Arsenal
Agent-native API key management with short-lived, scoped Agent Capability Tokens (ACTs). Minimizes blast radius through proof-of-possession binding, cryptographically-linked audit trails, and least-privilege scoping.
Capabilities
Agent Capability Token (ACT) framework
Short-lived tokens (30s to 10min TTL)
Proof-of-possession binding
mTLS-required broker communication
Encrypted secret storage
Hash-chained audit logging
7 Crates
Inside Arsenal
Every crate in the Arsenal workspace, what it does, and how it fits together.
arsenal-core
8.2K LOCACT token format, scope model (service:resource:action), and token lifecycle. Defines the CapabilityToken type with all constraint fields.
arsenal-crypto
6.1K LOCEd25519 + X25519 key operations, XChaCha20-Poly1305 encryption, HKDF key derivation, and constant-time token comparison.
arsenal-store
9.4K LOCEncrypted secret storage with in-memory, file, and database backends. All secrets encrypted with XChaCha20-Poly1305.
arsenal-policy
7.8K LOCDeclarative policy engine with CBOR serialization. 6 constraint types: device, session, origin, network, time window, environment.
arsenal-broker
12.3K LOCmTLS-required broker gateway. Validates proof-of-possession, enforces scope narrowing, and manages secret injection.
arsenal-sdk
5.6K LOCClient SDK for requesting and managing ACTs. Handles token refresh, scope negotiation, and audit log submission.
arsenal-audit
8.9K LOCHash-chained audit logging with tamper detection. Each entry links to the previous via BLAKE3 hash.
Cryptography
Available in
Install