Skip to main content
← back to extensions

Keepassxc

@magistr/keepassxcv2026.10.25.10· MIT· 1d agoVAULTS
01README

Swamp vault backed by a running KeePassXC, reached through its Browser Integration protocol via keepassxc-proxy — the same channel the KeePassXC-Browser extension uses. No master password is stored: the first call pops KeePassXC's "new connection" dialog and the resulting association key is kept in a 0600 file.

Each secret is one entry: URL swamp://<namespace>/<key>, username = key, password = value, in a configurable group (default swamp). list() returns every username under swamp://<namespace>.

Requires the KeePassXC GUI to be running with the database unlocked (a locked database triggers the unlock dialog and is retried), so it suits a workstation, not a headless swamp serve.

02Release Notes

2026.10.25.10

  • Repo-wide republish; no functional change.
03Vaults1
KeePassXCconfigurable
@magistr/keepassxcextensions/vaults/keepassxc/mod.ts

Secrets stored as entries in a running, unlocked KeePassXC, reached through its Browser Integration protocol (keepassxc-proxy). No master password is stored; access is granted once in KeePassXC's GUI.

Config Fields

FieldTypeDescription
namespace?stringHost part of entry URLs (swamp://<namespace>/<key>). Defaults to the vault name, sanitised.
group?stringKeePassXC group path for new entries, e.g. 'swamp' or 'Infra/swamp'.
proxyPath?stringPath to keepassxc-proxy. Defaults to the macOS app bundle, else PATH.
associationFile?stringWhere the association key is stored (mode 0600). Defaults to ~/.config/swamp/keepassxc/<vault>.json.
timeoutSeconds?numberPer-request wait; covers time spent answering KeePassXC dialogs.
triggerUnlock?booleanAsk KeePassXC to show its unlock dialog when the database is locked.
unlockWaitSeconds?numberHow long to keep retrying while the database is locked.
04Previous Versions11
2026.10.25.1MIT

2026.10.25.1

Changed

  • README: swamp vault put now prompts for secrets (hidden input) instead of taking them on the command line, where shell history keeps them.
2026.10.15.9MIT

2026.10.15.9

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.8MIT

2026.10.15.8

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.6MIT

2026.10.15.6

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.5MIT

2026.10.15.5

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.4MIT

2026.10.15.4

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.3MIT

2026.10.15.3

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.2MIT

2026.10.15.2

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.15.1MIT

2026.10.15.1

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.10.14.2MIT(was none)

2026.10.14.2

Changed

  • Repo-wide maintenance release: version bump to republish the current source. No schema change.
2026.09.30.1

2026.09.30.1

Added

  • Initial release. @magistr/keepassxc vault backed by a running KeePassXC through the Browser Integration protocol (keepassxc-proxy, NaCl box, native-messaging framing).
  • get / put / list over entries swamp://<namespace>/<key> (username = key, password = value) in a configurable group, created on first write.
  • One-time association via KeePassXC's GUI dialog; key stored at ~/.config/swamp/keepassxc/<vault>.json (mode 0600).
  • Locked database: triggerUnlock shows KeePassXC's unlock dialog and the call is retried for unlockWaitSeconds.
  • Idempotent put: an unchanged value sends no update (no GUI prompt).
  • Reply nonces are verified to be the incremented request nonce; ciphertext failing the MAC is rejected.
  • Wire-format fixtures captured from a live KeePassXC 2.7.11.
05Stats
A
100 / 100
Downloads
19
Archive size
29.2 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Docs keep secrets in a vault1/1earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/umag/swamp-workspace
06Platforms
07Labels
#vault#secrets#keepassxc#keepass#password-manager