PORTUNUS
A secret broker, not a secret leak

Your agents ask for a secret by name.
They never see the value.

Portunus is a standalone, boundary-only secret broker. Reference {{secret:stripe-key}} by metadata — Portunus resolves and injects the real value only at the actual execution boundary. It is structurally incapable of returning a value into an LLM or agent context.

Get started View on GitHub Desktop app (macOS)
Portunus key mark

Three names, one rule

Every component is named for what it actually does — Roman gatekeeping, not marketing. The rule underneath all three: a plaintext value only ever exists at the one boundary call that needs it, and is never returned, logged, or printed anywhere upstream of that.

Ostiarius

The gatekeeper

One implementation, three entry points — the CLI, the standalone UI's API routes, and an MCP server so any agent/harness can query and inject without a second privileged path to keep in sync.

Arca

The vault

Pluggable backends, chosen per reference or per project — local-encrypted and GCP Secret Manager are real today; AWS, Vault, Infisical, Doppler, 1Password, and Azure are honest stubs with a one-click request link, never a silent mis-route.

Petitio

The gate check

Every request passes an approval gate before Arca ever gives up a value — lifecycle state, time-boxed approvals, and a tamper-evident audit chain recording every decision, allowed or denied.

agent asks for {{secret:X}} → Ostiarius → Petitio checks → ✗ denied, no value ever released
agent asks for {{secret:X}} → Ostiarius → Petitio allows → Arca fetches → injected at the boundary — env var, file, or exec argv → agent gets a success signal, never the value

Install

Run it as a CLI/MCP tool, a local web UI, or a native macOS menu-bar app.

# CLI + MCP server + agent skills, one shot curl -fsSL https://mdostal.github.io/portunus/install.sh | bash portunus reg add my-secret sm-my-secret --project my-proj portunus resolve "Authorization: Bearer {{secret:my-secret}}"
# standalone Vault UI git clone https://github.com/mdostal/portunus cd portunus/ui && npm install && npm run dev
# macOS desktop app — menu-bar, self-updating cd ui && npm run build && cargo tauri build cp -r src-tauri/target/release/bundle/macos/Portunus.app /Applications/ open /Applications/Portunus.app

Full docs, MCP tool reference, and architecture diagrams live in the README and docs/architecture.md.

Support this project

Free and open source, always. A few ways to help — or just say hi.