The Vault for AI Agents. Zero Keys. Agent Authority.
VYLTZERO gives autonomous AI agents delegated authority without static credentials. Agents prove who they are with workload identity, hold a short-lived session token, and reach APIs and MCP servers through a broker that injects the real key in flight — every call policy-checked and signed into the audit log. Underneath is a full self-hosted secrets platform: envelope encryption, transit, PKI, leases and multi-region replication.
No static keys in agents HTTP & MCP credential broker Vault-compatible API No plaintext at rest
Silent console tour (~2 min) — tenants, KV, transit, MFA, regions, audit, and how envelope encryption protects secrets if the vault disk walks away.
Built for autonomous AI agents
Agents act with authority, never with keys
A leaked transcript, a prompt-injected env | curl or a compromised container exposes only a session token — one that expires within the hour, works only through the broker, and only for the routes its policy allows.
Workload identity & Kubernetes auth
Agent pods log in with their service-account token, verified by a Kubernetes TokenReview. No API key is ever written into the pod, the image or the prompt.
Short-lived agent session tokens
Each agent gets a one-hour session token bound to its tenant, policies and principal. It expires on its own and revoking it stops it working immediately.
Centralised credential brokerage
Real API keys live in the vault under brokered/, readable only by the broker. The agent's own policy explicitly denies reading them, so it cannot exfiltrate what it never holds.
Transparent HTTP and MCP proxy
Point an SDK's base URL at the agent-proxy and put the session token where the key would go. The real credential is injected in flight; streamed responses and MCP servers just work.
Policy-driven delegated authority
Every route checks tenant, policy, principal, method and path. Upstreams must be HTTPS, redirects are never followed, and CONNECT tunnels are refused.
Auditable agent access
Allowed or denied, every brokered call lands in the signed, hash-chained audit log with the agent's identity, the route and the outcome.
Prove identity
Agent pod presents its Kubernetes service-account token.
/v1/auth/kubernetes/login
Get a session token
Short-lived, tenant- and policy-bound. Never a real key.
1 h · revocable
Call through the proxy
SDK base URL points at the agent-proxy route.
/r/anthropic
Broker injects the key
Checked against route rules, then the real key is attached.
allowed_policies
Signed audit
Principal, route and outcome — allowed or denied.
agent_proxy.request
agent pod — no real key inside
$ # the session token came from /v1/auth/kubernetes/login
$ export ANTHROPIC_BASE_URL=http://vyltzero-agent-proxy:8094/r/anthropic
$ export ANTHROPIC_API_KEY="$(cat /session/token)"# expires in 1h
$ claude-p"fix the flaky test"✓ brokered route=anthropic principal=agents:claude-coder audit=signed
$ vyltzero secret get brokered/anthropic# as the agent403 policy agent-claude denies brokered/**
Multi-platform
Works with your agents, clouds and clusters
One vault in front of the AI harnesses, identity providers, cloud secret stores and languages you already run. Items marked coming soon exist in the codebase and are not switched on yet.
AI agent harnesses
Claude Code
OpenAI Codex
Cursor
Gemini CLI
Model Context Protocol (/v1/mcp)
Any SDK with a base URL
Sign-in & identity
Kubernetes service accounts
API keys
OIDC device flow
LDAP
SCIM 2.0 provisioning
AWS IAM · Azure workload · mTLScoming soon
Secret sync
AWS Secrets Managersync live
HashiCorp Vaultsync live
Kubernetes Secretssync live
Azure Key Vaultcoming soon
GCP Secret Managercoming soon
SDKs, CLI & API
Go · Python · Rust · TypeScript
vyltzero CLI
Vault KV v2-compatible API
External Secrets Operator
Examples: Java · PHP · Node.js · Bash
Deploy
Helm chart
Kubernetes operator (CRDs)
Multi-region, active/active
Prometheus metrics
Self-hosted, Rust + PostgreSQL
The vault underneath
Everything a secret needs, behind one API
Static and dynamic secrets, encryption-as-a-service, a private CA, and the identity and policy layer to govern them — each engine sealed by the same per-tenant key hierarchy.
Versioned KV secrets
A Vault-compatible KV v2 engine: versioned reads and writes, check-and-set, soft-delete and destroy, per-path metadata — every value sealed before it touches disk.
Envelope encryption
AES-256-GCM with a per-tenant key hierarchy. Data keys are wrapped under a tenant KEK, which is wrapped under a root key held only by the crypto service.
Transit engine
Encryption as a service: encrypt, decrypt, sign and verify without the plaintext key ever leaving the vault. Keys rotate while old ciphertext stays readable.
PKI & certificates
Issue and manage a private CA, roles and short-lived certificates. CA private keys are envelope-encrypted under their own root, never stored in the clear.
Dynamic leases
Every credential is a lease: issued, listed, renewed and revoked for real. Revoking a token stops it working immediately, not just flips a row.
Two-factor auth & identity
Self-service TOTP two-factor with recovery codes, over fine-grained policies on API keys and JWTs — plus Kubernetes, OIDC device-flow and LDAP sign-in and SCIM provisioning. Identity comes from a signed, per-tenant token, never a header.
Active / active by design
Two regions, one mesh
Each region is a complete, independent stack — its own database, its own services, its own public hostname. They share nothing at runtime but key material, and each region’s agent pulls the other’s changes over the public edge.
Region A
manchester · active
Own PostgreSQL, node-local storage
Full service set, sealed at rest
Serves its own public endpoint
encrypted replication
Region B
london · active
Byte-identical key material
Reads secrets written anywhere
Fails over as a PoP-side change
vyltzero — kv
$ vyltzero init
✓ wrote ~/.vyltzero/config.toml tenant=acme region=manchester
$ vyltzero secret put prod/db/creds-d password=s3cr3t✓ sealed with dek 01a0…93a7 version=1
$ vyltzero secret get prod/db/creds--profile london
# same secret, decrypted in the peer region
password = s3cr3treplication_lag=14ms
Security model
Encrypted where it matters, provable after the fact
The vault fails closed. Keys are wrapped, custody can be split, and every action is signed into a chain you can verify.
Signed, tamper-evident audit
Every operation joins a per-tenant hash chain signed with a dedicated key — a record cannot be altered or removed without breaking the chain.
Shamir-split custody
The root key can be split into Shamir shares so no single operator can unseal the vault alone. It starts sealed and stays sealed until a quorum agrees.
Tenant isolation to the key layer
A data key belongs to exactly one tenant; a cross-tenant request returns “not found” rather than another tenant’s data. Isolation holds even at the crypto service.
Zero plaintext at rest
Secrets, transit keys and CA material are all encrypted before storage. A database dump yields ciphertext wrapped under keys the database never sees.
Self-hosted & open source
Give your agents authority, not keys
Clone the repo, install the Helm chart and unseal. The getting-started guide takes you from an empty cluster to your first sealed secret; the agent-proxy guide gets your first agent brokered.