Features

What CipherDock does today — and the roadmap items we refuse to sell as shipped.

CDCipherDock — Agent mode, in detail

Sample token flow

Sample · Detail view

A 15-minute token, not a pasted key.

Stop pasting API keys into an AI coding agent’s chat. CipherDock mints a scoped token, injects secrets as environment variables for one process, then lets the token expire — nothing lands in the prompt, on disk, or in a log.

Mint a scoped token

cipherdock agent-token webapp staging --ttl 900 — read-only, single environment.

15 min

Inject, never paste

cipherdock agent-exec hands the agent secrets as process env vars — values stay masked: ••••••••••

Env vars only

Expire and audit

The token auto-expires; every read it made is written to the hash-chained audit log.

Logged

Token scope

Project

webapp

Environment

staging only

Bound

Permission

read-only

Secrets shown to the agent

Masked in console: ••••••••

Masked

Denials are audit-logged too. A token that reaches beyond its scope fails closed — and the attempt is on the record.

Sample token flow — names are illustrative; no real secret values are shown.Agent mode · v1

Envelope encryption

AES-256-GCM per-project DEKs, wrapped by a PBKDF2-HMAC-SHA256 (600k iter) KEK derived from your master secret.

Project/env RBAC

owner/admin/developer/viewer/ci roles scoped to project + environment. Fail-closed; denials audit-logged.

Agent mode

Short-lived (≤3600s), read-only, scope-bound tokens for AI coding agents; agent-exec injects secrets as process env vars.

Rotation engine

Schedules + dry-run; keeps the old version for rollback.

CI/CD syncs

Export-based: dotenv files or paste-ready gh/glab commands.

One-command migration

Imports HCP-Vault-Secrets-style JSON, kv-JSON, or dotenv.

Hash-chained audit log

Append-only, tamper-evident; every grant, set, rotation, and login is recorded.

CLI + HTTP API

Full CLI for humans and scripts; bearer-token HTTP API for everything else.

One-binary self-host

Single process, shipped as one PyInstaller binary in the release bundle (checksums included).

Honest scope: what's real today

We'd rather tell you what's roadmap than let you discover it after signup.

Area	v1 reality
Rotation providers	One working rotator: stripe-api-key stub demonstrating the flow (mints rk_live_…, keeps old version). Production provider APIs are roadmap.
CI/CD syncs	Export-based stubs (dotenv, paste-ready gh/glab commands). Native API syncs are roadmap.
SSO/SAML	Roadmap — Enterprise tier. Not in v1.
One-binary build	Real: cut with PyInstaller and smoke-verified 2026-10-20 (init → serve → secret round-trip). The release bundle ships the binary + README-SELFHOST + Caddyfile with SHA-256 checksums.
Master secret	Single root of trust in an env var or 0600 file — no HSM/KMS yet. If it leaks, re-wrap DEKs under a new one.