Codex · Vardra workspace2 exact grants · connected locally
ActiveAgentic access control for macOS
Let agents act. Keep access under control.
Vardra brokers scoped, time-boxed secret access for named coding agents. Routine work can auto-allow; higher-risk requests stop for your approval; every decision stays locally auditable.
The free open beta is available now for Apple-silicon Macs. Create an account, verify your email, and download Vardra - no card required.
Named agentsScoped grantsLocal audit
Search agents, grants, and access events
Claude Code · Client delivery1 Ask-first grant · lease expired
ReviewCursor · Local sandboxNo grants · denied by default
BlockedExact capability
billing_test.api_key · executePolicy
Ask-first · 15 minutes · one useApprove onceDenyRevoke grant
The agentic access gap
Agents can act faster than access controls can keep up.
The problem is not where a password is stored. It is deciding which software identity may use a real credential, for what task, under what limits, with proof after the run.
The agent inherits a standing token
A credential meant for one task quietly becomes broad, reusable access with no expiry or attribution.
Every request gets the same answer
Blanket approval stops work; blanket permission removes control. Risk needs an explicit policy tier.
Nobody can prove what was used
After the run, shell history and model transcripts cannot establish which agent accessed which capability.
One local policy boundary
Govern access where agents actually work.
Native policy control
Approve only when risk requires it
Connect named agents, define exact grants, decide Ask-first requests, and revoke access from the same Mac.Apple-silicon macOS v0.1 targetCLI and MCP broker
Trusted execution with output withheld
Vardra injects the leased value into a trusted child and returns exit metadata while withholding arbitrary child output.Apple-silicon macOS CLI bundleTrust boundary
Scoped use. Trusted children. Output withheld.
Named identities, exact grants and local decisions govern broker admission. The child possesses the credential. Same-user processes are inside the OS-account trust boundary; withholding child output does not prevent arbitrary exfiltration. No server-side vault key is required.
Read the security modelName the agent
Connect a named coding agent with its own expiring broker identity and exact grants.
Grant one capability
Bind an exact secret field, action, expiry, lease duration, use cap, and Auto-allow or Ask-first risk tier.
Broker the work
The trusted child receives the credential. Vardra withholds arbitrary child output; this is not a sandbox or an exfiltration defense.
Audit and revoke
Revoke the next broker use. This does not cancel an already-admitted child or erase credential copies it holds.
Objections answered
What operators need to know before trusting an access broker.
Is Vardra a password manager?
Vardra is an access broker for AI agents backed by a local encrypted vault. It governs scoped use and withholds arbitrary child output; trusted child processes still hold credentials.
Where do my secrets actually live?
The readable vault opens on your device. If sync is enabled, Vardra relays encrypted payloads that are useless without your local unlock material.
Can Vardra reset my master password?
No. That is the security boundary. Recovery has to come from material you control, not a support override that could open the vault.
Does this replace `.env` files?
For local development, that is the direction: keep canonical values in Vardra and inject only what a process needs. v0.1 starts with native vault and CLI/headless workflows; richer dev-tool guardrails graduate from there.
What happens if a device is lost?
Revoke that device from your account and continue from another paired device or your recovery material. A lost device does not give Vardra plaintext access.
Is this only a desktop app?
No. Vardra pairs the native Apple-silicon macOS vault with command-line and MCP workflows on the same supported platform.
Does revocation disable an offline capsule?
Not retroactively. Daemon-served capsule reads require unlocked state and live authority. Offline capsule/key loading checks local expiry and embedded scope, not live daemon lock or revocation.
Launch path