GitHub follow the repo Draft spec v0 · first release in progress DRAFT SPEC V0 · FIRST RELEASE IN PROGRESS · AGEDROP .DEV

To: the machines that need it

Agents ask for secrets. They never see them.

agedrop keeps every secret as an age-encrypted file in your git repo. Anyone with the public keys can add one. Only the machines that run it can read it. No server, no database, no lock-in.

See how it works Read the spec

MIT licensed · open format · decrypts with the stock age CLI

~/infra · carbon copy sealed 
# the agent hits a missing key and asks for it
agent $ agedrop request mini/hq VAPID_PRIVATE_KEY \
          --reason "Web Push key for plan #50"
✓ filed request r7k2 → requests/r7k2.toml

# you answer it, from a laptop or your phone
you $ agedrop fulfil r7k2
value: ••••••••••••••••
✓ encrypted to libor, mac-mini
  secrets/mini/hq/VAPID_PRIVATE_KEY.age

# the server decrypts at start, nobody else can
mini $ agedrop exec mini/hq -- docker compose up -d

Secrets end up everywhere except somewhere safe.

One home server, ten .env files, no backup. agedrop started as the fix for exactly that.

How it works

Four steps, all of them plain files in git.

  1. 1 Say who may read what

    Each machine, CI runner and owner has an age key pair. Public keys go in recipients/. Scopes in agedrop.toml decide which keys can open which secrets. Owners can always open everything, so a human can always rekey. 

    # agedrop.toml
[recipients]
owners = ["libor"]
mini   = ["mac-mini"]
ci     = ["github-actions"]

[scopes."mini/hq"]
recipients = ["owners", "mini"]

  2. 2 An agent files a request

    A script or an AI agent that needs a value writes a small request file: scope, name, reason, and optionally how to generate it. The file holds no secret, so an agent can safely commit it. 

    # requests/r7k2.toml
scope        = "mini/hq"
name         = "VAPID_PRIVATE_KEY"
reason       = "Web Push key for plan #50"
requested_by = "hq plan session #52"
generate     = "openssl ecparam -genkey …"

  3. 3 You answer it

    Paste the value in the CLI or on a static web page. It is encrypted on your device to the scope's public keys, and the same commit deletes the request. Writing needs no private key at all, so CI and teammates can add secrets too. 

    $ agedrop fulfil r7k2
value: ••••••••••••
✓ secrets/mini/hq/VAPID_PRIVATE_KEY.age
✓ removed requests/r7k2.toml
$ git push

  4. 4 The machine runs with it

    The server pulls the repo and decrypts with its own key, straight into a process environment or an env file. The agent that asked gets a working service, never the value. 

    $ agedrop exec mini/hq -- docker compose up -d
$ agedrop pull ci/deploy --env .env.deploy
$ agedrop ls
mini/hq    VAPID_PRIVATE_KEY   2 min ago   libor
mini/hq    DATABASE_URL        12 days     libor
ci/deploy  CF_API_TOKEN        stale · run rekey

Your secrets outlive the tool.

Every secret is one armored age file. Delete agedrop tomorrow and the stock age CLI still opens all of it. Git gives you backup, history and a record of who changed what. There is nothing to host and nothing to keep alive.

Storage
your git repo
Server
none
Format
age v1, armored
License
MIT
infra-secrets/
├── agedrop.toml
├── agedrop.lock
├── recipients/
│   ├── libor.pub
│   └── mac-mini.pub
├── secrets/
│   └── mini/hq/
│       ├── DATABASE_URL.age
│       └── VAPID_PRIVATE_KEY.age
└── requests/
# no agedrop installed? still fine
$ age -d -i ~/.config/agedrop/identity \
    secrets/mini/hq/DATABASE_URL.age

Free and open source.

agedrop is MIT licensed. There are no plans, seats or limits: everything runs from your repo and your own devices.

What you get

  • CLI: add, request, fulfil, pull, exec, rekey
  • Static web UI to answer requests from any device
  • Unlimited secrets, machines and people
  • Request alerts through your own CI (ntfy, webhook)
  • Open format: plain age files, MIT license

Free MIT license

Follow on GitHub

What the alternatives ask for

Tool Free tier Catch
Infisical Cloud 5 identities, people and machines counted together Pro is $20 per identity per month
Phase Cloud 5 users or service accounts, 3 apps 24 h audit log on free
Self-hosted vault Software is free A server to patch and back up; services fail when it is down
SOPS + age Free Adding a value needs a private key; no request flow
agedrop Everything in the repo, no limits No read audit: git shows who changed a secret, not who read it

Vendor pricing as published on infisical.com and phase.dev, checked 9 November 2026.

Questions

Can I use it today?

Not yet. The file format is a public draft, and the CLI and web UI are being built in the open. The first release, v0.1, ships the CLI, requests, rekey and the web UI. Follow the repo to hear when it lands.

Where is the server?

There isn't one. Your git host stores the files, your devices encrypt, and each machine decrypts with its own key. Request alerts go out through your own CI, for example to ntfy or a webhook.

What does an agent actually get?

The right to write a request file. It never gets the value, the private key, or a token that can read either. Once you answer, the service it was working on starts with the secret in its environment.

Someone with push access could replace a secret, right?

Yes. They can't read it, but they could overwrite it. Protect secrets/ with branch rules or pull requests and signed commits. agedrop ls shows who changed each secret last.

What happens when I remove a laptop or a person?

Remove their public key and run agedrop rekey. Old commits stay readable with the old key, so rekey prints the list of secrets you should rotate.

What does agedrop not protect against?

Another process running as the same user on a machine that holds a key. It also has no read audit and does not issue short-lived credentials. If you need those, you need a server, and agedrop is not one.

Put your secrets where your code already is.

Follow agedrop on GitHub