "Automic Vault controls Secret Application. The Target controls a Secret after receipt."
  },
  "operation_example": [
    {"command": "gh issue list", "policy": "Read Only", "decision": "automically authorized", "classification": "recognized read"},
    {"command": "gh issue create", "policy": "Read Only", "decision": "Approval required", "classification": "recognized write"},
    {"command": "gh auth token", "policy": "Read Only", "decision": "Approval required", "classification": "Secret Disclosure"}
  ],
  "features": {
    "project_values": "One Secret Name can select the nearest Project Value for the physical working directory, then a Global Value.",
    "temporary_access_grants": "Eligible agent tasks can receive visible, in-memory ten-minute write authority for one Verified Launcher and Tool-specific gate.",
    "iphone_approval": "An optional iPhone app can carry every human Approval for an enrolled Mac while the Mac remains the Local Execution Boundary.",
    "blessed_scripts": "Blessings bind an exact path, contents, Secret Names, and declared Tool capabilities.",
    "launcher_bundles": "Exact single-file Mach-O CLI snapshots can be signed, installed root-owned, enrolled, and revalidated on every request.",
    "aws": "Normal AWS invocations receive short-lived STS credentials from a native helper.",
    "docker": "Credential release verifies the live vendor-signed Docker process, ancestry, arguments, and requested registry.",
    "homebrew": "Execution policy separates reads and update from installs and upgrades.",
    "detection": "Over 100 supported developer configurations are checked for Exposures and Hazards.",
    "authorization_history": "Allowed and denied requests leave bounded local history."
  },
  "security_boundaries": [
    "Automic Vault does not intercept every process or replace the shell.",
    "Automic Vault does not prevent arbitrary local destruction.",
    "Automic Vault does not contain root or kernel compromise.",
    "Code signing proves identity and integrity, not intent.",
    "A Target can leak a Secret after receiving it.",
    "iPhone Approval has no Mac allow fallback; an unavailable phone or relay leaves the request waiting for its Gate Client to cancel.",
    "iPhone Mirroring and Show on Mac can expose Approval controls when per-device biometrics are disabled.",
    "Project Directories and agent task identifiers are not authorization identities.",
    "Authorization History is not tamperproof or audit-complete."
  ],
  "primary_action": {
    "label": "Download for macOS",
    "url": "https://www.automicvault.com/Automic%20Vault.dmg"
  },
  "founder": "Max Howell, creator of Homebrew",
  "url": "https://www.automicvault.com/",
  "source": "https://github.com/automic-vault/automic-vault",
  "docs": "https://www.automicvault.com/docs/",
  "security": "https://github.com/automic-vault/automic-vault/security",
  "pricing": "Free open-source software"
}