Vault, one of the four pillars.

The Vault: secrets an agent can use and never read.

Vyre keeps passwords, keys, sign-ins and cards sealed on disk. It hands one item at a time to the person, module or agent that holds a grant for it, and a model never sees a value.

AES-256-GCM, a key per item versionUse-only grants for agentsEvery reveal and use is loggedA person’s yes to reveal

A sealed value, in motion

An agent uses a credential. The model sees a name.

An agent asks for a use and never for a value. It names the item, and the system attaches the key at the moment of sending, after the door has checked the grant and, for anything that leaves, after a person has said yes.

The grant is a kernel factLending a login to an agent is a kernel grant on one item: the agent’s stable id, one action, one exact site, until an expiry. The Vault keeps no table of who may use what.
Items you cannot use do not existA model is told about an item only if it holds a grant on it. Any other name answers as if it were not there.
A missing sign-in is a stuck taskThe agent marks the task stuck with a fix that names the item, and the person’s card opens the Add sheet.

Animation: what a send with a vault credential does

What it stores.

Every kind of secret a team keeps.

Ten groups, in one list, in the sidebar and in the Add picker. Adding an item shows the fields of the chosen provider in its own console’s order.

AI modelsEmail and sendingPhone and textsGoogle and MicrosoftCode and hostingMessagingLoginsSSH keysSecure notesAny API key

Passwords and logins

A login holds a username, a password and a one-time code seed. An authenticator item holds a one-time code seed on its own.

API keys and tokens

Personal access tokens, OAuth tokens with their refresh token and client secret, cloud keys and plain secrets. The Add picker knows the services a module may need and where to get each key.

Cards and identities

A card keeps the number, holder, expiry, CVV and PIN. Identities and addresses keep the details a form asks for.

Notes, files and licences

Secure notes, files, licence keys and Wi-Fi passwords sit next to the credentials they belong with.

SSH keys and certificates

Private keys and certificates with their chain and passphrase, for the servers an agent deploys to.

AI sign-ins

A member signs in to an AI provider with the provider’s own sign-in and adds no API key as their own AI account.

Connections

Mail, calendar and MCP connections are vault items too, with a health word: Healthy, Expiring, Expired or Unused.

Member vaults

Each member has a vault of their own on the Space’s server. The owner’s vault is the Space’s, and shared vaults between people have the roles admin, member and read-only.

How a secret is kept.

Sealed at rest, with a key per item.

The cryptography uses only the standard library of the runtime. Nothing here is a package you have to trust.

1Master password plus Secret KeyArgon2id (or scrypt) turns the password into a key. The Secret Key is made with the account and shown once, for the recovery kit.
2The vault keyOpens the personal vault. A device key opens the agent vault.
3An item keyEach version of each item has its own key, wrapped under the vault key.
4AES-256-GCMThe value is sealed on disk. A change is a new version, so history is kept sealed too.

The server holds ciphertext only.For a member vault, the member’s own device supplies the Secret Key at each unlock.
Sealing for another person.An item can be sealed for another person’s Vyre with X25519. Ed25519 signs relay requests.
The Secret Key never lands in a log.It appears in no event and no audit row. It is served once from loopback for the recovery kit.
It locks itself.After 10 minutes idle or 12 hours at most, and optionally on sleep or screen lock. All four are settings.

Who can use what.

Sharing is a grant, not a copy.

A person, an agent and a task each get access the same way: a kernel grant on one item, ended by revoking it.

A person

Can use, without seeing it. Or Can edit, which also changes or replaces it. The grant is on one item and one current member, and ending it needs no one.

An agent

Use only. It signs in on its own computer by driving the page, at one exact origin, until an expiry. It gets back { filled, origin, navigated, tab } and never a field. A grant a model asks for waits for a person.

A task

The Flows module lends the doer the Connections the task’s approved Kit version names, use only, until a time, and takes them back when the task ends. Anything outward still waits for a yes.

Reveal, copy and fill need a person.A reveal stays up 60 seconds. A copied value leaves the clipboard after 30. One yes covers a reveal, copy or code for 5 minutes, on the same device and person.
An agent is never “you”.A model, module or guest cannot give the yes. The events record the field name, never the value.
A module asks, the Vault answers.A module calls the grant check, then asks for one field. It receives only a field it was granted.
Taking access away is free.Revoking needs no one. Granting from a model always waits.

In the app.

The real screen, with sample data.

The Vyre Vault screen. A list of items grouped by AI models, Code and hosting and Logins, and an open item showing a hidden value, who uses it and who has it. Sample data. — The Vault in the app. The value stays hidden until revealed, the item shows who uses it and who has it, and every use is logged. Sample data.

For agents

What an agent can ask, and what only a person can do.

Open to modelsvault.list, vault.item, vault.search and vault.history return names, kinds, field names and hosts. Never a value.
Waits for a personvault.grant from a model becomes a request. vault.approve is a person’s call.
Person surfaces onlyvault.put, vault.reveal, vault.copy, vault.inject, vault.rotate and vault.access.set refuse a model.

Callers and what they get

A person: Reveal, copy and fill, on their own device, after a presence check
A module: One granted field, through the grant check
An agent: A use of one item, at one origin, until an expiry
A model: Names and kinds

Events: vault.released, vault.filled, vault.refused, vault.lease-lent

Coming next

0.5.1: credentials lent to a woken agent for one job, use only, so an agent’s task can carry the sign-in it needs and nothing else.

Direction, not a shipped feature. Dates and scope live on the direction page.

Extend it

Bring your own software stack, or build a module.

Vyre can be extended by integrating your Zoho, QuickBooks, RingCentral and the rest of your software stack*. Today, add the item as a login or API key and write a custom module that asks the Vault for it. The module never sees a value it was not granted.

*where the vendor provides an API

Two ways in

Coming in 0.5.2: Integrations, packaged as modules, for the software a firm already runs.
Today: A connection in the Vault plus a Flow web step, or a custom module. It passes through the same grants and checks as any other.
Over MCP: An AI agent connected over Vyre’s MCP can help set this up. It acts as the person who connected it, within its key’s reach, and the Gate still holds anything that leaves.

Modules and Integrations: how to extend Vyre

Connects to.

How it fits with the rest of Vyre.

RecordsA sealed record field uses the same sealing process. A model sees a placeholder where the value is.Open →FlowsA Flow step lends a task its connections. A send that uses one waits for a yes.Open →AgentsAn agent has a list of the Vault items its person gave it, use only.Open →The GateWhere a held send that uses a credential waits for a person’s yes.Open →Vault, in the repositoryThe feature page with every code path.Open →

Code paths: core/vault/crypto.js · core/vault/access.js · core/vault/agent-fill.js · core/vault/people.js · lib/sealed.js

See it working.

Set up Vyre Point your AI agent at the repo