Secrets Manager

Store, distribute and rotate credentials without them landing in a file.

16 capabilities 1 sections reference specification

Build against it

# give your agent the catalog — no account, no install
claude mcp add provespec -- npx -y provespec-mcp

# then, from any agent session
spec_get(slug: "secrets-manager")                → the capability tree
spec_checklist(slug: "secrets-manager")          → the questions to answer
spec_grade(slug: "secrets-manager", grades: [...])  → parity % + the gap list

# or just fetch it
curl https://provespec.com/catalog/secrets-manager/spec.json

Grade every capability below as yes · partial · no · na, with a file reference as evidence. Whatever you leave ungraded counts as missing — the gap list is the work queue.

Or just paste this to your agent

Use the ProveSpec MCP server. Fetch the "secrets-manager" spec with
spec_get, then walk spec_checklist and grade this repository against it —
one verdict per capability, each with a file reference as the note.
Call spec_grade with the results and give me the gap list as the plan.

If the server is not registered, add it first:
  claude mcp add provespec -- npx -y provespec-mcp

The specification

AI 16

Storage

✓ Encrypted at rest with a separate key envelope encryption
✓ Versioned secrets with rollback
✓ Structured and binary secrets

Access

✓ Policy per identity and per path least privilege by default
✓ Short-lived credentials rather than static ones
✓ Machine identity via workload attestation not a bootstrap secret in a file

Rotation

✓ Scheduled rotation without downtime
✓ Dynamic credentials created per request and revoked on lease end
✓ Emergency revocation of a leaked secret

Distribution

✓ Injection into processes without writing to disk
✓ Client caching with a bounded TTL

Audit

✓ Every read and write logged with identity and time
✓ Tamper-evident audit log

Safety

✓ Secrets never appear in logs or error messages
✓ Sealed or locked state after restart until unsealed

Recovery

✓ Documented break-glass procedure and key shards

Download spec.json All 100 specs