SPEC SHEET · 01Sheet 1 of 1
A local broker that holds your secrets in one encrypted vault and hands them to apps and coding agents when needed, only inside the project boundary, only for the window you allow, and never as a value the agent can see.
Vault1 fileArgon2id · AEAD
Audit logchained HMACappend-only
resolves
at exec
haspbrokerv1.0 · daemon
redacts
11 enc.
AgentMCP / CLI6 first-class
Applauncher on PATHenv · file · dotenv
Plaintext pathonly inside the brokered child process
Cleartext at restnever. memory only while unlocked
Spec 01
11enc
Raw, base64-std, base64-url, base32, hex (lower & upper), URL-encoded, JSON-escaped, HTML entity, double-percent, Unicode escape. Marker tokens preserve line counts.
Spec 02
24h
Once · session · window. Window accepts durations like 15m or 1h. The 24-hour ceiling is enforced inside the daemon. No policy can lift it.
Spec 03
6+1
claude-code, codex-cli, cursor, aider, hermes, openclaw. A generic profile covers anything else that speaks MCP or runs a CLI.
Spec 04
0cloud
No account. No control plane. Telemetry stays off unless you explicitly opt in. Works on a plane, in a SCIF, on a laptop with no network. Source-available critical path. Signed release with SBOM & SLSA.
Noun 01
One personal encrypted local store under your home directory. Argon2id with memory-hard parameters (64 MB · 3 iterations · 4 lanes). AEAD encryption at rest. All your secrets live here once.
Noun 02
Normal applications you connect to the vault: your dev server, your data tool, your CLI. After connecting, you launch them by name and the right values are present. Three delivery modes: env var, temp file 0600, temp dotenv outside the repo.
Noun 03
Coding agents you connect to the vault. After connecting, the agent works through hasp instead of around it. MCP tool surface returns references and metadata, not values. The agent never reads the value.
Setup is explicit, once. Runtime is invisible, every time after.
01 · System model
HASP stays small on purpose: secrets live in one encrypted vault, repo roots define where they may be used, repo targets choose the workflow subset, apps and agents connect once, and short-lived grants deliver values only to a specific brokered run.
Vault
Encrypted local store of named secrets under HASP_HOME.
Repo
A bound project root plus optional value-free targets for workflow-specific delivery.
Agent
A connected app or coding agent that gets brokered access.
Grant
Short-lived, scoped permission to deliver a secret to one run.
Start and prove
Guided setup, repo bootstrap, first vault creation, health diagnosis, and the brokered first-proof check.
setup``bootstrap``init``doctor``proof
Keep secrets named
Add, import, capture, update, reveal, copy, expose, and hide values without turning them into loose project files.
secret``import``set``capture
Bind the repo edge
Project roots become policy boundaries. Inspect requirements, list targets, adopt repos, unbind stale ones, and scan for leaked managed values.
project``check-repo
Run without revealing
Resolve env and file refs at exec time, or expand a manifest target. Convenience env files exist, but only as an explicit operator request.
run``inject``write-env
Apps and agents
Connect app profiles and coding-agent profiles once. MCP and CLI surfaces return references and metadata, not secret values.
app``agent``mcp
Lock, backup, restore
Lock session material, export encrypted backups, and restore a vault without making recovery a plaintext workflow.
vault``export-backup``restore-backup
Runtime and grants
Start or inspect the daemon, open or revoke broker sessions, check reachability, and see current vault and daemon state.
daemon``session``status``ping
Evidence and maintenance
Print audit history, upgrade signed releases, generate completions and docs, report versions, and keep the deprecated TUI path visible.
audit``upgrade``completion``docs``version``tui
Mechanism
What it actually does
What you stop having to think about
Brokered runhasp run · hasp inject
Secrets injected into the child process at exec. The agent never enters the value into its context window or any readable surface.
You let the agent run while you make coffee, take a meeting, or sleep.
Process-tree-bound grantonce · session · window
Only the process tree the agent launched can use the grant. Hard 24-hour ceiling no policy can lift.
One bad day stops being a permanent breach.
Repo guardrailsscan · pre-commit · pre-push · deploy wrapper
Managed values are caught before they reach a commit, a push, or a deploy. Audited override for the rare case you need to ship a flagged file.
You let the agent edit files without proofreading every diff like a hawk.
Streaming redactoracross 11 encodings
Every encoded form of every managed value is masked in real time. Markers preserve line counts so logs still parse.
The traceback you copy-pasted into Slack is safe to send.
One vault, many appslauncher on PATH
After hasp app connect , you type . Rotation is one operation, not a search-and-replace.
You get back the half hour you lost every time you booted a project.
Append-only auditchained-hash HMAC
Every grant, reveal, and brokered run lands in a tamper-evident local log you own. Verify the chain. Package an evidence bundle.
"Did the agent touch the prod token?" gets answered in three seconds.
Fail-closed everywhereno silent downgrade
If the broker cannot enforce the rule, it refuses the operation. Failed safe injection does not fall back to writing an env file.
You stop carrying the suspicion that the tool you trust is lying in small ways.
9s_nine seconds_
A coding agent powered by a frontier model deleted a production database and its volume backups, on a single API call, after finding a credential in an unrelated file.
2_npm_
A second-tier disclosure: a popular coding agent's settings file silently records environment variables and ships them inside published npm packages.
1_line_
A third disclosure: a one-line command-injection bug in another agent lets a crafted repository steal the developer's active model API key on clone-and-open.
$82k_cloud bill_
A developer woke up to an $82,000 cloud bill on a project that normally spent $180/month after a leaked key was harvested and wrung out in a cryptomining loop.
28.6M_2025 leaks_
GitGuardian counted 28.6 million new secrets exposed in public commits across 2025. AI-coding repos: 40% more likely to leak than the rest.
$2M_asking price_
A supply-chain attack on an AI infrastructure provider exposed internal env vars and a database key, both reportedly listed for sale at $2M.
"…"classic risk
Prompt injection gets attention because it's novel, but stolen credentials are a classic attack with way higher impact.
Security community thread
Vignette 01Pre-push
The agent rewrote a config file. You said yes. Three commits later you push and CI emails the team to say a Stripe key just landed in the diff.
Pre-push hook caught it before it left the laptop. The redactor would have caught it in the agent's own output if it had ever printed it.
Vignette 02Catastrophic
The agent finds a credential in a file you forgot was on disk. The token is over-scoped because nobody had time to fix it last quarter. The agent decides the cleanest fix is destructive, and the database and its volume backups are gone before your push notification arrives.
The credential never lived loose on disk. It lived in the vault. The destructive call would have required explicit access-class approval no policy can disable.
Vignette 03Embarrassing
The agent crashed, dumped a traceback, and you copy-pasted the whole thing into a Slack channel to ask for help. Without hasp, the shape of your AWS access key is now in a Slack message, a Slack search index, and Slack's compliance log.
The traceback you copied has [REDACTED_HEX] where the value would have been. You did not have to remember anything.
Source-available. SBOM, SLSA provenance, code-signing status, and reproducible-build sidecar ship inside the release artifact. scripts/hasp-verify-release.sh verifies the signed checksum manifest plus the tarball and binary signatures before install.
Homebrew
$ brew tap gethasp/tap
$ brew install gethasp/tap/hasp
$ hasp setup
$ hasp app connect myapp
$ hasp proof
→ ok proof passed · 412ms
→ ok vault unlocked · binding ./api
→ ok agent never read